npm / @babel/core / 8.0.9

@babel/core 8.0.9

Source

https://github.com/babel/babel

Artifact scanned

core-8.0.9.tgz (npm tarball · 39.2 KB · SHA-256 109e5e88ab2c…)

Compared with

core-8.0.7.tgz (0 signals introduced since)

Files

17 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

2.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 15:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import lib/config/files/index.js:96:16

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

     const url = pathToFileURL(filepath).toString() + "?import";
     return await import(url);
   });
   const tsNotSupportedError = ext => `\

   likely benign LLM, confidence 0.90 A config loader dynamically imports a user config file via its pathToFileURL-derived URL.

   Reasoning

   The import specifier is a file URL built from a config file path with a query suffix, inside a config-file loader. The ast pass flags any non-literal dynamic import, and this is the standard way Node loads ESM config modules. Nothing in the snippet decodes, fetches remote code, or hides intent, so it reads as legitimate module loading.

2. info long-line lib/index.d.ts:69:1

   line length 1844 characters (raw pass, confidence 0.50)

     export { type ___CallerMetadata as CallerMetadata, type ___ConfigAPI as ConfigAPI, ___ConfigItem as ConfigItem, ___DEFAULT_EXTENSIONS as DEFAULT_EXTENSIONS, ___File as File, type ___FileResult as FileResult, type ___InputOptions as InputOptions, ___NodePath as NodePath, type ___NormalizedOptions as NormalizedOptions,

3. info long-line lib/index.d.ts:546:1

   line length 799 characters (raw pass, confidence 0.50)

   export { type CallerMetadata, type ConfigAPI, ConfigItem, DEFAULT_EXTENSIONS, File, type FileResult, type InputOptions, type NormalizedOptions, PartialConfig, type PluginAPI, type PluginItem, type PluginObject, PluginPass, type PluginTarget, type PresetAPI, type PresetItem, type PresetObject, type PresetTarget, type Vi

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o core-8.0.9.tgz https://registry.npmjs.org/@babel/core/-/core-8.0.9.tgz
printf '%s  %s\n' 109e5e88ab2c60541e0cdbf88bd65fc9074d13ebaaf43d8bb4f0fb7d82a8275a core-8.0.9.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf core-8.0.9.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg