@babel/core 8.0.7

Source: https://github.com/babel/babel
Tag scanned: v8.0.7
Directory: packages/babel-core (only this part of the repository was scanned)
Compared with: v8.0.6 (0 signals introduced since)
Files: 292 scanned, 71 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 1 warn · 9 info
Scan time: 5.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 7 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:49

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn dynamic-import packages/babel-core/src/config/files/module-types.ts:48:16

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  return await import(url);
});
```
likely benign LLM, confidence 0.60 Dynamic import of a runtime-provided URL inside a module-type config loader.
Reasoning
Dynamic import of a variable url in a config loader is a common pattern for loading user config files; the snippet alone does not show malicious use, but the non-literal specifier is a real risk if the URL is attacker-controlled. Likely a legitimate loader.
info ~~warn~~ → info by review encoding-base64 packages/babel-core/test/api.js:623:60

base64-like blob (196 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
```
        "",
        "//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbInN0ZG91dCJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztJQUFNLEdBQUcsWUFBSCxHQUFHO3dCQUFILEdBQUciLCJmaWxlIjoidW5kZWZpbmVkIiwic291cmNlc0NvbnRlbnQiOlsiY2xhc3MgRm9vIHt9XG4iXX0=",
      ].join("\n"),
      {
```
likely benign LLM, confidence 0.90 Inline base64 source map embedded in a test fixture string.
Reasoning
The blob is a standard inline source map (sourceMappingURL with base64 JSON) inside a test fixture, decoding to a small sourcemap with sourcesContent. Raw-pass base64 findings in test files of a Babel-like repo are typically benign.
info ~~warn~~ → info by review dynamic-import packages/babel-core/test/config-ts-integration-ts-node.js:150:5

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  it("should work with ts-node", async () => {
    require(
      path.join(
        __dirname,
```
likely benign LLM, confidence 0.85 Test requiring a locally computed fixture path.
Reasoning
Test helper requires a path built from __dirname and path.join to load a config fixture; non-literal require is expected in integration tests and the path is local.
info ~~warn~~ → info by review dynamic-import packages/babel-core/test/config-ts-integration-tsx.js:46:7

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    it("should work with tsx", () => {
      require(
        path.join(
          __dirname,
```
likely benign LLM, confidence 0.85 Test requiring a locally computed config path under __dirname.
Reasoning
Same pattern as the ts-node integration test: require of a path.join from __dirname for a fixture inside a test suite.
info ~~warn~~ → info by review dynamic-import packages/babel-core/test/fixtures/async/preset-plugin-promise/preset.js:4:41

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
// "Dynamic import"
const import_ = path => Promise.resolve(require(path));

module.exports = function preset(api) {
```
likely benign LLM, confidence 0.85 Babel-style test fixture wrapping a dynamic require in a promise.
Reasoning
Fixture preset wraps require(path) in a promise; this is a test fixture exercising async plugin loading, with the path supplied by the test harness.
info ~~critical~~ → info by review dynamic-execution packages/babel-core/test/fixtures/plugins/nested-if-alternate/exec.js:21:8

`eval` called with a non-literal expression (ast pass, confidence 0.75)
```
expect(eval(res.code)).toBe(23);
```
likely benign LLM, confidence 0.85 Test assertion evaluating transformed code output with eval.
Reasoning
eval of transformed code inside a test assertion is a test-harness idiom to check compiled output; it runs local, controlled fixture code, not untrusted input.

info encoding-base64 packages/babel-core/test/fixtures/transformation/source-maps/inline/output.js:4:65

base64-like blob (272 bytes, compression ratio 0.78) (in comment) (raw pass, confidence 0.36)

ingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6W10sInNvdXJjZXMiOlsic291cmNlLW1hcHMvaW5saW5lL2lucHV0LmpzIl0sInNvdXJjZXNDb250ZW50IjpbImFyci5tYXAoeCA9PiB4ICogeCk7Il0sIm1hcHBpbmdzIjoiQUFBQSxHQUFHLENBQUMsR0FBRyxDQUFDLFdBQUM7RUFBQSxPQUFJLENBQUMsR0FBRyxDQUFDO0FBQUEsRUFBQyIsImlnbm9yZUxpc3QiOltdfQ

info encoding-base64 packages/babel-core/test/fixtures/transformation/source-maps/input-source-map/input.js:5:51

base64-like blob (172 bytes, compression ratio 0.93) (in comment) (raw pass, confidence 0.36)


//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIm9yaWdpbmFsLmpzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLFVBQVUsWTtTQUFNLEM7Q0FBQyIsInNvdXJjZXNDb250ZW50IjpbInZhciBmb28gPSAoKSA9PiA0OyJdfQ==

info ~~warn~~ → info by review dynamic-import packages/babel-core/test/parse.js:21:20

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    const input = fs.readFileSync(fixture("input.js"), "utf8");
    const output = require(fixture("output"));

    const result = parseSync(input, {
```
likely benign LLM, confidence 0.85 Parser test requiring an expected-output fixture by name.
Reasoning
require of a fixture path built from a local fixture helper in a parser test; expected test behavior.
info ~~warn~~ → info by review dynamic-import packages/babel-core/test/parse.js:32:20

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    const input = fs.readFileSync(fixture("input.js"), "utf8");
    const output = require(fixture("output.json"));

    const result = parseSync(input, {
```
likely benign LLM, confidence 0.85 Parser test requiring a JSON output fixture via helper.
Reasoning
Same as the other parse test: requiring a local JSON fixture via a helper in a test file.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/babel/babel babel && cd babel
git checkout v8.0.7
disclude scan --severity info --diff v8.0.6 packages/babel-core