PyPI · pypi.org

deepspeed

Py Install Time Subprocess: subprocess call — process spawning.

Why PkgRadar flagged 0.19.2

Severity	Signal	Evidence
medium	Py Install Time Subprocess	subprocess call — process spawning. · deepspeed-0.19.2/setup.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · deepspeed-0.19.2/deepspeed/launcher/launch.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.19.2`	Review	24	2026-06-16
`0.19.1`	Review	24	2026-05-30

Block this in CI

PkgRadar gates deepspeed (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi deepspeed==0.19.2