@vitest/mocker 4.1.12

Source: https://github.com/vitest-dev/vitest
Tag scanned: v4.1.12
Directory: packages/mocker (only this part of the repository was scanned)
Compared with: v4.1.11 (0 signals introduced since)
Files: 31 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 3.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 20:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:74:41

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    }${url.hash}`
    return this.wrapDynamicImport(() => import(/* @vite-ignore */ actualUrl)).then((mod) => {
      if (!resolved.optimized || typeof mod.default === 'undefined') {
        return mod
```
likely benign LLM, confidence 0.90 Dynamic import of a resolved module URL in the browser mocking utility, annotated with @vite-ignore.
Reasoning
The import specifier is built from a resolved module URL inside a vitest-style browser mocker; the /* @vite-ignore */ comment is the standard Vite annotation for intentionally dynamic module loading. This is expected behavior for a module mocking framework, not obfuscated or malicious code.
info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:116:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      const query = url.search ? `${url.search}&t=${now()}` : `?t=${now()}`
      const moduleObject = await import(/* @vite-ignore */ `${url.pathname}${query}&mock=${mock.type}${url.hash}`)
      return this.mockObject(moduleObject, mock.type) as T
    }
```
likely benign LLM, confidence 0.90 Dynamic import of a path with cache-busting and mock query params inside the browser mocker.
Reasoning
The specifier is a path with a cache-busting query and a mock type parameter, consistent with a test mocker loading mocked module variants. The @vite-ignore annotation signals intentional dynamic loading. No encoding, decoding, or execution of external payloads is visible.
info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:120:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    return import(/* @vite-ignore */ mock.redirect)
  }
```
likely benign LLM, confidence 0.80 Dynamic import of a configured mock redirect module path.
Reasoning
The import target is mock.redirect, a configured redirect path for a mock. This is a legitimate pattern in a mocking library. The only residual doubt is that the redirect value's origin is not shown in the snippet, but nothing suggests remote or attacker-controlled loading.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/vitest-dev/vitest vitest && cd vitest
git checkout v4.1.12
disclude scan --severity info --diff v4.1.11 packages/mocker