npm / @babel/parser / 7.29.11

@babel/parser 7.29.11

Source

https://github.com/babel/babel

Artifact scanned

parser-7.29.11.tgz (npm tarball · 430.6 KB · SHA-256 468f983dce89…)

Compared with

parser-7.29.9.tgz (1 signals introduced since)

Files

6 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

5.3 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-24 17:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line lib/index.js:13976:1 new in this release

   line length 834 characters (raw pass, confidence 0.50)

       var _node$phase, _node$directive, _node$decorators, _node$optional, _node$typeAnnotation, _node$accessibility, _node$decorators2, _node$override, _node$readonly, _node$static, _node$declare, _node$returnType, _node$typeParameters, _node$optional2, _node$optional3, _node$accessibility2, _node$readonly2, _node$static

2. info warn → info by review dynamic-import CHANGELOG.md:566:1

   [embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

   import(`./section-modules/${link.dataset.entryModule}.js`)
   .then(module => {
     module.loadPageInto(main);

   likely benign LLM, confidence 0.85 A changelog code sample showing a dynamic import of a page section module based on a dataset value.

   Reasoning

   The snippet is a documentation example in a changelog showing a lazy-loaded section module via dynamic import with a template-literal path. The ast pass flags the non-literal specifier, which is a common and legitimate frontend pattern. Nothing in the snippet fetches remote code or hides intent, so it reads as a benign code sample.

3. info critical → info by review dynamic-execution CHANGELOG.md:777:1

   [embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

   `toString` has already been exported. Exported identifiers must be unique. (1:7)
   > 1 | export toString from './toString';
       |        ^

   dismissed LLM, confidence 0.92 Pasted compiler error text about a duplicate export, misread as a shell command.

   Reasoning

   The snippet is a parser or linter error message ('toString has already been exported') embedded in a markdown changelog. The 'dynamic-execution' signal fired because the tool parsed the error text as a bash block. No command is executed, so this is a false positive from markdown code-fence parsing.

4. info warn → info by review long-line lib/index.js:1451:1

   line length 2267 characters (raw pass, confidence 0.65)

   const astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 8, 70, 5, 3, 0, 2, 43

   dismissed LLM, confidence 0.90 A long generated array of Unicode identifier code-point ranges in a bundled parser library.

   Reasoning

   The raw pass flagged line length alone. The snippet is a large literal array of numeric code-point ranges, the kind of identifier-start/part table found in JavaScript parsers such as acorn or babel. Long generated data lines are common and carry no obfuscation or malicious signal.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o parser-7.29.11.tgz https://registry.npmjs.org/@babel/parser/-/parser-7.29.11.tgz
printf '%s  %s\n' 468f983dce8958e8a731dd32cf2a9211ac2004f0d9c5536f8c4a9a679f3d5963 parser-7.29.11.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf parser-7.29.11.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg