PkgRadar

PyPI · pypi.org

goldenmatch

Py Runtime Dynamic Dangerous Import: Dynamic __import__('os') — reflection bypass for static checks.

Why PkgRadar flagged 1.30.0

SeveritySignalEvidence
highPy Runtime Dynamic Dangerous ImportDynamic __import__('os') — reflection bypass for static checks. · goldenmatch-1.30.0/goldenmatch/distributed/clustering.py

Scanned versions

VersionVerdictScoreScanned (UTC)
1.30.0High risk302026-06-09
1.29.0High risk302026-06-09
1.28.0High risk302026-06-06
1.27.0High risk302026-06-05
1.26.0High risk302026-06-04
1.25.0Low risk02026-06-01
1.20.0Low risk02026-05-30
1.24.0Low risk02026-05-29
1.23.0Review252026-05-27
1.22.0Review252026-05-27
1.21.0Review252026-05-27

Block this in CI

PkgRadar gates goldenmatch (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi goldenmatch==1.30.0
Start free — 25 scans / moView full evidence