websocket-client 1.9.2

Source: https://github.com/websocket-client/websocket-client
Artifact scanned: websocket_client-1.9.2-py3-none-any.whl (wheel · 93.5 KB · SHA-256 e1a673830a9c…)
Compared with: websocket_client-1.9.1-py3-none-any.whl (0 signals introduced since)
Files: 38 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 3.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 07:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection websocket/_app.py:586:69

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
                    debug(
                        f"Calling custom dispatcher reconnect [{len(inspect.stack())} frames in stack]"
                    )
                    assert dispatcher is not None
```
likely benign LLM, confidence 0.95 Debug log that counts call-stack frames during a custom dispatcher reconnect in websocket-client.
Reasoning
inspect.stack() is used only to log the number of frames in a debug message inside the websocket-client reconnect logic. This is a diagnostic, not evasion or execution of hidden code.
info ~~warn~~ → info by review frame-introspection websocket/_app.py:605:62

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
                    debug(
                        f"Calling dispatcher reconnect [{len(inspect.stack())} frames in stack]"
                    )
                    dispatcher.reconnect(reconnect, initialize_socket)
```
likely benign LLM, confidence 0.95 Debug logging of stack depth before a standard dispatcher reconnect call.
Reasoning
Same pattern: inspect.stack() length is interpolated into a debug log message before calling dispatcher.reconnect. Harmless diagnostic in a legitimate WebSocket library.
info ~~warn~~ → info by review frame-introspection websocket/_dispatcher.py:51:69

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
            info(
                f"reconnect() - retrying in {seconds} seconds [{len(inspect.stack())} frames in stack]"
            )
            time.sleep(seconds)
```
likely benign LLM, confidence 0.95 Info log of stack depth while retrying a reconnect with a sleep delay.
Reasoning
inspect.stack() is used to add frame count to an info log line before a sleep-based retry. No malicious behavior is present; it is a logging detail in a well-known library.
info ~~warn~~ → info by review decoder-decompress-payload websocket/_wsdump.py:178:44

file imports decoder module(s) gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
                try:
                    data = "[gzip] " + str(gzip.decompress(data), "utf-8")
                except:
                    pass
```
likely benign LLM, confidence 0.90 Gzip decompression of received WebSocket frame data for display in the wsdump utility.
Reasoning
wsdump is the websocket-client command-line tool that optionally decompresses gzip-compressed frames it receives for display. The decompress call operates on data from the socket for display, wrapped in a try/except, which is a normal feature rather than an embedded payload being executed.

info unicode-homoglyph websocket/tests/test_websocket.py:498:32

identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)

        self.assertEqual(state, True)
        state = validate_utf8("κόσμε")
        self.assertEqual(state, True)
        state = validate_utf8("a\ud800b")

info unicode-mixed-script websocket/tests/test_websocket.py:498:32

identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

        self.assertEqual(state, True)
        state = validate_utf8("κόσμε")
        self.assertEqual(state, True)
        state = validate_utf8("a\ud800b")

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o websocket_client-1.9.2-py3-none-any.whl https://files.pythonhosted.org/packages/d5/d2/cc4dc1271e464942db7ee278baae2daa99ee77cb2af744025c04da585a3e/websocket_client-1.9.2-py3-none-any.whl
printf '%s  %s\n' e1a673830a9c7bfa47b1cd3d5e4178f4c9651d80a4eab02c9c23a1c3ec6250ce websocket_client-1.9.2-py3-none-any.whl | shasum -a 256 -c -
unzip -q websocket_client-1.9.2-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg