npm / @babel/helper-validator-identifier / 8.0.6

@babel/helper-validator-identifier 8.0.6

Source

https://github.com/babel/babel

Artifact scanned

helper-validator-identifier-8.0.6.tgz (npm tarball · 7.0 KB · SHA-256 9eb9bf58bace…)

Compared with

helper-validator-identifier-8.0.4.tgz (1 signals introduced since)

Files

6 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 16:33

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review long-line lib/identifier-browser.js:5:1 new in this release

   line length 2345 characters (raw pass, confidence 0.65)

   const supplementaryIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 13, 65, 5, 3, 

   likely benign LLM, confidence 0.97 A minified browser build of Unicode supplementary identifier-range data stored as one long numeric array.

   Reasoning

   The raw long-line signal fires on a single line holding a large numeric array. The snippet is a table of Unicode identifier code-point ranges, the kind of data an identifier parser such as acorn ships in its browser build. The file name, the array contents and the lack of any execution or decoding logic all point to a legitimate data table. Long generated lines are a known raw-pass false positive.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o helper-validator-identifier-8.0.6.tgz https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.6.tgz
printf '%s  %s\n' 9eb9bf58bace8c3d1fce42fd15abea35e10ab5061d0ab9be42b489404175110b helper-validator-identifier-8.0.6.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf helper-validator-identifier-8.0.6.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg