@babel/generator 8.0.6

Source: https://github.com/babel/babel
Tag scanned: v8.0.6
Directory: packages/babel-generator (only this part of the repository was scanned)
Compared with: v8.0.5 (0 signals introduced since)
Files: 1152 scanned, 148 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 62 info
Scan time: 8.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 14:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/comments/dynamic-import/input.js:1:6

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/*0*/import/*1*/(/*2*/"foo"/*3*/)/*4*/
```
likely benign LLM, confidence 0.93 Comment-laden dynamic import("foo") in a parser test fixture.
Reasoning
The snippet is a dynamic import whose specifier is the string literal "foo", with comments between the tokens. It sits in a parser fixture named for comment handling, so the flag comes from the scanner's own test input rather than from a real loader. The literal specifier makes the non-literal message a false positive.
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/comments/dynamic-import/output.js:1:6

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/*0*/import /*1*/(/*2*/"foo" /*3*/); /*4*/
```
likely benign LLM, confidence 0.93 Formatted expected output of a dynamic import("foo") fixture with comments.
Reasoning
This is the formatted output counterpart of the comment-handling fixture. It contains import("foo") with a literal string specifier and interleaved comments, which is expected output for a formatter test. Nothing here is a non-literal specifier or an evasion attempt.
info identifier-low-length packages/babel-generator/test/fixtures/comments/newlines/input.js:1:1

17 of 42 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/comments/newlines/output.js:1:1

17 of 42 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/edgecase/async-generator/input.js:1:1

15 of 35 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/edgecase/async-generator/output.js:1:1

15 of 35 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

info long-line packages/babel-generator/test/fixtures/edgecase/large-file-concise/output.js:1:1

line length 2112 characters (mostly string/comment) (raw pass, confidence 0.39)

"undefined" === typeof Aura && (Aura = {}); Aura.bootstrap || (Aura.bootstrap = {}); Aura.frameworkJsReady || (Aura.ApplicationDefs = { cmpExporter: {}, libExporter: {} }, $A = { componentService: { addComponent: function (a, b) { Aura.ApplicationDefs.cmpExporter[a] = b; }, addLibraryExporter: function (a, b) { Aura.Ap

info identifier-low-length packages/babel-generator/test/fixtures/edgecase/new-precedence/input.js:1:1

mean non-conventional identifier length 1.90 over 41 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/edgecase/new-precedence/output.js:1:1

mean non-conventional identifier length 1.90 over 41 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/def-site-variance/input.js:1:1

42 of 74 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/def-site-variance/output.js:1:1

42 of 74 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/enum-declaration/input.js:1:1

30 of 54 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/enum-declaration/output.js:1:1

30 of 54 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/parentheses/input.js:1:1

mean non-conventional identifier length 1.43 over 21 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/parentheses/output.js:1:1

mean non-conventional identifier length 1.43 over 21 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/qualified-generic-type/input.js:1:1

mean non-conventional identifier length 1.65 over 20 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/qualified-generic-type/output.js:1:1

mean non-conventional identifier length 1.65 over 20 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/type-union-intersection/input.js:1:1

26 of 46 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/type-union-intersection/output.js:1:1

26 of 46 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/typeapp-call/input.js:1:1

mean non-conventional identifier length 1.38 over 48 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/flow/typeapp-call/output.js:1:1

mean non-conventional identifier length 1.38 over 48 names (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/import-phases/source-expression-comments/input.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import/* 1 */./* 2 */source/* 3 */(/* 4 */"foo"/* 5 */, /* 6 */)/* 7 */;
```
likely benign LLM, confidence 0.92 Test fixture for source-phase import.source("foo") with comments.
Reasoning
This is an import-phases fixture exercising the source-phase syntax import.source(...) with comments in between. The specifier is the literal "foo". The finding is a parser-coverage artifact of the test corpus, not code that runs.
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/import-phases/source-expression-comments/output.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import /* 1 */ /* 2 */ /* 3 */.source(/* 4 */"foo" /* 5 */ /* 6 */) /* 7 */;
```
likely benign LLM, confidence 0.92 Expected formatted output for an import.source("foo") comment fixture.
Reasoning
This is the expected formatted output for the source-phase import comment fixture. It uses the literal specifier "foo" and has no sensitive behavior.
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/import-phases/source-expression-options-comments/input.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import/* 1 */./* 2 */source/* 3 */(/* 4 */"foo"/* 5 */, /* 6 */options/* 7 */,/* 8 */)/* 9 */;
```
likely benign LLM, confidence 0.92 Test fixture for import.source("foo", options) with comments.
Reasoning
This fixture covers the source-phase import with an options argument and comments. The specifier is the literal "foo", and the options object is a plain identifier in a test input. It is a parser test, not a loader of attacker-controlled modules.
info ~~warn~~ → info by review dynamic-import packages/babel-generator/test/fixtures/import-phases/source-expression-options-comments/output.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import /* 1 */ /* 2 */ /* 3 */.source(/* 4 */"foo" /* 5 */, /* 6 */options /* 7 */ /* 8 */) /* 9 */;
```
likely benign LLM, confidence 0.92 Expected formatted output for an import.source("foo", options) comment fixture.
Reasoning
This is the formatted expected output of the options-plus-comments source-phase import fixture. It contains only the literal "foo" specifier and an options identifier, with no dynamic or malicious behavior.
info unicode-surrogate packages/babel-generator/test/fixtures/minified/literals/input.js:9:2

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
"😂";
"\uD83D_\uDE02"
`😂`;
/foobar/g;
```
info unicode-surrogate packages/babel-generator/test/fixtures/minified/literals/input.js:9:9

orphaned low surrogate \uDE02 (no preceding high surrogate) (token pass, confidence 0.65)
```
"😂";
"\uD83D_\uDE02"
`😂`;
/foobar/g;
```
info unicode-surrogate packages/babel-generator/test/fixtures/minified/literals/output.js:1:40

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
5;5;50;5e4;"foobar";" ";"\n\r";"😂";"\uD83D_\uDE02"`😂`;/foobar/g;null;true;false;5;2;56;31;
```
info unicode-surrogate packages/babel-generator/test/fixtures/minified/literals/output.js:1:47

orphaned low surrogate \uDE02 (no preceding high surrogate) (token pass, confidence 0.65)
```
5;5;50;5e4;"foobar";" ";"\n\r";"😂";"\uD83D_\uDE02"`😂`;/foobar/g;null;true;false;5;2;56;31;
```
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/exponentiation/input.js:1:1

mean non-conventional identifier length 1.26 over 23 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/exponentiation/output.js:1:1

mean non-conventional identifier length 1.26 over 23 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/in-inside-for/input.js:1:1

mean non-conventional identifier length 1.98 over 299 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/in-inside-for/output.js:1:1

mean non-conventional identifier length 1.98 over 299 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/new-callee/input.js:1:1

23 of 50 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/new-callee/output.js:1:1

23 of 50 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/nullish-coalescing/input.js:1:1

mean non-conventional identifier length 1.46 over 35 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/nullish-coalescing/output.js:1:1

mean non-conventional identifier length 1.46 over 35 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/sequence-expression-createParenthesizedExpressions/input.js:1:1

34 of 48 non-conventional identifiers are single-character (71%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/sequence-expression-createParenthesizedExpressions/output.js:1:1

34 of 48 non-conventional identifiers are single-character (71%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/sequence-expressions/input.js:1:1

34 of 48 non-conventional identifiers are single-character (71%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/sequence-expressions/output.js:1:1

34 of 48 non-conventional identifiers are single-character (71%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/ts-function-type/input.ts:1:1

30 of 60 non-conventional identifiers are single-character (50%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/ts-function-type/output.js:1:1

30 of 60 non-conventional identifiers are single-character (50%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/ts-new-callee/input.js:1:1

25 of 51 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/parentheses/ts-new-callee/output.js:1:1

25 of 51 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
info whitespace-anomaly packages/babel-generator/test/fixtures/regression/comment-before-parentheses-return-arg-createParenthesizedExpressions/input.js:2:1

file mixes tab and space indentation (8 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
function assertElement(assertFn, shouldBeElement, opt_message) {
  return /** @type {!Ele	ment} */ (
	  assertType_(
	    assertFn,
```
info whitespace-anomaly packages/babel-generator/test/fixtures/regression/comment-before-parentheses-return-arg/input.js:2:1

file mixes tab and space indentation (8 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
function assertElement(assertFn, shouldBeElement, opt_message) {
  return /** @type {!Ele	ment} */ (
	  assertType_(
	    assertFn,
```
info whitespace-anomaly packages/babel-generator/test/fixtures/sourcemaps/comment-before-parentheses-return-arg-createParenthesizedExpressions/input.js:2:1

file mixes tab and space indentation (8 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
function assertElement(assertFn, shouldBeElement, opt_message) {
  return /** @type {!Ele	ment} */ (
	  assertType_(
	    assertFn,
```
info whitespace-anomaly packages/babel-generator/test/fixtures/sourcemaps/comment-before-parentheses-return-arg/input.js:2:1

file mixes tab and space indentation (8 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
function assertElement(assertFn, shouldBeElement, opt_message) {
  return /** @type {!Ele	ment} */ (
	  assertType_(
	    assertFn,
```
info identifier-low-length packages/babel-generator/test/fixtures/types/LogicalExpression/input.js:1:1

25 of 33 non-conventional identifiers are single-character (76%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/types/LogicalExpression/output.js:1:1

25 of 33 non-conventional identifiers are single-character (76%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/cast-need-parentheses/input.js:1:1

mean non-conventional identifier length 1.61 over 90 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/cast-need-parentheses/output.js:1:1

mean non-conventional identifier length 1.61 over 90 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/satisfies-parentheses-createParenthesizedExpression/input.ts:1:1

38 of 56 non-conventional identifiers are single-character (68%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/satisfies-parentheses-createParenthesizedExpression/output.js:1:1

38 of 56 non-conventional identifiers are single-character (68%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/satisfies-parentheses/input.ts:1:1

38 of 56 non-conventional identifiers are single-character (68%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/satisfies-parentheses/output.js:1:1

38 of 56 non-conventional identifiers are single-character (68%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/types-mapped-as/input.js:1:1

21 of 40 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/types-mapped-as/output.js:1:1

21 of 40 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/types-parameter-const-modifier/input.ts:1:1

13 of 30 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-generator/test/fixtures/typescript/types-parameter-const-modifier/output.js:1:1

13 of 30 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info ~~critical~~ → info by review dynamic-execution packages/babel-generator/test/index.js:1038:5

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
    );
    new Function(generate(mem).code);
  });
```
likely benign LLM, confidence 0.80 Test harness constructing a Function from code generated by the tool's own generator.
Reasoning
The file is the scanner's own test suite. The flagged new Function(generate(mem).code) most likely appears in a test harness that evaluates code produced by the tool's own generator, checking that output is valid or behaves correctly. The source is local and generated, not attacker-supplied. Some doubt remains because the pattern is a real dynamic-execution sink, and only the snippet is visible.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/babel/babel babel && cd babel
git checkout v8.0.6
disclude scan --severity info --diff v8.0.5 packages/babel-generator