@babel/core 8.0.7

Source: https://github.com/babel/babel
Tag scanned: v8.0.7
Directory: packages/babel-core (only this part of the repository was scanned)
Compared with: v8.0.6 (0 signals introduced since)
Files: 292 scanned, 71 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 10 info
Scan time: 4.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 8 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 17:00

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/babel-core/src/config/files/module-types.ts:48:16

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  return await import(url);
});
```
likely benign LLM, confidence 0.70 A config loader performs a dynamic import of a computed URL.
Reasoning
Dynamic import of a variable url in a config loader is a common pattern for loading user config files; the snippet alone shows no obfuscation, but the specifier's origin is not visible.
info ~~warn~~ → info by review encoding-base64 packages/babel-core/test/api.js:623:60

base64-like blob (196 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
```
        "",
        "//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbInN0ZG91dCJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztJQUFNLEdBQUcsWUFBSCxHQUFHO3dCQUFILEdBQUciLCJmaWxlIjoidW5kZWZpbmVkIiwic291cmNlc0NvbnRlbnQiOlsiY2xhc3MgRm9vIHt9XG4iXX0=",
      ].join("\n"),
      {
```
dismissed LLM, confidence 0.95 A base64-encoded inline sourcemap embedded in a test fixture.
Reasoning
The base64 blob is a standard inline source map for a tiny test fixture ('class Foo {}'), a normal artifact in test suites.
info ~~warn~~ → info by review dynamic-import packages/babel-core/test/config-ts-integration-ts-node.js:150:5

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  it("should work with ts-node", async () => {
    require(
      path.join(
        __dirname,
```
likely benign LLM, confidence 0.93 Test file requires a path built from __dirname.
Reasoning
A require with path.join(__dirname, ...) in a test for ts-node integration is ordinary test loading of fixtures.
info ~~warn~~ → info by review dynamic-import packages/babel-core/test/config-ts-integration-tsx.js:46:7

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    it("should work with tsx", () => {
      require(
        path.join(
          __dirname,
```
likely benign LLM, confidence 0.93 Test requires a fixture path built from __dirname.
Reasoning
Same pattern as the ts-node test: path.join with __dirname used to load test fixtures in an integration test.
info ~~warn~~ → info by review dynamic-import packages/babel-core/test/fixtures/async/preset-plugin-promise/preset.js:4:41

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
// "Dynamic import"
const import_ = path => Promise.resolve(require(path));

module.exports = function preset(api) {
```
likely benign LLM, confidence 0.92 Test fixture preset that requires a path dynamically.
Reasoning
A Babel-style test fixture wrapping require in a promise to exercise async preset loading; the comment indicates intent to test dynamic import behavior.
info ~~critical~~ → info by review dynamic-execution packages/babel-core/test/fixtures/plugins/nested-if-alternate/exec.js:21:8

`eval` called with a non-literal expression (ast pass, confidence 0.75)
```
expect(eval(res.code)).toBe(23);
```
likely benign LLM, confidence 0.90 Test uses eval on generated code to check its result.
Reasoning
eval of transformed code inside a test assertion is a standard way to check that generated output runs correctly; it is a test fixture, not a dropper.

info encoding-base64 packages/babel-core/test/fixtures/transformation/source-maps/inline/output.js:4:65

base64-like blob (272 bytes, compression ratio 0.78) (in comment) (raw pass, confidence 0.36)

ingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6W10sInNvdXJjZXMiOlsic291cmNlLW1hcHMvaW5saW5lL2lucHV0LmpzIl0sInNvdXJjZXNDb250ZW50IjpbImFyci5tYXAoeCA9PiB4ICogeCk7Il0sIm1hcHBpbmdzIjoiQUFBQSxHQUFHLENBQUMsR0FBRyxDQUFDLFdBQUM7RUFBQSxPQUFJLENBQUMsR0FBRyxDQUFDO0FBQUEsRUFBQyIsImlnbm9yZUxpc3QiOltdfQ

info encoding-base64 packages/babel-core/test/fixtures/transformation/source-maps/input-source-map/input.js:5:51

base64-like blob (172 bytes, compression ratio 0.93) (in comment) (raw pass, confidence 0.36)


//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIm9yaWdpbmFsLmpzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLFVBQVUsWTtTQUFNLEM7Q0FBQyIsInNvdXJjZXNDb250ZW50IjpbInZhciBmb28gPSAoKSA9PiA0OyJdfQ==

info ~~warn~~ → info by review dynamic-import packages/babel-core/test/parse.js:21:20

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    const input = fs.readFileSync(fixture("input.js"), "utf8");
    const output = require(fixture("output"));

    const result = parseSync(input, {
```
likely benign LLM, confidence 0.93 Parser test requires an expected-output fixture.
Reasoning
Test reads fixture output via require(fixture(...)), a normal test helper pattern for loading expected outputs.
info ~~warn~~ → info by review dynamic-import packages/babel-core/test/parse.js:32:20

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    const input = fs.readFileSync(fixture("input.js"), "utf8");
    const output = require(fixture("output.json"));

    const result = parseSync(input, {
```
likely benign LLM, confidence 0.93 Parser test requires an expected JSON fixture.
Reasoning
Same as the other parse test: loading an expected JSON fixture through a helper in a test file.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/babel/babel babel && cd babel
git checkout v8.0.7
disclude scan --severity info --diff v8.0.6 packages/babel-core