@vitest/mocker 5.1.0-beta.1

Source: https://github.com/vitest-dev/vitest
Tag scanned: v5.1.0-beta.1
Directory: packages/mocker (only this part of the repository was scanned)
Compared with: v5.0.5 (0 signals introduced since)
Files: 32 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 3.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 20:36

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:81:41

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    }${url.hash}`
    return this.wrapDynamicImport(() => import(/* @vite-ignore */ actualUrl)).then((mod) => {
      if (!resolved.optimized || typeof mod.default === 'undefined') {
        return mod
```
likely benign LLM, confidence 0.93 Dynamic import of a resolved module URL inside a browser test-runner mocker, marked @vite-ignore.
Reasoning
This is a Vite-style module mocker in a browser test runner. The import specifier is built from the resolved module URL, and the /* @vite-ignore */ comment marks it as an intentional dynamic import of a module the tool itself resolved. No decoding, remote fetch, or hidden payload is visible. The non-literal specifier is inherent to the mocking design.
info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:128:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      const query = url.search ? `${url.search}&t=${now()}` : `?t=${now()}`
      const moduleObject = await import(
        /* @vite-ignore */ `${url.pathname}${query}&mock=${mock.type}${url.hash}`
      )
```
likely benign LLM, confidence 0.93 Cache-busted dynamic import of a module path with a mock query parameter, used by the test mocker.
Reasoning
The specifier is a template built from the URL pathname, a timestamp query, and the mock type, with a Vite ignore annotation. This is a cache-busting import for module mocking, a routine pattern in test tooling. Nothing indicates attacker-controlled input or an encoded payload.
info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:134:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    return import(/* @vite-ignore */ mock.redirect)
  }
```
likely benign LLM, confidence 0.90 Dynamic import of a configured redirect module path within the browser mocker.
Reasoning
This imports mock.redirect, a path configured by the mocking framework for redirecting a module to a replacement. It is the same legitimate mocker mechanism, flagged only because the specifier is non-literal. The snippet shows no sign of remote or obfuscated loading.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/vitest-dev/vitest vitest && cd vitest
git checkout v5.1.0-beta.1
disclude scan --severity info --diff v5.0.5 packages/mocker