npm / @types/node / 26.6.4

@types/node 26.6.4

Source

https://github.com/DefinitelyTyped/DefinitelyTyped

Artifact scanned

node-26.6.4.tgz (npm tarball · 460.0 KB · SHA-256 bf2dbf11cfcc…)

Compared with

node-26.6.3.tgz (0 signals introduced since)

Files

91 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

0.4 s

LLM review

LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 13:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line README.md:15:1

   line length 1025 characters (raw pass, confidence 0.50)

   These definitions were written by [Microsoft TypeScript](https://github.com/Microsoft), [Alberto Schiabel](https://github.com/jkomyno), [Andrew Makarov](https://github.com/r3nya), [Benjamin Toueg](https://github.com/btoueg), [David Junger](https://github.com/touffy), [Mohsen Azimi](https://github.com/mohsen1), [Nikita 

2. info unicode-mixed-script http.d.ts:2151:46

   identifier `oʊmɪɡə` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

        * try {
        *   validateHeaderValue('x-my-header', 'oʊmɪɡə');
        * } catch (err) {
        *   console.error(err instanceof TypeError); // --> true

3. info encoding-base64 https.d.ts:280:31

   base64-like blob (44 bytes, compression ratio 1.25) (in comment) (raw pass, confidence 0.36)

        *     // Pin the public key, similar to HPKP pin-sha256 pinning
        *     const pubkey256 = 'pL1+qb9HTMRZJmuC/bB/ZI9d302BYrrqiVuRyW+DGrU=';
        *     if (sha256(cert.pubkey) !== pubkey256) {
        *       const msg = 'Certificate verification error: ' +

4. info encoding-base64 https.d.ts:338:34

   10 rows of base64-like lines, lines 338-349 (first: base64-like blob (44 bytes, compression ratio 1.25) (in comment)) (raw pass, confidence 0.36)

        *   Certificate SHA256 fingerprint: 25:FE:39:32:D9:63:8C:8A:FC:A1:9A:29:87:D8:3E:4C:1D:98:DB:71:E4:1A:48:03:98:EA:22:6A:BD:8B:93:16
        *   Public key ping-sha256: pL1+qb9HTMRZJmuC/bB/ZI9d302BYrrqiVuRyW+DGrU=
        * Subject Common Name: DigiCert SHA2 Extended Validation Server CA

5. info unicode-zero-width process.d.ts:1215:36

   U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

                        *
                        * The idea of ⟨U+200B⟩⟨U+200B⟩this function is to help you free up resources when the starts process exiting, but also let the object be garbage collected if it is no longer being used.
                        * @param ref The reference to the resource that is being tracked.

6. info unicode-zero-width process.d.ts:1215:39

   U+200B ZERO WIDTH SPACE in source (in string/comment) (raw pass, confidence 0.45)

                        *
                        * The idea of ⟨U+200B⟩⟨U+200B⟩this function is to help you free up resources when the starts process exiting, but also let the object be garbage collected if it is no longer being used.
                        * @param ref The reference to the resource that is being tracked.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o node-26.6.4.tgz https://registry.npmjs.org/@types/node/-/node-26.6.4.tgz
printf '%s  %s\n' bf2dbf11cfccd34681fc4d5e4d150afce77fd6610224757dbe6c92c8e5149700 node-26.6.4.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf node-26.6.4.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg