PyPI · pypi.org

onnxsim

Py Install Time Subprocess: subprocess call — process spawning.

Why PkgRadar flagged 0.6.5

Severity	Signal	Evidence
medium	Py Install Time Subprocess	subprocess call — process spawning. · onnxsim-0.6.5/setup.py
medium	Py Install Time Subprocess	subprocess call — process spawning. · onnxsim-0.6.5/third_party/onnx-optimizer/setup.py
medium	Py Install Time Subprocess	subprocess call — process spawning. · onnxsim-0.6.5/third_party/onnx-optimizer/third_party/onnx/setup.py
medium	Py Custom Build Backend	Non-standard PEP 517 build-backend `backend` — runs custom code at install time. · pyproject.toml
medium	Remote Payload	matched "wget " · onnxsim-0.6.5/third_party/onnx-optimizer/third_party/onnx/workflow_scripts/protobuf/build_protobuf_unix.sh

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.6.5`	Review	38	2026-06-08
`0.6.4`	Review	38	2026-06-01

Block this in CI

PkgRadar gates onnxsim (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi onnxsim==0.6.5