PyPI · pypi.org
sspec
Py Import Time Subprocess: subprocess call — process spawning.
Why PkgRadar flagged 2.6.1
| Severity | Signal | Evidence |
|---|---|---|
| medium | Py Import Time Subprocess | subprocess call — process spawning. · sspec-2.6.1/.uv-cache/archive-v0/-j7KLzTVgye4fq5lDWE_w/setuptools/_vendor/jaraco/context/__init__.py |
| medium | Py Import Time Subprocess | subprocess call — process spawning. · sspec-2.6.1/.uv-cache/archive-v0/NLEnI0LziYcXQGxALPA40/hatchling/cli/dep/__init__.py |
| medium | Py Import Time Eval Exec | Python eval()/exec() called on a string. · sspec-2.6.1/.uv-cache/archive-v0/-j7KLzTVgye4fq5lDWE_w/setuptools/_vendor/jaraco/functools/__init__.py |
| high | Py Import Time Network Call | Network call (urllib/requests/httpx/http.client) at install or import time. · sspec-2.6.1/.uv-cache/archive-v0/-j7KLzTVgye4fq5lDWE_w/setuptools/_vendor/jaraco/context/__init__.py |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
2.6.1 | High risk | 90 | 2026-06-10 |
2.6.0 | High risk | 90 | 2026-06-10 |
2.5.0 | High risk | 90 | 2026-06-01 |
2.4.2 | High risk | 90 | 2026-05-31 |
Block this in CI
pkgradar gate --ecosystem pypi sspec==2.6.1