@babel/generator 8.0.6

Source: https://github.com/babel/babel
Tag scanned: v8.0.6
Directory: packages/babel-generator (only this part of the repository was scanned)
Compared with: v8.0.5 (0 signals introduced since)
Files: 1152 scanned, 148 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 62 info
Scan time: 7.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:38

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/comments/dynamic-import/input.js:1:6

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/*0*/import/*1*/(/*2*/"foo"/*3*/)/*4*/
```
dismissed LLM, confidence 0.93 Test fixture exercising comments inside a dynamic import call with a literal specifier.
Reasoning
The snippet shows import("foo") with a string literal specifier and comments between tokens. The fixture exists to test comment preservation around dynamic import, and the scanner's non-literal check does not account for the literal here. This is a scanner test fixture, not malicious code.
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/comments/dynamic-import/output.js:1:6

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/*0*/import /*1*/(/*2*/"foo" /*3*/); /*4*/
```
dismissed LLM, confidence 0.93 Formatted expected output of a comment-handling test for dynamic import with a literal specifier.
Reasoning
This is the formatted output counterpart of the input fixture. It has the same literal "foo" specifier and comment placement, so the non-literal warning is a false positive from the scanner's own test suite.
info identifier-low-length packages/babel-generator/test/fixtures/comments/newlines/input.js:1:1

17 of 42 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/comments/newlines/output.js:1:1

17 of 42 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/edgecase/async-generator/input.js:1:1

15 of 35 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/edgecase/async-generator/output.js:1:1

15 of 35 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

info long-line packages/babel-generator/test/fixtures/edgecase/large-file-concise/output.js:1:1

line length 2112 characters (mostly string/comment) (raw pass, confidence 0.39)

"undefined" === typeof Aura && (Aura = {}); Aura.bootstrap || (Aura.bootstrap = {}); Aura.frameworkJsReady || (Aura.ApplicationDefs = { cmpExporter: {}, libExporter: {} }, $A = { componentService: { addComponent: function (a, b) { Aura.ApplicationDefs.cmpExporter[a] = b; }, addLibraryExporter: function (a, b) { Aura.Ap

info identifier-low-length packages/babel-generator/test/fixtures/edgecase/new-precedence/input.js:1:1

mean non-conventional identifier length 1.90 over 41 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/edgecase/new-precedence/output.js:1:1

mean non-conventional identifier length 1.90 over 41 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/def-site-variance/input.js:1:1

42 of 74 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/def-site-variance/output.js:1:1

42 of 74 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/enum-declaration/input.js:1:1

30 of 54 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/enum-declaration/output.js:1:1

30 of 54 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/parentheses/input.js:1:1

mean non-conventional identifier length 1.43 over 21 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/parentheses/output.js:1:1

mean non-conventional identifier length 1.43 over 21 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/qualified-generic-type/input.js:1:1

mean non-conventional identifier length 1.65 over 20 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/qualified-generic-type/output.js:1:1

mean non-conventional identifier length 1.65 over 20 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/type-union-intersection/input.js:1:1

26 of 46 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/type-union-intersection/output.js:1:1

26 of 46 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/typeapp-call/input.js:1:1

mean non-conventional identifier length 1.38 over 48 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/typeapp-call/output.js:1:1

mean non-conventional identifier length 1.38 over 48 names (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/import-phases/source-expression-comments/input.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import/* 1 */./* 2 */source/* 3 */(/* 4 */"foo"/* 5 */, /* 6 */)/* 7 */;
```
dismissed LLM, confidence 0.92 Import-phase test fixture for import.source with comments around a literal specifier.
Reasoning
This is a source-phase import expression (import.source) with a literal "foo" argument and comments, in a fixture directory named for import phases. It is a parser or formatter test case, not an attack pattern.
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/import-phases/source-expression-comments/output.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import /* 1 */ /* 2 */ /* 3 */.source(/* 4 */"foo" /* 5 */ /* 6 */) /* 7 */;
```
dismissed LLM, confidence 0.92 Expected formatted output for the import.source comment test fixture.
Reasoning
This is the expected-output side of the same import-phases fixture. It shows the same import.source("foo") form reformatted, with no sign of obfuscation.
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/import-phases/source-expression-options-comments/input.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import/* 1 */./* 2 */source/* 3 */(/* 4 */"foo"/* 5 */, /* 6 */options/* 7 */,/* 8 */)/* 9 */;
```
dismissed LLM, confidence 0.92 Test fixture for import.source with an options argument and comments.
Reasoning
This fixture is import.source with a literal "foo" argument plus an options argument and comments. It tests syntax handling for import phases, and the literal specifier means the non-literal warning does not apply.
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/import-phases/source-expression-options-comments/output.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import /* 1 */ /* 2 */ /* 3 */.source(/* 4 */"foo" /* 5 */, /* 6 */options /* 7 */ /* 8 */) /* 9 */;
```
dismissed LLM, confidence 0.92 Expected formatted output for the import.source-with-options comment test.
Reasoning
Formatted expected output of the import.source options fixture, with the same literal specifier and no dynamic or hidden behavior.
info unicode-surrogate packages/babel-generator/test/fixtures/minified/literals/input.js:9:2

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
"😂";
"\uD83D_\uDE02"
`😂`;
/foobar/g;
```
info unicode-surrogate packages/babel-generator/test/fixtures/minified/literals/input.js:9:9

orphaned low surrogate \uDE02 (no preceding high surrogate) (token pass, confidence 0.65)
```
"😂";
"\uD83D_\uDE02"
`😂`;
/foobar/g;
```
info unicode-surrogate packages/babel-generator/test/fixtures/minified/literals/output.js:1:40

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
5;5;50;5e4;"foobar";" ";"\n\r";"😂";"\uD83D_\uDE02"`😂`;/foobar/g;null;true;false;5;2;56;31;
```
info unicode-surrogate packages/babel-generator/test/fixtures/minified/literals/output.js:1:47

orphaned low surrogate \uDE02 (no preceding high surrogate) (token pass, confidence 0.65)
```
5;5;50;5e4;"foobar";" ";"\n\r";"😂";"\uD83D_\uDE02"`😂`;/foobar/g;null;true;false;5;2;56;31;
```
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/exponentiation/input.js:1:1

mean non-conventional identifier length 1.26 over 23 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/exponentiation/output.js:1:1

mean non-conventional identifier length 1.26 over 23 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/in-inside-for/input.js:1:1

mean non-conventional identifier length 1.98 over 299 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/in-inside-for/output.js:1:1

mean non-conventional identifier length 1.98 over 299 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/new-callee/input.js:1:1

23 of 50 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/new-callee/output.js:1:1

23 of 50 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/nullish-coalescing/input.js:1:1

mean non-conventional identifier length 1.46 over 35 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/nullish-coalescing/output.js:1:1

mean non-conventional identifier length 1.46 over 35 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/sequence-expression-createParenthesizedExpressions/input.js:1:1

34 of 48 non-conventional identifiers are single-character (71%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/sequence-expression-createParenthesizedExpressions/output.js:1:1

34 of 48 non-conventional identifiers are single-character (71%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/sequence-expressions/input.js:1:1

34 of 48 non-conventional identifiers are single-character (71%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/sequence-expressions/output.js:1:1

34 of 48 non-conventional identifiers are single-character (71%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/ts-function-type/input.ts:1:1

30 of 60 non-conventional identifiers are single-character (50%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/ts-function-type/output.js:1:1

30 of 60 non-conventional identifiers are single-character (50%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/ts-new-callee/input.js:1:1

25 of 51 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/ts-new-callee/output.js:1:1

25 of 51 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
info whitespace-anomaly packages/babel-generator/test/fixtures/regression/comment-before-parentheses-return-arg-createParenthesizedExpressions/input.js:2:1

file mixes tab and space indentation (8 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
function assertElement(assertFn, shouldBeElement, opt_message) {
  return /** @type {!Ele	ment} */ (
	  assertType_(
	    assertFn,
```
info whitespace-anomaly packages/babel-generator/test/fixtures/regression/comment-before-parentheses-return-arg/input.js:2:1

file mixes tab and space indentation (8 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
function assertElement(assertFn, shouldBeElement, opt_message) {
  return /** @type {!Ele	ment} */ (
	  assertType_(
	    assertFn,
```
info whitespace-anomaly packages/babel-generator/test/fixtures/sourcemaps/comment-before-parentheses-return-arg-createParenthesizedExpressions/input.js:2:1

file mixes tab and space indentation (8 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
function assertElement(assertFn, shouldBeElement, opt_message) {
  return /** @type {!Ele	ment} */ (
	  assertType_(
	    assertFn,
```
info whitespace-anomaly packages/babel-generator/test/fixtures/sourcemaps/comment-before-parentheses-return-arg/input.js:2:1

file mixes tab and space indentation (8 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
function assertElement(assertFn, shouldBeElement, opt_message) {
  return /** @type {!Ele	ment} */ (
	  assertType_(
	    assertFn,
```
info identifier-low-length packages/babel-generator/test/fixtures/types/LogicalExpression/input.js:1:1

25 of 33 non-conventional identifiers are single-character (76%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/types/LogicalExpression/output.js:1:1

25 of 33 non-conventional identifiers are single-character (76%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/cast-need-parentheses/input.js:1:1

mean non-conventional identifier length 1.61 over 90 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/cast-need-parentheses/output.js:1:1

mean non-conventional identifier length 1.61 over 90 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/satisfies-parentheses-createParenthesizedExpression/input.ts:1:1

38 of 56 non-conventional identifiers are single-character (68%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/satisfies-parentheses-createParenthesizedExpression/output.js:1:1

38 of 56 non-conventional identifiers are single-character (68%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/satisfies-parentheses/input.ts:1:1

38 of 56 non-conventional identifiers are single-character (68%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/satisfies-parentheses/output.js:1:1

38 of 56 non-conventional identifiers are single-character (68%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/types-mapped-as/input.js:1:1

21 of 40 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/types-mapped-as/output.js:1:1

21 of 40 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/types-parameter-const-modifier/input.ts:1:1

13 of 30 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/types-parameter-const-modifier/output.js:1:1

13 of 30 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info ~~critical~~ → info by review dynamic-execution packages/babel-generator/test/index.js:1038:5

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
    );
    new Function(generate(mem).code);
  });
```
likely benign LLM, confidence 0.75 Test-suite code that builds and evaluates a function from generated source code.
Reasoning
The snippet shows new Function(generate(mem).code) in a test file. Here the body comes from a code generator, which is typical of a compiler or transform test harness that evaluates generated output. A runtime-built Function is still a real dynamic-execution pattern, so the residual doubt is real. Without the surrounding test context, I rate it likely benign.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/babel/babel babel && cd babel
git checkout v8.0.6
disclude scan --severity info --diff v8.0.5 packages/babel-generator