disclude.io

npm / @opentelemetry/instrumentation / 0.300.0

@opentelemetry/instrumentation 0.300.0

Source
https://github.com/open-telemetry/opentelemetry-js
Commit scanned
12a5817ad147 (recorded by npm)
Directory
experimental/packages/opentelemetry-instrumentation (only this part of the repository was scanned)
Compared with
92b844e8aa7d (0 signals introduced since)
Files
45 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 2 info
Scan time
3.7 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-22 10:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review dynamic-import experimental/packages/opentelemetry-instrumentation/test/node/InstrumentationBase.test.ts:313:32

    `require` called with a non-literal specifier (ast pass, confidence 0.60)

            instrumentation.enable();
        const exportsPatched = require(moduleName);
        assert.equal(exportsPatched.__patched, true, 'after enable');
        instrumentation.disable();
    likely benign LLM, confidence 0.90 A test requires a module through a variable specifier to check that instrumentation patched its exports.
    Reasoning

    The snippet is from a unit test that enables an instrumentation, requires a module by a variable name, asserts a patch flag, and disables again. A dynamic require inside a test harness for module patching is a normal pattern, and nothing here decodes, downloads, or executes an untrusted payload. The AST rule fires only because the specifier is not a literal.

  2. info warn → info by review dynamic-import experimental/packages/opentelemetry-instrumentation/test/node/InstrumentationBase.test.ts:363:32

    `require` called with a non-literal specifier (ast pass, confidence 0.60)

            instrumentation.enable();
        const exportsPatched = require(fileName);
        assert.equal(exportsPatched.__patched, true, 'after enable');
        instrumentation.disable();
    likely benign LLM, confidence 0.90 A test requires a fixture file through a variable path to verify that instrumentation patched its exports.
    Reasoning

    This is the same test pattern as the sibling finding: enable instrumentation, require a file by a variable name, assert the patch marker, then disable. The specifier comes from the test's own fixtures and no encoded or remote content is involved, so the non-literal require is benign test scaffolding.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/open-telemetry/opentelemetry-js opentelemetry-js && cd opentelemetry-js
git checkout 12a5817ad147c186a0e45a6637abd5abf423727a
disclude scan --severity info --diff 92b844e8aa7d9655e4b3560154e912c4c1ced64d experimental/packages/opentelemetry-instrumentation