disclude.io

npm / @babel/traverse / 8.0.7

@babel/traverse 8.0.7

Source
https://github.com/babel/babel
Artifact scanned
traverse-8.0.7.tgz (npm tarball · 73.4 KB · SHA-256 0f226cb46f4a…)
Compared with
traverse-8.0.6.tgz (0 signals introduced since)
Files
4 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 4 info
Scan time
4.0 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-23 18:39

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review long-line lib/index.d.ts:958:1

    line length 68431 characters (raw pass, confidence 0.65)

    declare function replaceWithSourceString(this: NodePath_Final<t.Node | null>, replacement: string): [NodePath<t.Identifier, "Identifier", NonNullable<t.ArrayExpression | t.ArrayPattern | t.ArrowFunctionExpression | t.AssignmentExpression | t.AssignmentPattern | t.AwaitExpression | t.BinaryExpression | t.BindExpression
    likely benign LLM, confidence 0.95 Generated TypeScript declaration with an enormous inline union type on one line.
    Reasoning

    A very long line in a generated TypeScript declaration file from @babel/traverse-style types. The snippet is a function declaration with a huge union type, typical of auto-generated .d.ts output. Long-line on a raw pass is a known high false-positive signal; no execution or hidden content.

  2. info warn → info by review long-line lib/index.d.ts:969:1

    line length 102779 characters (raw pass, confidence 0.65)

    declare function replaceExpressionWithStatements(this: NodePath_Final<t.Node | null>, nodes: t.Statement[]): NodePath<null, null, t.Node> | (NodePath<t.Identifier, "Identifier", NonNullable<t.ArrayExpression | t.ArrayPattern | t.ArrowFunctionExpression | t.AssignmentExpression | t.AssignmentPattern | t.AwaitExpression
    likely benign LLM, confidence 0.95 Generated type declaration for replaceExpressionWithStatements with a large inlined union.
    Reasoning

    Same pattern: a generated .d.ts declaration whose type union is emitted on a single line. Type declarations cannot execute code and the content is consistent with Babel typings.

  3. info warn → info by review long-line lib/index.d.ts:970:1

    line length 134038 characters (raw pass, confidence 0.65)

    declare function replaceInline(this: NodePath_Final<t.Node | null>, nodes: t.Node | t.Node[]): (NodePath<t.Identifier, "Identifier", NonNullable<t.ArrayExpression | t.ArrayPattern | t.ArrowFunctionExpression | t.AssignmentExpression | t.AssignmentPattern | t.AwaitExpression | t.BinaryExpression | t.BindExpression | t.B
    likely benign LLM, confidence 0.95 Generated declaration for replaceInline with an oversized inlined type union.
    Reasoning

    A declare function signature in a .d.ts file with a massive generated union type. Raw long-line finding in a type declaration file; no runtime code or obfuscation is present in the snippet.

  4. info warn → info by review long-line lib/index.d.ts:4406:1

    line length 134035 characters (raw pass, confidence 0.65)

    declare function getCachedPaths(path: NodePath_Final<Node | null>): Map<Node, NodePath<t.Identifier, "Identifier", NonNullable<t.ArrayExpression | t.ArrayPattern | t.ArrowFunctionExpression | t.AssignmentExpression | t.AssignmentPattern | t.AwaitExpression | t.BinaryExpression | t.BindExpression | t.BreakStatement | t.
    likely benign LLM, confidence 0.95 Generated declaration for getCachedPaths with a large inlined type union.
    Reasoning

    Generated .d.ts declaration for getCachedPaths with a very long union type, consistent with Babel traverse typings. Length alone from a type-generator is not evidence of malice.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o traverse-8.0.7.tgz https://registry.npmjs.org/@babel/traverse/-/traverse-8.0.7.tgz
printf '%s  %s\n' 0f226cb46f4aa06d5de2bf5e56e05bffc344abd8f93435244d499f3fa10165f0 traverse-8.0.7.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf traverse-8.0.7.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg