PyPI · pypi.org
pybbarolo
Py Install Time Subprocess: subprocess call with shell=True — passes argv to /bin/sh.
Why PkgRadar flagged 1.8.0
| Severity | Signal | Evidence |
|---|---|---|
| medium | Py Install Time Subprocess | subprocess call with shell=True — passes argv to /bin/sh. · pybbarolo-1.8.0/setup.py |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
1.8.0 | Review | 25 | 2026-06-01 |
1.3.9 | Review | 35 | 2026-05-30 |
1.3.8 | Review | 35 | 2026-05-30 |
1.3.7 | Review | 35 | 2026-05-30 |
1.3.6 | Review | 35 | 2026-05-29 |
Block this in CI
pkgradar gate --ecosystem pypi pybbarolo==1.8.0