@babel/parser 8.0.7

Source: https://github.com/babel/babel
Tag scanned: v8.0.7
Directory: packages/babel-parser (only this part of the repository was scanned)
Compared with: v8.0.6 (0 signals introduced since)
Files: 6167 scanned, 6941 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 45 info
Scan time: 18.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 28 of 28 warn and critical signals; 28 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:22

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/babel-parser/CHANGELOG.md:566:1

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
import(`./section-modules/${link.dataset.entryModule}.js`)
.then(module => {
  module.loadPageInto(main);
```
likely benign LLM, confidence 0.80 Documentation example of lazy-loading a page module via dynamic import.
Reasoning
Markdown changelog embedding a JS snippet showing a dynamic import of a section module from a dataset attribute. Non-literal specifier is a common legitimate lazy-loading pattern; the dataset value is not attacker-controlled in a meaningful way here.
info ~~critical~~ → info by review dynamic-execution packages/babel-parser/CHANGELOG.md:777:1

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
`toString` has already been exported. Exported identifiers must be unique. (1:7)
> 1 | export toString from './toString';
    |        ^
```
dismissed LLM, confidence 0.90 Error output text from a JavaScript/Babel-style parser about duplicate exports, misclassified as shell.
Reasoning
The snippet is a compiler error message about a duplicate export ('toString' already exported), not a shell command. The bash-embedding classification is a misparse of the markdown code block; no runtime-determined command exists.

info unicode-zero-width packages/babel-parser/src/parser/comments.ts:249:18

U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

   * ```
   * async /* 1 *⟨U+200B⟩/ function f() {}
   * ```
   * the comment whitespace `/* 1 *⟨U+200B⟩/` has leading node Identifier(async). When

info unicode-zero-width packages/babel-parser/src/parser/comments.ts:251:36

U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

   * ```
   * the comment whitespace `/* 1 *⟨U+200B⟩/` has leading node Identifier(async). When
   * we see the function token, we create a Function node and mark `/* 1 *⟨U+200B⟩/` as
   * inner comments. So `/* 1 *⟨U+200B⟩/` should be detached from the Identifier node.

info unicode-zero-width packages/babel-parser/src/parser/comments.ts:252:75

U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

   * the comment whitespace `/* 1 *⟨U+200B⟩/` has leading node Identifier(async). When
   * we see the function token, we create a Function node and mark `/* 1 *⟨U+200B⟩/` as
   * inner comments. So `/* 1 *⟨U+200B⟩/` should be detached from the Identifier node.
   *

info unicode-zero-width packages/babel-parser/src/parser/comments.ts:253:32

U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

   * we see the function token, we create a Function node and mark `/* 1 *⟨U+200B⟩/` as
   * inner comments. So `/* 1 *⟨U+200B⟩/` should be detached from the Identifier node.
   *
   * @param node the last finished AST node _before_ current token

info ~~warn~~ → info by review unicode-zero-width packages/babel-parser/test/fixtures/core/uncategorised/16/input.js:1:2

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
T⟨U+200C⟩ = []
```
likely benign LLM, confidence 0.95 Parser fixture containing a ZWNJ inside an identifier.
Reasoning
A parser test fixture deliberately using a zero-width non-joiner in an identifier to test Unicode identifier handling. Expected for a Babel-style test suite.
info ~~warn~~ → info by review unicode-zero-width packages/babel-parser/test/fixtures/core/uncategorised/17/input.js:1:2

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
T⟨U+200D⟩ = []
```
likely benign LLM, confidence 0.95 Parser fixture containing a ZWJ inside an identifier.
Reasoning
Parser test fixture with a zero-width joiner in an identifier, testing valid Unicode identifier parsing.
info ~~warn~~ → info by review unicode-zero-width packages/babel-parser/test/fixtures/core/uncategorised/450/input.js:1:1

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
⟨U+200C⟩ = []
```
likely benign LLM, confidence 0.95 Parser fixture with a ZWNJ-only identifier.
Reasoning
Parser test fixture using a ZWNJ as an identifier character; this is a conformance test, not an attack.
info ~~warn~~ → info by review unicode-zero-width packages/babel-parser/test/fixtures/core/uncategorised/451/input.js:1:1

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
⟨U+200D⟩ = []
```
likely benign LLM, confidence 0.95 Parser fixture with a ZWJ-only identifier.
Reasoning
Parser test fixture using a ZWJ as an identifier character in a conformance test.
info ~~warn~~ → info by review unicode-mixed-script packages/babel-parser/test/fixtures/es2015/let/let-declaration-in-non-BMP/input.js:1:5

identifier `in𝐬𝐭𝐚𝐧𝐜𝐞𝐨𝐟` mixes scripts: Latin + Other (raw pass, confidence 0.80)
```
let in𝐬𝐭𝐚𝐧𝐜𝐞𝐨𝐟;
```
likely benign LLM, confidence 0.95 Parser fixture declaring a non-BMP identifier.
Reasoning
Test fixture for non-BMP identifiers in let declarations; mixed-script flag is an artifact of the deliberate test input.
info ~~warn~~ → info by review generator-yield-callable packages/babel-parser/test/fixtures/es2015/regression/6864/input.js:2:4

generator `f` yields a callable — `next().value()` invokes the yielded function (state-machine pattern) (ast pass, confidence 0.80)
```
function *f() {
  (yield a => a);
  (yield async a => a);
  (yield async (a) => a);
```
likely benign LLM, confidence 0.90 Parser regression fixture yielding arrow functions from a generator.
Reasoning
Regression test for parsing yielded arrow functions inside generators. The pattern is a parser edge case, not a state-machine dropper.
info ~~warn~~ → info by review generator-yield-callable packages/babel-parser/test/fixtures/es2015/regression/6864/input.js:3:4

generator `f` yields a callable — `next().value()` invokes the yielded function (state-machine pattern) (ast pass, confidence 0.80)
```
  (yield a => a);
  (yield async a => a);
  (yield async (a) => a);
}
```
likely benign LLM, confidence 0.90 Parser regression fixture yielding async arrow functions.
Reasoning
Same regression fixture as the other finding in this file; yielded callables are syntax test cases.
info ~~warn~~ → info by review generator-yield-callable packages/babel-parser/test/fixtures/es2015/regression/6864/input.js:4:4

generator `f` yields a callable — `next().value()` invokes the yielded function (state-machine pattern) (ast pass, confidence 0.80)
```
  (yield async a => a);
  (yield async (a) => a);
}
```
likely benign LLM, confidence 0.90 Parser regression fixture yielding an async arrow with parens.
Reasoning
Same regression fixture; yielded async arrow with parenthesized parameter is a syntax test case.
info ~~warn~~ → info by review unicode-mixed-script packages/babel-parser/test/fixtures/es2017/async-functions/async-function-and-non-bmp-character/input.js:1:7

identifier `function𝐬` mixes scripts: Latin + Other (raw pass, confidence 0.80)
```
async function𝐬 f() {}
```
likely benign LLM, confidence 0.95 Parser fixture with a non-BMP character in an async function name.
Reasoning
Parser test fixture for non-BMP characters adjacent to async function syntax; the mixed-script result is deliberate.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import-createImportExpression-false/inside-function/input.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
function loadImport(file) {
  return import(`test/${file}.js`);
}
```
likely benign LLM, confidence 0.95 Function returning import() of a templated relative path.
Reasoning
A template-literal dynamic import inside a helper function, in a parser test fixture. The path prefix is fixed and only the file name varies, which is ordinary module loading.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import-createImportExpression-false/invalid-arguments-spread/input.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(...[1])
```
likely benign LLM, confidence 0.93 import() called with a spread of an array literal, used as a parser test.
Reasoning
Syntax-error fixture for spread arguments in import(). It exercises parser edge cases and does not load or execute anything meaningful.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import-createImportExpression-false/top-level/input.js:4:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
const test = 'hello';
import(`testing/${test}.js`);

import('testing.js').then(() => {});
```
likely benign LLM, confidence 0.95 Top-level import() calls with a templated and a literal specifier.
Reasoning
Parser test fixture with a template-literal import and a literal import. The non-literal case is an ordinary dynamic import with a fixed prefix.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import-createImportExpression-false/variable-arguments/input.js:2:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const testVariable = 'test.js';
import(testVariable).then(() => {});
```
likely benign LLM, confidence 0.95 Dynamic import() of a variable holding 'test.js'.
Reasoning
Same pattern as the other variable-argument fixture: a dynamic import of a local constant in a test fixture.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import/inside-function/input.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
function loadImport(file) {
  return import(`test/${file}.js`);
}
```
likely benign LLM, confidence 0.95 Parser fixture for dynamic import inside a function.
Reasoning
Parser test fixture showing dynamic import with a template specifier inside a function; standard syntax test.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import/invalid-arguments-spread/input.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(...[1])
```
likely benign LLM, confidence 0.95 Parser fixture with spread arguments to dynamic import.
Reasoning
Parser fixture testing invalid spread arguments to import(); it is intentionally malformed syntax, not an attack.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import/top-level/input.js:4:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
const test = 'hello';
import(`testing/${test}.js`);

import('testing.js').then(() => {});
```
likely benign LLM, confidence 0.95 Parser fixture for top-level dynamic imports.
Reasoning
Parser fixture for top-level dynamic import with template and literal specifiers; standard syntax coverage.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import/variable-arguments/input.js:2:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const testVariable = 'test.js';
import(testVariable).then(() => {});
```
likely benign LLM, confidence 0.95 Dynamic import() whose specifier is a variable holding 'test.js'.
Reasoning
A dynamic import of a local constant string, in a parser test fixture. Non-literal dynamic import is a normal language feature, and the import target is a fixed test file.
info unicode-surrogate packages/babel-parser/test/fixtures/es2022/module-string-names/export-name-has-lone-surrogate/input.js:2:18

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
const foo = 42, bar = 42;
export { foo as "\ud800\udbff" } // should throw
export { bar as "\udbff\udfff" } // should not throw
```
info unicode-surrogate packages/babel-parser/test/fixtures/es2022/module-string-names/export-name-has-lone-surrogate/input.js:2:24

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)
```
const foo = 42, bar = 42;
export { foo as "\ud800\udbff" } // should throw
export { bar as "\udbff\udfff" } // should not throw
```
info unicode-surrogate packages/babel-parser/test/fixtures/es2022/module-string-names/export-name-has-lone-surrogate/input.js:3:18

surrogate pair \uDBFF\uDFFF (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
export { foo as "\ud800\udbff" } // should throw
export { bar as "\udbff\udfff" } // should not throw
```
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/_no-plugin/module-blocks/input.js:4:27

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
};
let moduleExports = await import(moduleBlock);
```
likely benign LLM, confidence 0.94 await import() of a module-block value, in a parser test.
Reasoning
Experimental module-blocks parser fixture where the import target is a module block value. This is test-suite syntax, not a live payload.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/deferred-import-evaluation/invalid-spread/input.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import.defer(...["foo", { with: { type: "json" } }]);
```
likely benign LLM, confidence 0.93 import.defer called with a spread array, as an invalid-syntax test.
Reasoning
Invalid-syntax fixture for import.defer with spread arguments. It is a parser error case in a test directory.
info identifier-low-length packages/babel-parser/test/fixtures/experimental/discard-binding/object-pattern/input.js:1:1

21 of 49 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/module-blocks/valid-import-module-blocks-createImportExpression-false/input.js:4:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
};
import(module);
```
likely benign LLM, confidence 0.94 import() of a module block identifier in a valid-syntax test variant.
Reasoning
Duplicate variant of the module-blocks valid-syntax test, with the same benign structure.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/module-blocks/valid-import-module-blocks/input.js:4:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
};
import(module);
```
likely benign LLM, confidence 0.94 import() of a module block identifier in a valid-syntax test.
Reasoning
Valid module-blocks syntax test where import() takes a module block identifier. Test-suite code for an experimental proposal.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/partial-application/invalid-in-ImportCall/input.js:1:20

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const importJSON = import(?, { with: { type: "json" } });
```
likely benign LLM, confidence 0.93 import() with a partial-application placeholder, used as an invalid-syntax test.
Reasoning
Invalid partial-application syntax with a placeholder inside import(). This is a parser error fixture and the code is not meant to run.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/pipeline-operator-fsharp/fsharp-proposal-arrow-and-import-call-in-body/input.js:1:16

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
x => x |> y => import(y |> x)
```
likely benign LLM, confidence 0.92 Pipeline-operator arrow function containing import() of a piped value.
Reasoning
F-sharp pipeline proposal fixture with an import() inside an arrow body. The non-literal specifier comes from the pipeline expression, typical of parser test syntax.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/source-phase-imports/dynamic-import-comments/input.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import/* 1 */./* 2 */source/* 3 */(/* 4 */"foo"/* 5 */, /* 6 */)/* 7 */;
```
likely benign LLM, confidence 0.93 source-phase import() call with interleaved comments, used as a parser test.
Reasoning
Source-phase import syntax fixture with comments inside the call. Its purpose is testing comment placement in the parser.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/source-phase-imports/dynamic-import-options-comments/input.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import/* 1 */./* 2 */source/* 3 */(/* 4 */"foo"/* 5 */, /* 6 */ options /* 7 */, /* 8 */)/* 9 */;
```
likely benign LLM, confidence 0.93 source-phase import() with an options argument and comments, used as a parser test.
Reasoning
Source-phase import fixture with comments around an options argument. Parser test syntax with no runtime payload.
info identifier-low-length packages/babel-parser/test/fixtures/flow/arrows-in-ternaries/issue-13644/input.js:1:1

mean non-conventional identifier length 1.00 over 48 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/flow/arrows-in-ternaries/issue-58/input.js:1:1

mean non-conventional identifier length 1.20 over 140 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/flow/type-annotations/108/input.js:1:1

13 of 30 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info whitespace-anomaly packages/babel-parser/test/fixtures/jsx/regression/7/input.js:2:1

file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
<path d="M230 80
		A 45 45, 0, 1, 0, 275 125
    L 275 80 Z"/>
```
info identifier-low-length packages/babel-parser/test/fixtures/typescript/cast/destructuring-assignment-in-parens/input.ts:1:1

mean non-conventional identifier length 1.23 over 26 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/typescript/class/extends-expression-assertion/input.ts:1:1

14 of 30 non-conventional identifiers are single-character (47%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/typescript/type-arguments/instantiation-expression-property-access/input.ts:1:1

mean non-conventional identifier length 1.00 over 25 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/typescript/types/const-type-parameters/input.ts:1:1

54 of 121 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/typescript/types/import-type-dynamic-errors/input.ts:3:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
type Y = import(`Foo`);
type Z = import(Y);
```
likely benign LLM, confidence 0.95 A TypeScript type-level import(Y) with a non-literal specifier inside a parser test fixture.
Reasoning
The file is a test fixture under test/fixtures for TypeScript import-type error handling. The flagged import(Y) is a type-level import specifier, not a runtime dynamic import that loads or executes code. The snippet is intentionally malformed test input for the type checker and shows no malicious behavior.
info identifier-low-length packages/babel-parser/test/fixtures/typescript/types/mapped-as/input.ts:1:1

21 of 40 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/babel/babel babel && cd babel
git checkout v8.0.7
disclude scan --severity info --diff v8.0.6 packages/babel-parser