PyPI / xxhash / 4.0.2

xxhash 4.0.2

Source

https://github.com/ifduyue/python-xxhash

Artifact scanned

xxhash-4.0.2.tar.gz (sdist · 99.2 KB · SHA-256 af3d1b3cfa52…)

Compared with

xxhash-4.0.1.tar.gz (0 signals introduced since)

Files

27 scanned, 8 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

5.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 09:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review macro-keyword-override deps/xxhash/xxhash.h:3851:1

   `#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)

      || (defined(__wasm_simd128__) && XXH_HAS_INCLUDE(<arm_neon.h>)) /* WASM SIMD128 via SIMDe */
   #    define inline __inline__  /* circumvent a clang bug */
   #    include <arm_neon.h>
   #    undef inline

   likely benign LLM, confidence 0.90 Temporary #define of inline around an arm_neon.h include in the vendored xxHash header, a documented clang workaround.

   Reasoning

   This is the standard xxHash header workaround that temporarily redefines inline around including arm_neon.h to work around a clang bug, then undefines it. It is a known legitimate compatibility pattern and not obfuscation; the raw macro-keyword pass flags it only because it touches a keyword.

2. info warn → info by review identifier-confusable-collision deps/xxhash/xxhash.h:4684:23

   two identifiers collapse to visual skeleton `bitf|ip|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)

       XXH_ASSERT(9 <= len && len <= 16);
       {   xxh_u64 const bitflip1 = (XXH_readLE64(secret+24) ^ XXH_readLE64(secret+32)) + seed;
           xxh_u64 const bitflip2 = (XXH_readLE64(secret+40) ^ XXH_readLE64(secret+48)) - seed;
           xxh_u64 const input_lo = XXH_readLE64(input)           ^ bitflip1;

   likely benign LLM, confidence 0.90 Two ordinary local variable names in xxHash's hashing routine collide under visual-skeleton normalization.

   Reasoning

   The flagged identifiers bitflip1 and bitflip2 are ordinary variable names in the xxHash 9-16 byte path. The confusable collision is an artifact of the skeleton normalization (l/1 and i/l-like letters), not hidden code. The surrounding code is the standard published xxHash algorithm.

3. info critical → info by review dynamic-execution setup.py:28:1

   `exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

   version_dict = {}
   exec(d.joinpath("xxhash", "version.py").read_text(), {}, version_dict)
   version = version_dict["VERSION"]

   likely benign LLM, confidence 0.90 Build script execs the package's own version.py to read the VERSION string, a common packaging pattern.

   Reasoning

   setup.py execs the contents of xxhash/version.py, a file shipped in the package itself, into a dict to read VERSION. This is a common packaging idiom for reading a version without importing the package. The exec runs at module scope in setup.py, which is typical for build scripts, and the target is a local, known file rather than network or encoded data. Still a dynamic exec, so some residual doubt remains.

4. info critical → info by review dynamic-import tests/test_interpreters.py:19:19

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

           try:
               mod = __import__(name)
               if hasattr(mod, 'create'):
                   return mod

   likely benign LLM, confidence 0.85 Test helper dynamically imports an interpreter module by name and checks for a create function.

   Reasoning

   This is a test helper that dynamically imports a module by name inside a try block and checks for a create attribute, likely to probe for available interpreter backends. The name comes from a test-controlled list, so this is a legitimate test pattern rather than malicious dynamic loading.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o xxhash-4.0.2.tar.gz https://files.pythonhosted.org/packages/39/e6/ed6c428055ffd3f9299db3ec8671fd78b70c24173c040b8faafb6348ebbb/xxhash-4.0.2.tar.gz
printf '%s  %s\n' af3d1b3cfa5280e84d8968e9f30c9eca75781db4915eb6d6acb0dd4fc93e0f47 xxhash-4.0.2.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf xxhash-4.0.2.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg