xxhash 3.4.2

Source: https://github.com/ifduyue/python-xxhash
Artifact scanned: xxhash-3.4.2.tar.gz (sdist · 1.1 MB · SHA-256 b4525f5ee08d…)
Compared with: xxhash-3.4.1.tar.gz (12 signals introduced since)
Files: 80 scanned, 34 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 25 info
Scan time: 13.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 16 of 16 warn and critical signals; 16 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 14:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:121:42 new in this release

[embedded bash] command name is a variable (`$CC`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && type $CC && which $CC && $CC --version
        echo && type $CXX && which $CXX && $CXX --version
        echo && type make && make -v
```
likely benign LLM, confidence 0.90 CI step echoing the configured C compiler version using the CC environment variable.
Reasoning
Standard CI step printing compiler versions via $CC; the variable is set by the workflow matrix/env, which is normal for CI config.
info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:122:44 new in this release

[embedded bash] command name is a variable (`$CXX`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && type $CC && which $CC && $CC --version
        echo && type $CXX && which $CXX && $CXX --version
        echo && type make && make -v
        echo && cat /proc/cpuinfo || echo /proc/cpuinfo is not present
```
likely benign LLM, confidence 0.90 CI step printing the C++ compiler version via the CXX variable.
Reasoning
Same pattern as the CC line: CXX is an environment-provided compiler variable used to print its version in a CI job.
info ~~critical~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:204:171 new in this release

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
        # Run "make check" if /proc/cpuinfo has flags for avx512.
        grep -q "^flags.*\bavx512\b" /proc/cpuinfo && CPPFLAGS="-mavx512f -DXXH_VECTOR=XXH_AVX512" make clean check || (echo This test runner does not support AVX512. && $(exit 0))
```
likely benign LLM, confidence 0.85 Conditional make invocation gated on AVX512 CPU flags, with a no-op substitution fallback.
Reasoning
The '$(exit 0)' and '$(exit 1)' constructs are no-op fallbacks used to force a step result; the flagged substitution is trivially benign and the surrounding logic checks AVX512 support via /proc/cpuinfo for test selection.
info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:436:17 new in this release

[embedded bash] command name is a variable (`$XCC`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && which $XCC
        echo && $XCC --version
        echo && $XCC -v  # Show built-in specs
        echo && which $XEMU
```
likely benign LLM, confidence 0.90 CI diagnostic step printing cross-compiler info via XCC variable.
Reasoning
XCC is a cross-compiler variable set by the CI matrix for a cross-build job; printing its version and specs is ordinary CI diagnostics.
info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:437:17 new in this release

[embedded bash] command name is a variable (`$XCC`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && $XCC --version
        echo && $XCC -v  # Show built-in specs
        echo && which $XEMU
        echo && $XEMU --version
```
likely benign LLM, confidence 0.90 CI step running the cross-compiler version command via XCC.
Reasoning
Same as the adjacent XCC lines: version checks for a configured cross compiler in CI.
info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:439:17 new in this release

[embedded bash] command name is a variable (`$XEMU`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && which $XEMU
        echo && $XEMU --version
```
likely benign LLM, confidence 0.90 CI step printing the emulator version via XEMU variable.
Reasoning
XEMU is an emulator variable used to report version for cross-architecture test runs; standard CI practice.
info ~~warn~~ → info by review obfuscated-command-name deps/xxhash/.github/workflows/ci.yml:544:9 new in this release

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
        .\cmake_unofficial\build\Release\xxhsum.exe -bi1
```
likely benign LLM, confidence 0.90 Windows CI step running the freshly built xxhsum.exe benchmark.
Reasoning
The backslash path is a normal Windows relative path to the built xxhsum.exe in a CMake build directory; the 'escape sequences' are just path separators in a PowerShell/cmd step.
info ~~warn~~ → info by review obfuscated-command-name deps/xxhash/.github/workflows/ci.yml:559:9 new in this release

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
        .\cmake_unofficial\build-clang-cl\Release\xxhsum.exe -bi1
```
likely benign LLM, confidence 0.90 Windows CI step running xxhsum.exe from a clang-cl build directory.
Reasoning
Ordinary Windows build-output path to xxhsum.exe; backslashes are path separators, not obfuscation.
info ~~warn~~ → info by review obfuscated-command-name deps/xxhash/.github/workflows/ci.yml:575:9 new in this release

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
        .\cmake_unofficial\build-clang-cl-dispatch\Release\xxhsum.exe -V | grep autoVec
        .\cmake_unofficial\build-clang-cl-dispatch\Release\xxhsum.exe -bi1
```
likely benign LLM, confidence 0.90 Windows CI step invoking the built xxhsum.exe for a dispatch build.
Reasoning
Normal Windows paths to the built binary for a dispatch-variant test; the flagged backslashes are path separators.
info ~~warn~~ → info by review obfuscated-command-name deps/xxhash/.github/workflows/ci.yml:576:9 new in this release

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
        .\cmake_unofficial\build-clang-cl-dispatch\Release\xxhsum.exe -V | grep autoVec
        .\cmake_unofficial\build-clang-cl-dispatch\Release\xxhsum.exe -bi1
```
likely benign LLM, confidence 0.90 Windows CI step running the built xxhsum.exe benchmark.
Reasoning
Duplicate of the previous step's benchmark invocation with the same ordinary Windows build path.
info ~~critical~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:619:51 new in this release

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
          # Expected output is "./xxhsum.exe: PE32+ executable (console) x86-64, for MS Windows"
          file ./xxhsum.exe | grep -q 'x86-64' || $(exit 1)
          ./xxhsum.exe --version
```
likely benign LLM, confidence 0.85 Windows-target CI check verifying the built xxhsum.exe architecture with file.
Reasoning
The '|| $(exit 1)' is a no-op fallback that fails the step if the file type check misses; the executed binary is the one just built by the workflow.
info ~~critical~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:629:50 new in this release

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
          # Expected output is "./xxhsum.exe: PE32 executable (console) Intel 80386, for MS Windows"
          file ./xxhsum.exe | grep -q '80386' || $(exit 1)
          ./xxhsum.exe --version
```
likely benign LLM, confidence 0.85 CI check verifying the 32-bit Windows build of xxhsum.exe.
Reasoning
Same pattern as the x86-64 check: a no-op '$(exit 1)' fallback asserting the 32-bit PE architecture of the locally built binary.
info identifier-low-length bench.sh:1:1

40 of 70 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)

info dynamic-execution bench.sh:8:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh32_intdigest     1000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh32_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:16:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh32_intdigest    10000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh32_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:25:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh64_intdigest     1000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh64_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:33:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh64_intdigest    10000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh64_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:42:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh3_64_intdigest   1000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh3_64_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:50:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh3_64_intdigest  10000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh3_64_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:59:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh3_128_intdigest  1000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh3_128_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:67:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh3_128_intdigest 10000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh3_128_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info ~~warn~~ → info by review macro-keyword-override deps/xxhash/xxhash.h:3433:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
   || (defined(__wasm_simd128__) && XXH_HAS_INCLUDE(<arm_neon.h>)) /* WASM SIMD128 via SIMDe */
#    define inline __inline__  /* circumvent a clang bug */
#    include <arm_neon.h>
#    undef inline
```
likely benign LLM, confidence 0.90 Temporary redefinition of inline around a NEON header include to work around a clang bug.
Reasoning
Temporary #define inline __inline__ wrapped around an arm_neon.h include, with an #undef afterward; this is a documented workaround for a clang bug in the SIMDe/NEON header path, and it is a token-level warning only.
info ~~warn~~ → info by review identifier-confusable-collision deps/xxhash/xxhash.h:4294:23

two identifiers collapse to visual skeleton `bitf|ip|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
    XXH_ASSERT(9 <= len && len <= 16);
    {   xxh_u64 const bitflip1 = (XXH_readLE64(secret+24) ^ XXH_readLE64(secret+32)) + seed;
        xxh_u64 const bitflip2 = (XXH_readLE64(secret+40) ^ XXH_readLE64(secret+48)) - seed;
        xxh_u64 const input_lo = XXH_readLE64(input)           ^ bitflip1;
```
dismissed LLM, confidence 0.93 Local variables bitflip1 and bitflip2 in the vendored xxHash3 implementation collide under confusable-character normalization.
Reasoning
The flagged identifiers are bitflip1 and bitflip2 in standard xxHash3 code. Their skeleton collision comes from treating digits 1 and 2 and letters as confusable, which is a known false positive for ordinary numbered local names. The snippet is ordinary arithmetic on secret bytes with no hidden or obfuscated content.
info ~~warn~~ → info by review decoder-import-with-exec setup.py:35:1

file imports decoder module(s) codecs and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
version_dict = {}
exec(Path(__file__).parent.joinpath("xxhash", "version.py").read_text(), {}, version_dict)
version = version_dict["VERSION"]
```
likely benign LLM, confidence 0.90 setup.py execs the package's own version.py to read the VERSION constant at build time.
Reasoning
The setup script reads xxhash/version.py from the package's own directory and execs it into a dict to extract VERSION. This is the common pattern for single-sourcing a version string. The codecs-import signal is generic and nothing in the snippet decodes a hidden payload or reaches the network.
info ~~critical~~ → info by review dynamic-execution setup.py:35:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
version_dict = {}
exec(Path(__file__).parent.joinpath("xxhash", "version.py").read_text(), {}, version_dict)
version = version_dict["VERSION"]
```
likely benign LLM, confidence 0.88 Module-level exec of the local xxhash/version.py file to load VERSION during setup.
Reasoning
This is the same exec of a repository-local version.py file into a separate dict, which is a standard version-extraction idiom. The argument is not attacker-controlled and the file is part of the source tree. The critical severity reflects the non-literal exec pattern alone, not any malicious behaviour in context.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o xxhash-3.4.2.tar.gz https://files.pythonhosted.org/packages/19/66/3f81b97574acdc085c295d2dcdb2538107b349d4533e7441a9269ffe638e/xxhash-3.4.2.tar.gz
printf '%s  %s\n' b4525f5ee08dbf3ddd007426c5ec4a848ecc5e6a05fd0b745e6d5e7cfba03d15 xxhash-3.4.2.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf xxhash-3.4.2.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg