@babel/parser 8.0.7

Source: https://github.com/babel/babel
Tag scanned: v8.0.7
Directory: packages/babel-parser (only this part of the repository was scanned)
Compared with: v8.0.6 (0 signals introduced since)
Files: 6167 scanned, 6941 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 45 info
Scan time: 17.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 28 of 28 warn and critical signals; 28 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 13:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/babel-parser/CHANGELOG.md:566:1

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
import(`./section-modules/${link.dataset.entryModule}.js`)
.then(module => {
  module.loadPageInto(main);
```
likely benign LLM, confidence 0.80 Markdown changelog example of lazy-loading a section module via dynamic import.
Reasoning
Dynamic import with a template-built path from a dataset attribute in documentation example code; a common lazy-loading pattern shown in a changelog, not an attack.
info ~~critical~~ → info by review dynamic-execution packages/babel-parser/CHANGELOG.md:777:1

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
`toString` has already been exported. Exported identifiers must be unique. (1:7)
> 1 | export toString from './toString';
    |        ^
```
dismissed LLM, confidence 0.90 Changelog text quoting a JavaScript duplicate-export compiler error, mislabelled as shell.
Reasoning
The snippet is a Babel/ESLint-style error message about duplicate export names, not a shell command with a variable command name. The finding's signal is a misclassification of an embedded bash block.

info unicode-zero-width packages/babel-parser/src/parser/comments.ts:249:18

U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

   * ```
   * async /* 1 *⟨U+200B⟩/ function f() {}
   * ```
   * the comment whitespace `/* 1 *⟨U+200B⟩/` has leading node Identifier(async). When

info unicode-zero-width packages/babel-parser/src/parser/comments.ts:251:36

U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

   * ```
   * the comment whitespace `/* 1 *⟨U+200B⟩/` has leading node Identifier(async). When
   * we see the function token, we create a Function node and mark `/* 1 *⟨U+200B⟩/` as
   * inner comments. So `/* 1 *⟨U+200B⟩/` should be detached from the Identifier node.

info unicode-zero-width packages/babel-parser/src/parser/comments.ts:252:75

U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

   * the comment whitespace `/* 1 *⟨U+200B⟩/` has leading node Identifier(async). When
   * we see the function token, we create a Function node and mark `/* 1 *⟨U+200B⟩/` as
   * inner comments. So `/* 1 *⟨U+200B⟩/` should be detached from the Identifier node.
   *

info unicode-zero-width packages/babel-parser/src/parser/comments.ts:253:32

U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

   * we see the function token, we create a Function node and mark `/* 1 *⟨U+200B⟩/` as
   * inner comments. So `/* 1 *⟨U+200B⟩/` should be detached from the Identifier node.
   *
   * @param node the last finished AST node _before_ current token

info ~~warn~~ → info by review unicode-zero-width packages/babel-parser/test/fixtures/core/uncategorised/16/input.js:1:2

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
T⟨U+200C⟩ = []
```
likely benign LLM, confidence 0.90 Parser test fixture using a ZWNJ inside a JavaScript identifier.
Reasoning
A zero-width non-joiner in an identifier in a parser test fixture; this is a deliberate edge case for identifier parsing, not malicious.
info ~~warn~~ → info by review unicode-zero-width packages/babel-parser/test/fixtures/core/uncategorised/17/input.js:1:2

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
T⟨U+200D⟩ = []
```
likely benign LLM, confidence 0.90 Parser test fixture using a ZWJ inside a JavaScript identifier.
Reasoning
Zero-width joiner in an identifier in a parser test fixture, a deliberate Unicode identifier edge case.
info ~~warn~~ → info by review unicode-zero-width packages/babel-parser/test/fixtures/core/uncategorised/450/input.js:1:1

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
⟨U+200C⟩ = []
```
likely benign LLM, confidence 0.90 Parser fixture with a ZWNJ-only identifier.
Reasoning
Standalone ZWNJ identifier in a test fixture of a parser suite; expected test input.
info ~~warn~~ → info by review unicode-zero-width packages/babel-parser/test/fixtures/core/uncategorised/451/input.js:1:1

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
⟨U+200D⟩ = []
```
likely benign LLM, confidence 0.90 Parser fixture with a ZWJ-only identifier.
Reasoning
Standalone ZWJ identifier in a parser test fixture; expected test input.
info ~~warn~~ → info by review unicode-mixed-script packages/babel-parser/test/fixtures/es2015/let/let-declaration-in-non-BMP/input.js:1:5

identifier `in𝐬𝐭𝐚𝐧𝐜𝐞𝐨𝐟` mixes scripts: Latin + Other (raw pass, confidence 0.80)
```
let in𝐬𝐭𝐚𝐧𝐜𝐞𝐨𝐟;
```
likely benign LLM, confidence 0.90 Test fixture declaring a let variable with non-BMP mathematical bold letters.
Reasoning
Mathematical bold characters in an identifier inside a Babel-style conformance fixture for non-BMP identifiers; intentional test of Unicode parsing.
info ~~warn~~ → info by review generator-yield-callable packages/babel-parser/test/fixtures/es2015/regression/6864/input.js:2:4

generator `f` yields a callable — `next().value()` invokes the yielded function (state-machine pattern) (ast pass, confidence 0.80)
```
function *f() {
  (yield a => a);
  (yield async a => a);
  (yield async (a) => a);
```
dismissed LLM, confidence 0.90 Parser regression fixture with generators yielding arrow functions.
Reasoning
Yielding arrow functions is valid JavaScript; this is a parser regression fixture, and the generator yields callables without any invocation of next().value().
info ~~warn~~ → info by review generator-yield-callable packages/babel-parser/test/fixtures/es2015/regression/6864/input.js:3:4

generator `f` yields a callable — `next().value()` invokes the yielded function (state-machine pattern) (ast pass, confidence 0.80)
```
  (yield a => a);
  (yield async a => a);
  (yield async (a) => a);
}
```
dismissed LLM, confidence 0.90 Parser regression fixture with generators yielding async arrow functions.
Reasoning
Same regression fixture; yielding arrow functions is ordinary syntax with no state-machine invocation.
info ~~warn~~ → info by review generator-yield-callable packages/babel-parser/test/fixtures/es2015/regression/6864/input.js:4:4

generator `f` yields a callable — `next().value()` invokes the yielded function (state-machine pattern) (ast pass, confidence 0.80)
```
  (yield async a => a);
  (yield async (a) => a);
}
```
dismissed LLM, confidence 0.90 Parser regression fixture with generators yielding async arrow functions.
Reasoning
Same regression fixture; ordinary generator yield syntax in a parser test.
info ~~warn~~ → info by review unicode-mixed-script packages/babel-parser/test/fixtures/es2017/async-functions/async-function-and-non-bmp-character/input.js:1:7

identifier `function𝐬` mixes scripts: Latin + Other (raw pass, confidence 0.80)
```
async function𝐬 f() {}
```
likely benign LLM, confidence 0.90 Parser fixture with a non-BMP character adjacent to an async function declaration.
Reasoning
Non-BMP character in an identifier inside a parser fixture testing async function syntax; intentional test input.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import-createImportExpression-false/inside-function/input.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
function loadImport(file) {
  return import(`test/${file}.js`);
}
```
likely benign LLM, confidence 0.90 Parser fixture with a templated dynamic import inside a function.
Reasoning
Parser fixture for dynamic import with the createImportExpressions option disabled; benign test input.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import-createImportExpression-false/invalid-arguments-spread/input.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(...[1])
```
likely benign LLM, confidence 0.90 Parser fixture for invalid dynamic import arguments with spread.
Reasoning
Invalid spread-argument dynamic import test case in a parser fixture; benign.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import-createImportExpression-false/top-level/input.js:4:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
const test = 'hello';
import(`testing/${test}.js`);

import('testing.js').then(() => {});
```
likely benign LLM, confidence 0.93 Babel-style test fixture using dynamic import() with a template-string specifier.
Reasoning
This is a parser test fixture exercising dynamic import with a template-literal specifier. The file path and snippet show ordinary test input, not a payload.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import-createImportExpression-false/variable-arguments/input.js:2:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const testVariable = 'test.js';
import(testVariable).then(() => {});
```
likely benign LLM, confidence 0.93 Test fixture calling import() with a variable specifier.
Reasoning
A fixture in a parser test suite that passes a variable to import(). The flagged pattern is a normal dynamic import in test input.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import/inside-function/input.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
function loadImport(file) {
  return import(`test/${file}.js`);
}
```
likely benign LLM, confidence 0.90 Parser fixture showing a dynamic import with a templated path inside a function.
Reasoning
Dynamic import inside a test fixture for the dynamic-import syntax feature; the path is a parameter, but this is a parser test.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import/invalid-arguments-spread/input.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(...[1])
```
likely benign LLM, confidence 0.90 Parser fixture for invalid dynamic import arguments using spread.
Reasoning
Spread-argument dynamic import is an invalid-syntax test case in a parser fixture suite.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import/top-level/input.js:4:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
const test = 'hello';
import(`testing/${test}.js`);

import('testing.js').then(() => {});
```
likely benign LLM, confidence 0.90 Parser fixture exercising top-level dynamic import.
Reasoning
Top-level dynamic import with template and literal specifiers in a parser test fixture; benign.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/es2020/dynamic-import/variable-arguments/input.js:2:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const testVariable = 'test.js';
import(testVariable).then(() => {});
```
likely benign LLM, confidence 0.90 Parser fixture for dynamic import with a variable argument.
Reasoning
Dynamic import with a variable specifier in a parser test fixture; benign syntax coverage.
info unicode-surrogate packages/babel-parser/test/fixtures/es2022/module-string-names/export-name-has-lone-surrogate/input.js:2:18

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
const foo = 42, bar = 42;
export { foo as "\ud800\udbff" } // should throw
export { bar as "\udbff\udfff" } // should not throw
```
info unicode-surrogate packages/babel-parser/test/fixtures/es2022/module-string-names/export-name-has-lone-surrogate/input.js:2:24

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)
```
const foo = 42, bar = 42;
export { foo as "\ud800\udbff" } // should throw
export { bar as "\udbff\udfff" } // should not throw
```
info unicode-surrogate packages/babel-parser/test/fixtures/es2022/module-string-names/export-name-has-lone-surrogate/input.js:3:18

surrogate pair \uDBFF\uDFFF (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
export { foo as "\ud800\udbff" } // should throw
export { bar as "\udbff\udfff" } // should not throw
```
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/_no-plugin/module-blocks/input.js:4:27

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
};
let moduleExports = await import(moduleBlock);
```
likely benign LLM, confidence 0.93 Experimental-syntax test fixture using await import() on a variable.
Reasoning
A test fixture for the module-blocks proposal, which runs with the plugin disabled. The non-literal import is expected in this test context.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/deferred-import-evaluation/invalid-spread/input.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import.defer(...["foo", { with: { type: "json" } }]);
```
likely benign LLM, confidence 0.93 Invalid-syntax test fixture for import.defer with a spread argument.
Reasoning
An intentionally invalid-syntax fixture for deferred import evaluation testing spread arguments. It is parser test input, not executable malware.
info identifier-low-length packages/babel-parser/test/fixtures/experimental/discard-binding/object-pattern/input.js:1:1

21 of 49 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/module-blocks/valid-import-module-blocks-createImportExpression-false/input.js:4:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
};
import(module);
```
likely benign LLM, confidence 0.93 Module-blocks test fixture with createImportExpression disabled.
Reasoning
A duplicate of the module-blocks parser fixture with an option toggled off. The flagged dynamic import is expected in test input.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/module-blocks/valid-import-module-blocks/input.js:4:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
};
import(module);
```
likely benign LLM, confidence 0.93 Module-blocks test fixture calling import() on a variable.
Reasoning
A valid-syntax test fixture for module blocks that calls import() on a variable. This is standard test coverage for the parser.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/partial-application/invalid-in-ImportCall/input.js:1:20

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const importJSON = import(?, { with: { type: "json" } });
```
likely benign LLM, confidence 0.92 Invalid-syntax test fixture using a partial-application placeholder in import().
Reasoning
An invalid-syntax fixture for partial application inside an import call. The placeholder ? is deliberate test input and is not runnable code.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/pipeline-operator-fsharp/fsharp-proposal-arrow-and-import-call-in-body/input.js:1:16

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
x => x |> y => import(y |> x)
```
likely benign LLM, confidence 0.92 Pipeline-operator test fixture with import() inside an arrow function body.
Reasoning
A pipeline-operator test fixture where import() appears in an arrow body. This is a syntax test for the F# pipeline proposal.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/source-phase-imports/dynamic-import-comments/input.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import/* 1 */./* 2 */source/* 3 */(/* 4 */"foo"/* 5 */, /* 6 */)/* 7 */;
```
likely benign LLM, confidence 0.93 Test fixture for source-phase import syntax with interleaved comments.
Reasoning
A source-phase-imports fixture that checks comment placement inside import.source(). The heavy comments are part of the syntax test, not obfuscation.
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/experimental/source-phase-imports/dynamic-import-options-comments/input.js:1:8

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
/* 0 */import/* 1 */./* 2 */source/* 3 */(/* 4 */"foo"/* 5 */, /* 6 */ options /* 7 */, /* 8 */)/* 9 */;
```
likely benign LLM, confidence 0.93 Test fixture for source-phase import with options and comments.
Reasoning
Another source-phase-imports fixture testing comments around an options argument. The comments serve the parser test and do not hide behavior.
info identifier-low-length packages/babel-parser/test/fixtures/flow/arrows-in-ternaries/issue-13644/input.js:1:1

mean non-conventional identifier length 1.00 over 48 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/flow/arrows-in-ternaries/issue-58/input.js:1:1

mean non-conventional identifier length 1.20 over 140 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/flow/type-annotations/108/input.js:1:1

13 of 30 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info whitespace-anomaly packages/babel-parser/test/fixtures/jsx/regression/7/input.js:2:1

file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
<path d="M230 80
		A 45 45, 0, 1, 0, 275 125
    L 275 80 Z"/>
```
info identifier-low-length packages/babel-parser/test/fixtures/typescript/cast/destructuring-assignment-in-parens/input.ts:1:1

mean non-conventional identifier length 1.23 over 26 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/typescript/class/extends-expression-assertion/input.ts:1:1

14 of 30 non-conventional identifiers are single-character (47%) (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/typescript/type-arguments/instantiation-expression-property-access/input.ts:1:1

mean non-conventional identifier length 1.00 over 25 names (token pass, confidence 0.50)
info identifier-low-length packages/babel-parser/test/fixtures/typescript/types/const-type-parameters/input.ts:1:1

54 of 121 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-import packages/babel-parser/test/fixtures/typescript/types/import-type-dynamic-errors/input.ts:3:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
type Y = import(`Foo`);
type Z = import(Y);
```
likely benign LLM, confidence 0.92 TypeScript test fixture covering erroneous dynamic import types.
Reasoning
A TypeScript fixture of import types with dynamic or invalid arguments, used for error-case testing. The import() here is a type-level construct.
info identifier-low-length packages/babel-parser/test/fixtures/typescript/types/mapped-as/input.ts:1:1

21 of 40 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/babel/babel babel && cd babel
git checkout v8.0.7
disclude scan --severity info --diff v8.0.6 packages/babel-parser