npm / @typescript-eslint/eslint-plugin / 8.72.0

@typescript-eslint/eslint-plugin 8.72.0

Source: https://github.com/typescript-eslint/typescript-eslint
Tag scanned: v8.72.0
Directory: packages/eslint-plugin (only this part of the repository was scanned)
Compared with: v8.71.2 (0 signals introduced since)
Files: 492 scanned, 419 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 4.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 15:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line packages/eslint-plugin/CHANGELOG.md:3497:1

line length 1529 characters (raw pass, confidence 0.50)

* made BaseNode.parent non-optional ([#5252](https://github.com/typescript-eslint/typescript-eslint/issues/5252)) ([a4768f3](https://github.com/typescript-eslint/typescript-eslint/commit/a4768f38ef4943873c1e9443e8cd101a663ac3c0)), closes [#5036](https://github.com/typescript-eslint/typescript-eslint/issues/5036) [#5834

info unicode-surrogate packages/eslint-plugin/tests/rules/no-unnecessary-template-expression.test.ts:1838:20

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
    {
      code: "` ${'\\ud83d\\udc68'} `;",
      errors: [
        {
```
info unicode-surrogate packages/eslint-plugin/tests/rules/no-unnecessary-template-expression.test.ts:1838:27

orphaned low surrogate \uDC68 (no preceding high surrogate) (token pass, confidence 0.65)
```
    {
      code: "` ${'\\ud83d\\udc68'} `;",
      errors: [
        {
```
info unicode-surrogate packages/eslint-plugin/tests/rules/no-unnecessary-template-expression.test.ts:1848:19

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
      ],
      output: '` \\ud83d\\udc68 `;',
    },
    {
```
info unicode-surrogate packages/eslint-plugin/tests/rules/no-unnecessary-template-expression.test.ts:1848:26

orphaned low surrogate \uDC68 (no preceding high surrogate) (token pass, confidence 0.65)
```
      ],
      output: '` \\ud83d\\udc68 `;',
    },
    {
```
info ~~critical~~ → info by review dynamic-execution packages/eslint-plugin/tools/generate-breaking-changes.mts:26:3

`eval` called with a non-literal expression (ast pass, confidence 0.90)
```
  let oldRulesObject!: { rules: TypeScriptESLintRules };
  eval(`oldRulesObject = ${oldObjectText}`);
  const oldRuleNames = new Set(Object.keys(oldRulesObject.rules));
```
likely benign LLM, confidence 0.85 A developer tool evals a templated object literal of old ESLint rule text to extract rule names.
Reasoning
This is a repository maintenance script under tools/ that uses eval to parse an object literal of rule definitions, apparently taken from the project's own older source text. The eval input is not attacker-controlled network or user data, and the surrounding snippet shows only a local data-extraction purpose. Eval is a poor practice and worth flagging in review, but the snippet shows no sign of malicious intent or obfuscation.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/typescript-eslint/typescript-eslint typescript-eslint && cd typescript-eslint
git checkout v8.72.0
disclude scan --severity info --diff v8.71.2 packages/eslint-plugin