PkgRadar

PyPI · pypi.org

alpha-id-zix

Py Runtime Dynamic Dangerous Import: Dynamic __import__('subprocess') — reflection bypass for static checks.

Why PkgRadar flagged 0.0.6

SeveritySignalEvidence
highPy Runtime Dynamic Dangerous ImportDynamic __import__('subprocess') — reflection bypass for static checks. · alpha_id_zix-0.0.6/src/alpha_id/codex_brain.py

Scanned versions

VersionVerdictScoreScanned (UTC)
0.2.0Low risk02026-06-03
0.1.2Low risk02026-06-03
0.1.1Low risk02026-06-03
0.1.0Low risk02026-06-03
0.0.9Low risk02026-06-03
0.0.8Low risk02026-06-03
0.0.7Low risk02026-06-03
0.0.6High risk302026-06-03
0.0.5Low risk02026-06-03
0.0.4Low risk02026-06-03
0.0.3Low risk02026-06-03
0.0.2Low risk02026-06-03
0.0.1Low risk02026-06-03
0.3.1Low risk02026-06-03
0.3.0Low risk02026-06-03

Block this in CI

PkgRadar gates alpha-id-zix (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi alpha-id-zix==0.0.6