xxhash 3.6.1

Source: https://github.com/ifduyue/python-xxhash
Artifact scanned: xxhash-3.6.1.tar.gz (sdist · 1.1 MB · SHA-256 98677a70ca73…)
Compared with: xxhash-3.6.0.tar.gz (12 signals introduced since)
Files: 80 scanned, 34 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 24 info
Scan time: 13.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 15 of 15 warn and critical signals; 15 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 14:14

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:121:42 new in this release

[embedded bash] command name is a variable (`$CC`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && type $CC && which $CC && $CC --version
        echo && type $CXX && which $CXX && $CXX --version
        echo && type make && make -v
```
likely benign LLM, confidence 0.90 CI step echoing the configured C compiler version using the $CC variable.
Reasoning
Standard CI step printing compiler version via $CC; the variable is set by the workflow matrix/env, a common and benign pattern in xxhash's CI.
info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:122:44 new in this release

[embedded bash] command name is a variable (`$CXX`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && type $CC && which $CC && $CC --version
        echo && type $CXX && which $CXX && $CXX --version
        echo && type make && make -v
        echo && cat /proc/cpuinfo || echo /proc/cpuinfo is not present
```
likely benign LLM, confidence 0.90 CI step printing compiler and CPU diagnostics using $CXX.
Reasoning
Same benign pattern as the $CC line: prints the C++ compiler configured via $CXX and checks /proc/cpuinfo for diagnostics.
info ~~critical~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:204:171 new in this release

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
        # Run "make check" if /proc/cpuinfo has flags for avx512.
        grep -q "^flags.*\bavx512\b" /proc/cpuinfo && CPPFLAGS="-mavx512f -DXXH_VECTOR=XXH_AVX512" make clean check || (echo This test runner does not support AVX512. && $(exit 0))
```
likely benign LLM, confidence 0.85 Conditional AVX512 test runner logic using a no-op command substitution fallback.
Reasoning
The $(exit 0) and $(exit 1) substitutions are inert no-op constructs used as fallback in a shell chain; the grep for avx512 flags is legitimate test-selection logic. Flagged only because the scanner cannot resolve the command name.
info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:436:17 new in this release

[embedded bash] command name is a variable (`$XCC`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && which $XCC
        echo && $XCC --version
        echo && $XCC -v  # Show built-in specs
        echo && which $XEMU
```
likely benign LLM, confidence 0.90 CI step reporting cross-compiler version via $XCC.
Reasoning
Compiler version reporting using $XCC set by the build matrix for cross-compilation toolchains; routine in CI.
info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:437:17 new in this release

[embedded bash] command name is a variable (`$XCC`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && $XCC --version
        echo && $XCC -v  # Show built-in specs
        echo && which $XEMU
        echo && $XEMU --version
```
likely benign LLM, confidence 0.90 CI step printing cross-compiler version and specs via $XCC.
Reasoning
Routine version/spec output for the cross-compiler variable $XCC in a CI job.
info ~~warn~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:439:17 new in this release

[embedded bash] command name is a variable (`$XEMU`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
        echo && which $XEMU
        echo && $XEMU --version
```
likely benign LLM, confidence 0.90 CI step checking the emulator binary configured via $XEMU.
Reasoning
Routine emulator presence/version check using $XEMU in a cross-compilation CI job.
info ~~warn~~ → info by review obfuscated-command-name deps/xxhash/.github/workflows/ci.yml:544:9 new in this release

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
        .\cmake_unofficial\build\Release\xxhsum.exe -bi1
```
likely benign LLM, confidence 0.90 Runs the freshly built Windows xxhsum.exe benchmark via a backslash path.
Reasoning
Backslashes are Windows path separators in a PowerShell/cmd invocation of the locally built xxhsum.exe; not obfuscation.
info ~~warn~~ → info by review obfuscated-command-name deps/xxhash/.github/workflows/ci.yml:559:9 new in this release

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
        .\cmake_unofficial\build-clang-cl\Release\xxhsum.exe -bi1
```
likely benign LLM, confidence 0.90 Runs the clang-cl built xxhsum.exe with Windows path separators.
Reasoning
Windows path separators to a locally built binary in a CI benchmark step; benign.
info ~~warn~~ → info by review obfuscated-command-name deps/xxhash/.github/workflows/ci.yml:575:9 new in this release

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
        .\cmake_unofficial\build-clang-cl-dispatch\Release\xxhsum.exe -V | grep autoVec
        .\cmake_unofficial\build-clang-cl-dispatch\Release\xxhsum.exe -bi1
```
likely benign LLM, confidence 0.90 Runs the dispatch-built xxhsum.exe from a Windows build directory.
Reasoning
Windows backslash paths to the locally built dispatch binary in CI; the flagged signal is a false positive from path syntax.
info ~~warn~~ → info by review obfuscated-command-name deps/xxhash/.github/workflows/ci.yml:576:9 new in this release

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
        .\cmake_unofficial\build-clang-cl-dispatch\Release\xxhsum.exe -V | grep autoVec
        .\cmake_unofficial\build-clang-cl-dispatch\Release\xxhsum.exe -bi1
```
likely benign LLM, confidence 0.90 Runs the dispatch-built xxhsum.exe from a Windows build directory.
Reasoning
Duplicate of the adjacent step with the same Windows path syntax; benign.
info ~~critical~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:619:51 new in this release

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
          # Expected output is "./xxhsum.exe: PE32+ executable (console) x86-64, for MS Windows"
          file ./xxhsum.exe | grep -q 'x86-64' || $(exit 1)
          ./xxhsum.exe --version
```
likely benign LLM, confidence 0.85 Verifies the built xxhsum.exe architecture with file and fails via a no-op substitution.
Reasoning
Uses $(exit 1) as an inert failure fallback after a file-type check on the built binary; the file command verifies architecture. No malicious payload.
info ~~critical~~ → info by review dynamic-execution deps/xxhash/.github/workflows/ci.yml:629:50 new in this release

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
          # Expected output is "./xxhsum.exe: PE32 executable (console) Intel 80386, for MS Windows"
          file ./xxhsum.exe | grep -q '80386' || $(exit 1)
          ./xxhsum.exe --version
```
likely benign LLM, confidence 0.85 Verifies the 32-bit xxhsum.exe architecture with file and fails via a no-op substitution.
Reasoning
Same architecture-check pattern for the 32-bit Windows binary; benign CI verification.
info identifier-low-length bench.sh:1:1

40 of 70 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)

info dynamic-execution bench.sh:8:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh32_intdigest     1000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh32_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:16:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh32_intdigest    10000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh32_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:25:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh64_intdigest     1000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh64_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:33:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh64_intdigest    10000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh64_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:42:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh3_64_intdigest   1000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh3_64_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:50:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh3_64_intdigest  10000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh3_64_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:59:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh3_128_intdigest  1000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh3_128_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info dynamic-execution bench.sh:67:1

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

echo -n "    xxh3_128_intdigest 10000B: "
$PYTHON -mtimeit -s 'from xxhash import xxh3_128_intdigest' \
                 -s 'import os'  \
                 -s 'import random' \

info ~~warn~~ → info by review macro-keyword-override deps/xxhash/xxhash.h:3433:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
   || (defined(__wasm_simd128__) && XXH_HAS_INCLUDE(<arm_neon.h>)) /* WASM SIMD128 via SIMDe */
#    define inline __inline__  /* circumvent a clang bug */
#    include <arm_neon.h>
#    undef inline
```
likely benign LLM, confidence 0.90 Temporarily redefines inline to __inline__ while including arm_neon.h to work around a clang bug.
Reasoning
Temporary #define inline around an arm_neon.h include is a known workaround for a clang bug, immediately undone with #undef. Not malicious, though it is a legitimate macro-keyword override.
info ~~warn~~ → info by review identifier-confusable-collision deps/xxhash/xxhash.h:4294:23

two identifiers collapse to visual skeleton `bitf|ip|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
    XXH_ASSERT(9 <= len && len <= 16);
    {   xxh_u64 const bitflip1 = (XXH_readLE64(secret+24) ^ XXH_readLE64(secret+32)) + seed;
        xxh_u64 const bitflip2 = (XXH_readLE64(secret+40) ^ XXH_readLE64(secret+48)) - seed;
        xxh_u64 const input_lo = XXH_readLE64(input)           ^ bitflip1;
```
likely benign LLM, confidence 0.90 Vendored xxHash C header with local variables bitflip1 and bitflip2 whose names trigger a visual-confusability heuristic.
Reasoning
The skeleton collision comes from ordinary local names like bitflip1 and bitflip2 in the vendored, well-known xxHash header. The confusable-name heuristic fires on a digit-versus-letter lookalike in normal arithmetic code, and the snippet shows no obfuscation or malicious behaviour. This is a token-pass finding, which has a higher false-positive rate.
info ~~critical~~ → info by review dynamic-execution setup.py:31:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
version_dict = {}
exec(d.joinpath("xxhash", "version.py").read_text(), {}, version_dict)
version = version_dict["VERSION"]
```
likely benign LLM, confidence 0.80 setup.py executes the package's own xxhash/version.py to read the VERSION string during build.
Reasoning
setup.py reads xxhash/version.py from the project's own source tree and executes it into a dict to extract VERSION, a common single-source version pattern. The exec runs only when setup.py is executed for build or install, not at import time of the package. The source is a local project file, not a remote or encoded payload, so the non-literal argument is not by itself malicious. Residual doubt remains because the flagged exec is at module scope in a build script.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o xxhash-3.6.1.tar.gz https://files.pythonhosted.org/packages/a6/2f/b71ad84d2eba03fb39a6788e45ce43873e6da6cbe28e00b784e5b8e720f4/xxhash-3.6.1.tar.gz
printf '%s  %s\n' 98677a70ca735ed527985504130e0a802e81e18bccc525ae1dcf2180acf51104 xxhash-3.6.1.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf xxhash-3.6.1.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg