npm / @babel/core / 8.0.7

@babel/core 8.0.7

Source

https://github.com/babel/babel

Artifact scanned

core-8.0.7.tgz (npm tarball · 39.2 KB · SHA-256 a25198596a78…)

Compared with

core-8.0.6.tgz (0 signals introduced since)

Files

17 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

2.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 19:54

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import lib/config/files/index.js:96:16

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

     const url = pathToFileURL(filepath).toString() + "?import";
     return await import(url);
   });
   const tsNotSupportedError = ext => `\

   likely benign LLM, confidence 0.90 Dynamic import of a resolved local config file URL in a config loader.

   Reasoning

   The import specifier is a file URL built from a config file path the tool itself resolved (pathToFileURL plus a cache-busting query). This is the standard way ESLint-style tools load JavaScript config files dynamically; it is a legitimate pattern and the import target is a user project config, not a remote or obfuscated payload.

2. info long-line lib/index.d.ts:69:1

   line length 1844 characters (raw pass, confidence 0.50)

     export { type ___CallerMetadata as CallerMetadata, type ___ConfigAPI as ConfigAPI, ___ConfigItem as ConfigItem, ___DEFAULT_EXTENSIONS as DEFAULT_EXTENSIONS, ___File as File, type ___FileResult as FileResult, type ___InputOptions as InputOptions, ___NodePath as NodePath, type ___NormalizedOptions as NormalizedOptions,

3. info long-line lib/index.d.ts:546:1

   line length 799 characters (raw pass, confidence 0.50)

   export { type CallerMetadata, type ConfigAPI, ConfigItem, DEFAULT_EXTENSIONS, File, type FileResult, type InputOptions, type NormalizedOptions, PartialConfig, type PluginAPI, type PluginItem, type PluginObject, PluginPass, type PluginTarget, type PresetAPI, type PresetItem, type PresetObject, type PresetTarget, type Vi

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o core-8.0.7.tgz https://registry.npmjs.org/@babel/core/-/core-8.0.7.tgz
printf '%s  %s\n' a25198596a78cfc9b29c1caec06b2052dc5c001b4754b2fbab023ae2b8d5fd44 core-8.0.7.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf core-8.0.7.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg