npm / @babel/helper-validator-identifier / 8.0.6

@babel/helper-validator-identifier 8.0.6

Source: https://github.com/babel/babel
Tag scanned: v8.0.6
Directory: packages/babel-helper-validator-identifier (only this part of the repository was scanned)
Compared with: v8.0.5 (6 signals introduced since)
Files: 14 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 13 info
Scan time: 3.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 13:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/babel-helper-validator-identifier/scripts/generate-identifier-regex.ts:23:9 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
const start = (
  await import(`${unicodePackageName}/Binary_Property/ID_Start/ranges.mjs`)
).default;
const cont = (
```
likely benign LLM, confidence 0.90 Build script dynamically imports Unicode ID_Start range data from a named npm package.
Reasoning
The dynamic import specifier is a template built from a package name variable, loading Unicode property range data from a build-time generator script under scripts/. This is a common pattern for code generation (e.g., generating identifier regexes from the unicode package). It is not obfuscation, and the import targets a fixed package subpath, not attacker-controlled input or a remote URL. Benign unless unicodePackageName is externally controlled, which the snippet does not suggest.
info ~~warn~~ → info by review dynamic-import packages/babel-helper-validator-identifier/scripts/generate-identifier-regex.ts:26:9 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
const cont = (
  await import(`${unicodePackageName}/Binary_Property/ID_Continue/ranges.mjs`)
).default;
```
likely benign LLM, confidence 0.90 Build script dynamically imports Unicode ID_Continue range data from a named npm package.
Reasoning
Same pattern as the sibling finding: a dynamic import of the ID_Continue ranges module from the unicode package inside a regex generator script. The specifier is a fixed package path with a variable package name, consistent with legitimate code generation. No execution of decoded payloads or remote fetches is shown.

info long-line packages/babel-helper-validator-identifier/src/identifier-regex-browser.ts:34:1 new in this release

line length 1719 characters (raw pass, confidence 0.50)

export const supplementaryIdentifierStartCodes = [0,11,2,25,2,18,2,1,2,14,3,13,35,122,70,52,268,28,4,48,48,31,14,29,6,37,11,29,3,35,5,7,2,4,43,157,19,35,5,35,5,39,9,51,13,10,2,14,2,6,2,1,2,10,2,14,2,6,2,1,4,51,13,310,10,21,11,7,25,5,2,41,2,13,65,5,3,0,2,43,2,1,4,0,3,22,11,22,10,30,66,18,2,1,11,21,11,25,7,25,39,55,7,1,6

info long-line packages/babel-helper-validator-identifier/src/identifier-regex-browser.ts:36:1 new in this release

line length 924 characters (raw pass, confidence 0.50)

export const supplementaryIdentifierCodes = [509,0,227,0,150,4,294,9,1368,2,2,1,6,3,41,2,5,0,166,1,574,3,9,9,7,9,32,4,318,1,31,4,33,15,71,10,50,3,123,2,54,14,32,10,3,1,11,3,46,10,8,0,46,9,7,2,37,13,2,9,6,1,45,0,13,2,49,13,9,3,2,11,83,11,7,0,3,0,158,11,6,9,7,3,56,1,2,6,3,1,3,2,10,0,11,1,3,6,4,4,68,8,2,0,3,0,2,3,2,4,2,0,

info unicode-surrogate packages/babel-helper-validator-identifier/test/helpers/describe-is-identifier-name-tests.js:46:36 new in this release

orphaned high surrogate \uD801 (no matching low surrogate) (token pass, confidence 0.65)
```
      // UTF16 encoding of U+107BB = D801 DFBB
      expect(isIdentifierNameImpl("\uD801")).toBe(false);
      expect(isIdentifierNameImpl("\uDFBB")).toBe(false);
    });
```
info unicode-surrogate packages/babel-helper-validator-identifier/test/helpers/describe-is-identifier-name-tests.js:47:36 new in this release

orphaned low surrogate \uDFBB (no preceding high surrogate) (token pass, confidence 0.65)
```
      expect(isIdentifierNameImpl("\uD801")).toBe(false);
      expect(isIdentifierNameImpl("\uDFBB")).toBe(false);
    });
    it("supports Unicode 17.0", () => {
```
info unicode-surrogate packages/babel-helper-validator-identifier/test/helpers/describe-is-identifier-name-tests.js:23:57

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
    );
    it.each(["+hello", "0$", "-ゆゆ式", "#_", "_#", "\ud800\ud800"])(
      "returns false if provided string %p is not an IdentifierName",
      function (word) {
```
info unicode-surrogate packages/babel-helper-validator-identifier/test/helpers/describe-is-identifier-name-tests.js:23:63

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
    );
    it.each(["+hello", "0$", "-ゆゆ式", "#_", "_#", "\ud800\ud800"])(
      "returns false if provided string %p is not an IdentifierName",
      function (word) {
```
info unicode-surrogate packages/babel-helper-validator-identifier/test/helpers/describe-is-identifier-name-tests.js:30:37

surrogate pair \uDB40\uDDD5 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
    it("supports astral symbols", function () {
      expect(isIdentifierNameImpl("x\uDB40\uDDD5")).toBe(true);
    });
    it("supports Unicode 18.0", () => {
```
info unicode-surrogate packages/babel-helper-validator-identifier/test/helpers/describe-is-identifier-name-tests.js:63:36

orphaned high surrogate \uD802 (no matching low surrogate) (token pass, confidence 0.65)
```
      // UTF16 encoding of U+10940 = D802 DD40
      expect(isIdentifierNameImpl("\uD802")).toBe(false);
      expect(isIdentifierNameImpl("_\uDD40")).toBe(false);
    });
```
info unicode-surrogate packages/babel-helper-validator-identifier/test/helpers/describe-is-identifier-name-tests.js:64:37

orphaned low surrogate \uDD40 (no preceding high surrogate) (token pass, confidence 0.65)
```
      expect(isIdentifierNameImpl("\uD802")).toBe(false);
      expect(isIdentifierNameImpl("_\uDD40")).toBe(false);
    });
    it("supports Unicode 16.0", () => {
```
info unicode-surrogate packages/babel-helper-validator-identifier/test/helpers/describe-is-identifier-name-tests.js:80:36

orphaned high surrogate \uD801 (no matching low surrogate) (token pass, confidence 0.65)
```
      // UTF16 encoding of U+105c0 = D801 DDC0
      expect(isIdentifierNameImpl("\uD801")).toBe(false);
      expect(isIdentifierNameImpl("_\uDDC0")).toBe(false);
    });
```
info unicode-surrogate packages/babel-helper-validator-identifier/test/helpers/describe-is-identifier-name-tests.js:81:37

orphaned low surrogate \uDDC0 (no preceding high surrogate) (token pass, confidence 0.65)
```
      expect(isIdentifierNameImpl("\uD801")).toBe(false);
      expect(isIdentifierNameImpl("_\uDDC0")).toBe(false);
    });
    it("supports Unicode 15.1", () => {
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/babel/babel babel && cd babel
git checkout v8.0.6
disclude scan --severity info --diff v8.0.5 packages/babel-helper-validator-identifier