PkgRadar

PyPI · pypi.org

fwquant

Py Import Time Subprocess: subprocess call with shell=True — passes argv to /bin/sh.

Why PkgRadar flagged 1.0.67

SeveritySignalEvidence
mediumPy Import Time Subprocesssubprocess call with shell=True — passes argv to /bin/sh. · fwquant-1.0.67/fuwen/cli/__init__.py
mediumPy Import Time Subprocesssubprocess call — process spawning. · fwquant-1.0.67/fuwen/cli/__init__.py
mediumPy Import Time Ctypes Loadctypes.CDLL/cdll.LoadLibrary — loads native code into the process. · fwquant-1.0.67/fw_core/fuwen_gateway/ctp/__init__.py

Scanned versions

VersionVerdictScoreScanned (UTC)
1.0.67Review1042026-06-16
1.0.66Review1042026-06-16
1.0.65Review1042026-06-16
1.0.64Review1042026-06-16
1.0.63Review1042026-06-12
1.0.62Review1042026-06-02
1.0.61Review1042026-05-30
1.0.60Review1042026-05-30

Block this in CI

PkgRadar gates fwquant (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi fwquant==1.0.67
Start free — 25 scans / moView full evidence