@babel/parser 8.0.8

Source: https://github.com/babel/babel
Artifact scanned: parser-8.0.8.tgz (npm tarball · 117.4 KB · SHA-256 d25c5cd778c3…)
Compared with: parser-8.0.7.tgz (0 signals introduced since)
Files: 7 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 4.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 14:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import CHANGELOG.md:566:1

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
import(`./section-modules/${link.dataset.entryModule}.js`)
.then(module => {
  module.loadPageInto(main);
```
likely benign LLM, confidence 0.85 A changelog code example showing a lazy-loaded page section via a templated dynamic import.
Reasoning
This is a markdown changelog with an embedded JavaScript example. The dynamic import with a templated module path reads as a documented lazy-loading pattern for page sections, not a payload. Dynamic import in a changelog code sample is common and the snippet shows nothing malicious.
info ~~critical~~ → info by review dynamic-execution CHANGELOG.md:777:1

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
`toString` has already been exported. Exported identifiers must be unique. (1:7)
> 1 | export toString from './toString';
    |        ^
```
dismissed LLM, confidence 0.92 A pasted JavaScript parser error message about a duplicate export, misclassified as a bash command.
Reasoning
The flagged 'bash' block is not shell code. It is a compiler/parser error message (a duplicate export of toString, with a caret pointer), pasted into the changelog. The 'command name is a variable' finding was triggered by misreading error text as a shell command, so this is a false positive.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o parser-8.0.8.tgz https://registry.npmjs.org/@babel/parser/-/parser-8.0.8.tgz
printf '%s  %s\n' d25c5cd778c3a0d123292225f680f4c7d66bb1ea3ee843d4f44d7aff0f64a2c5 parser-8.0.8.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf parser-8.0.8.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg