btclib-org/btclib

Review signals: 31 hardcoded secret, 1 known vulnerability. 66 static matches retained as context.

Gitleaks found a possible hardcoded secret; value withheld. 3 distinct locations. 31 findings.

OSV reports a known vulnerability in this dependency version. golang.org/x/crypto

18 encoded blob matches retained as context; full list in the evidence.

48 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• btclib provides Base58 encoding and decoding: Real input produced the expected result: {"bytes_hex": "0000"}

  Source: - Base58 encoding/decoding

  Input: 112edB6q

  Expected: decodes to the bytes 0x0000

  Command: Python API btclib.base58.decode

  Observed: …{"bytes_hex": "0000"}, "source_file": "<guest-path>"}

Local or hosted: local

Import btclib from PyPI and run the README-listed Base58 decode API (btclib.base58.decode) on real input

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; python3 --version; cat README.md 2>/dev/null | head -150
cd <guest-path> && sed -n 150,400p README.md; ls .coldpass; cat .python-version
cd <guest-path> && grep -n -A3 'requires-python\|\[project.scripts\]\|\[project.optional' pyproject.toml | head -40; ls src/btclib | head -80; python3 -m venv --help >/dev/null && echo venv_ok
mkdir -p <guest-path> && cd <guest-path> && python3 -m venv <guest-path> && <guest-path> -m pip install --upgrade pip -q 2>&1 | tail -3; <guest-path> -m pip install --upgrade btclib 2>&1 | tail -5
cd /tmp && <guest-path> -I -c "
import btclib.base58 as b, inspect
print(b.b58encode.__doc__ and 'doc ok')
print(b.b58encode(bytes.fromhex('00010203')))
print(b.b58decode('1Ldp').hex() if False else '')
" ; <guest-path> -I -c "import btclib.base58 as b; print([n for n in dir(b) if not n.startswith('_')])"; <guest-path> -I -c "import btclib.bech32 as b; print([n for n in dir(b) if not n.startswith('_')])"
cd /tmp && <guest-path> -I -c "
from btclib.base58 import encode, decode
print(encode(b'Hello World'))
print(decode('JxF12TrwUP45BMd'))
from btclib.bech32 import encode as be
print(be('bc', 0, bytes.fromhex('751e76e8199196d454941c45d1b3a323f1433bd6')) if False else 'skip')
"
cd /tmp && <guest-path> -I -c "
import inspect
from btclib import base58
print(inspect.signature(base58.encode)); print(inspect.signature(base58.decode))
print(base58.encode(b'Hello World', checksum=False) if 'checksum' in str(inspect.signature(base58.encode)) else '')
print(base58.decode(base58.encode(b'Hello World')))
print(base58.encode(bytes.fromhex('0000')) )
"
cd /tmp && <guest-path> -I -c "
from btclib.base58 import encode, decode
print(decode('112edB6q'), encode(bytes.fromhex('0000')), decode(encode(b'Hello World')))
from btclib import bech32
import inspect; print(inspect.signature(bech32.encode)); print(inspect.signature(bech32.decode))
"
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"python_api","module":"btclib.base58","call":"decode","args":["112edB6q"],"kwargs":{},"expected_value":{"bytes_hex":"0000"},"cwd":"<guest-path>","env":{}}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"btclib provides Base58 encoding and decoding","source":"- Base58 encoding/decoding","input":"112edB6q","expected":"decodes to the bytes 0x0000","probe_kind":"python_api","module":"btclib.base58","call":"decode","args":["112edB6q"],"kwargs":{},"expected_value":{"bytes_hex":"0000"},"cwd":"<guest-path>","env":{}}]
EOF
cat .coldpass/probe.json; python3 -I -c "import json;json.load(open('.coldpass/claims.json'));print('ok')"
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && echo '[]' > .coldpass/examples.json && cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md (library only, no server, daemon, cron, loop, webhook, --once or --now entrypoint) and pyproject.toml (no [project.scripts]). Only CI schedules exist in .github, which are excluded."}
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Import btclib from PyPI and run the README-listed Base58 decode API (btclib.base58.decode) on real input","operation_scope":"Python 3.12.3 venv at <guest-path>; btclib 2026.10.28 with ecc 2026.10.28; no browser, credentials, or network services needed. README is a library README with no CLI or server entrypoint, so no CLI, MCP, or HTTP probe was possible.","steps":["python3 -m venv <guest-path>","<guest-path> -m pip install --upgrade pip","<guest-path> -m pip install --upgrade btclib (README: 'python -m pip install --upgrade btclib')","Replay: btclib.base58.decode('112edB6q') returned bytes 0x0000 (README: '- Base58 encoding/decoding')"],"deviations":["README has no runnable CLI or server, so verification used the python_api probe kind against the library's documented public API instead of a command-line probe.","Pinned commit f9d944d57fe93992e56d8e2816f27c63a6808a5f was not fetched via git (workspace has no .git); the workspace source was used as provided. The PyPI install is the README-documented route.","No README code examples exist, so examples.json is empty and no README python examples were run.","Cycles: no scheduler, daemon, or trigger exists in the product, so detected=false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
for f in examples cycles report; do python3 -I -c "import json,sys;json.load(open('.coldpass/$f.json'));print('$f ok')"; done
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 1500