# SBOM for pytokei 1.0.1
> Python bindings to tokei, the Rust library to count code quickly.
The Python package pytokei 1.0.1 ships 11 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.
- Package URL (PURL): `pkg:pypi/pytokei@1.0.1`
- PyPI: https://pypi.org/project/pytokei/1.0.1/
- Requires Python: \>=3.10
- Documentation:
- Homepage:
- Source:
## SBOMs
### pytokei-1.0.1-cp38-abi3-macosx\_10\_12\_x86\_64.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/64ca6f80-a215-5e34-a715-eedc41c42b71/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-macosx\_11\_0\_arm64.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/1092c613-359e-52a0-8873-7ba3618a09b5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/2dc53cff-db7c-5d81-8acc-a8e0f8f8762c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/7f209681-bad2-525d-abfc-e0c620de1a4b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-manylinux\_2\_17\_i686.manylinux2014\_i686.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/8c77145a-72af-5a7c-838a-ab787eaf7fa1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/25331d2b-07ba-5dac-9261-7a2223bcce9a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-musllinux\_1\_1\_aarch64.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/21dfafc3-8b84-573e-bd4d-70f8b80a0831/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-musllinux\_1\_1\_x86\_64.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/4580589c-1917-572f-94a6-53e5bea919ff/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-win32.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/dac0b7bd-b60f-5dea-b39d-9383daa6f37b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-win\_amd64.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/c49cbc67-d895-5ab5-a882-10b90fe3e1fb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities
### pytokei-1.0.1-cp38-abi3-win\_arm64.whl
PEP 740 attestation verified (GitHub, plaguss/pytokei, workflow ci.yml).
- [pytokei-1.0.1.dist-info/sboms/pytokei.cyclonedx.json](https://pypi.sbomify.com/artifact/22567690-81df-59ec-93eb-d4bd2cf95bab/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities
## Known vulnerabilities
Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.22.6 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.22.6 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.22.6 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` |
| [RUSTSEC-2021-0139](https://osv.dev/vulnerability/RUSTSEC-2021-0139) | unknown | ansi\_term 0.12.1 (crates.io) | none listed | ansi\_term is Unmaintained |
| [RUSTSEC-2021-0145](https://osv.dev/vulnerability/RUSTSEC-2021-0145) | unknown | atty 0.2.14 (crates.io) | none listed | Potential unaligned read |
| [RUSTSEC-2024-0375](https://osv.dev/vulnerability/RUSTSEC-2024-0375) | unknown | atty 0.2.14 (crates.io) | none listed | \`atty\` is unmaintained |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2024-0384](https://osv.dev/vulnerability/RUSTSEC-2024-0384) | unknown | instant 0.1.13 (crates.io) | none listed | \`instant\` is unmaintained |
| [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.9.10 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` |
| [RUSTSEC-2020-0163](https://osv.dev/vulnerability/RUSTSEC-2020-0163) | unknown | term\_size 0.3.2 (crates.io) | none listed | \`term\_size\` is unmaintained; use \`terminal\_size\` instead |
## Fetch it over TEA
This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:
```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/pytokei@1.0.1
```
Machine-readable copy of this page: https://pypi.sbomify.com/package/pytokei/1.0.1.json
---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/pytokei/1.0.1