@babel/parser 8.0.7

Source: https://github.com/babel/babel
Artifact scanned: parser-8.0.7.tgz (npm tarball · 116.9 KB · SHA-256 139a8ad511dd…)
Compared with: parser-8.0.6.tgz (0 signals introduced since)
Files: 7 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 4.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 16:24

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import CHANGELOG.md:566:1

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
import(`./section-modules/${link.dataset.entryModule}.js`)
.then(module => {
  module.loadPageInto(main);
```
likely benign LLM, confidence 0.85 A markdown changelog code sample showing a lazy-loaded page section via a templated dynamic import.
Reasoning
The finding is a fenced JavaScript example in a changelog. It shows a dynamic import whose path is built from a dataset attribute, which is a common lazy-loading pattern for page sections. The snippet has no network access, decoding, or process spawning, and a changelog is documentation, not shipped code. The dynamic specifier is only mildly interesting, so this is likely benign.
info ~~critical~~ → info by review dynamic-execution CHANGELOG.md:777:1

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
`toString` has already been exported. Exported identifiers must be unique. (1:7)
> 1 | export toString from './toString';
    |        ^
```
dismissed LLM, confidence 0.93 A markdown changelog excerpt quoting a JavaScript duplicate-export error message, misread as a shell command.
Reasoning
The flagged 'embedded bash' block is not shell code. It is a compiler or parser error message about a duplicate export of `toString` in a JavaScript module, with a caret marker. The ast pass appears to have mislabeled the text as a shell command, and nothing in the snippet executes anything. The critical severity is a misclassification.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o parser-8.0.7.tgz https://registry.npmjs.org/@babel/parser/-/parser-8.0.7.tgz
printf '%s  %s\n' 139a8ad511dd38cc9a6329a02a51df0f2c642e7e40d8a60ffe80ebae77115e93 parser-8.0.7.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf parser-8.0.7.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg