zerovec 0.11.8

Source: https://github.com/unicode-org/icu4x
Commit scanned: c56bbb5a7b47 (recorded by crates.io)
Directory: utils/zerovec (only this part of the repository was scanned)
Compared with: a14f2dad852b (0 signals introduced since)
Files: 71 scanned, 9 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 3.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 21:22

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info unicode-mixed-script utils/zerovec/derive/examples/make_var.rs:215:29

identifier `diﬀərənt` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
        b: '⸘',
        c: Cow::Borrowed("a diﬀərənt ştring"),
    },
    VarStruct {
```

info unicode-mixed-script utils/zerovec/derive/examples/make_var.rs:226:46

identifier `ɨpsu` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

const TEST_STRINGS2: &[&str] = &["hellø", "wørłd"];
const TEST_STRINGS3: &[&str] = &["łořem", "ɨpsu₥"];

const TEST_MULTIFIELD: &[MultiFieldStruct<'static>] = &[

info unicode-mixed-script utils/zerovec/derive/examples/make_var.rs:240:29

identifier `diﬀərənt` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

        b: '⸘',
        c: Cow::Borrowed("a diﬀərənt ştring"),
        d: 120,
        e: Cow::Borrowed("a diﬀərənt testing ştring"),

info unicode-mixed-script utils/zerovec/derive/examples/make_var.rs:242:29

identifier `diﬀərənt` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
        d: 120,
        e: Cow::Borrowed("a diﬀərənt testing ştring"),
        f: 'ł',
    },
```

info proc-macro-presence utils/zerovec/derive/src/lib.rs:29:1

proc-macro attribute `#[proc_macro_derive]` present (ast pass, confidence 0.95)

/// Full docs for this proc macro can be found on the [`zerovec`](https://docs.rs/zerovec) crate.
#[proc_macro_derive(ULE)]
pub fn ule_derive(input: TokenStream) -> TokenStream {
    let input = parse_macro_input!(input as DeriveInput);

info ~~warn~~ → info by review encoding-base64 utils/zerovec/src/map2d/databake.rs:100:147

base64-like blob (113 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
```
                        b"\x1C\0\0\0\0\0\x04\0\x08\0\x0C\0\x10\0\x14\0\x18\0\x1C\0 \0$\0(\0,\x000\x004\08\0<\0@\0D\0H\0L\0P\0T\0X\0\\\0`\0d\0h\0l\0NbatPalmArabGlagShawAdlmLinbArabArabYeziArabLatnLimbNkooMongArabPhlpDevaKhojSindArabCyrlDevaArabHansBopoHanbHant"
                    )
                },
```
likely benign LLM, confidence 0.93 A Rust byte-string literal holding generated ICU-style lookup data (offset table plus script names), flagged as a base64-like blob by the raw pass.
Reasoning
The snippet is a Rust byte-string literal containing binary offset tables and ICU-style property/script names (Arab, Latn, Deva, Hans). This is typical generated data from ICU4X-style data baking, not an encoded payload. The base64-like signal is a raw-pass false positive driven by the byte-escape density and the long run of ASCII identifiers, and the code is a static data table with no decode or execution step.
info ~~warn~~ → info by review encoding-base64 utils/zerovec/src/map2d/databake.rs:134:147

base64-like blob (113 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
```
                        b"\x1C\0\0\0\0\0\x04\0\x08\0\x0C\0\x10\0\x14\0\x18\0\x1C\0 \0$\0(\0,\x000\x004\08\0<\0@\0D\0H\0L\0P\0T\0X\0\\\0`\0d\0h\0l\0NbatPalmArabGlagShawAdlmLinbArabArabYeziArabLatnLimbNkooMongArabPhlpDevaKhojSindArabCyrlDevaArabHansBopoHanbHant"
                    )
                },
```
likely benign LLM, confidence 0.93 A second generated Rust byte-string data literal in the same databake file, flagged by the raw pass as a base64-like blob.
Reasoning
Same generated byte-string data table as the other finding in this file, with the same offset-table and script-name content. The path name 'databake' and the absence of any decode or runtime execution point to a benign generated data file. Raw-pass signal with no AST-level corroboration.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/unicode-org/icu4x icu4x && cd icu4x
git checkout c56bbb5a7b47409759113903764c456f13b418e5
disclude scan --severity info --diff a14f2dad852be26bad277ae704abf27a15cbfed1 utils/zerovec