@vitest/mocker 5.1.0-beta.1

Source: https://github.com/vitest-dev/vitest
Artifact scanned: mocker-5.1.0-beta.1.tgz (npm tarball · 59.8 KB · SHA-256 f4c6c5246ed9…)
Compared with: mocker-5.0.5.tgz (0 signals introduced since)
Files: 30 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 10 info
Scan time: 5.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 23:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info whitespace-anomaly dist/chunk-automock.js:11:1

file mixes tab and space indentation (447 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
function setIsNodeInPattern(node) {
	return isNodeInPatternWeakSet.add(node);
}
function isNodeInPattern(node) {
```
info ~~warn~~ → info by review dynamic-execution dist/chunk-automock.js:251:32754

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
of Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0))}let D;function init$1(){return D||(D=(async()=>{const B=await WebAssembly.compile(G()),{exports:Q}=await WebAssembly.instantiate(B);A$1=Q;})())}function initSync(){if(A$1)return;const B=new WebAssembly.Module(G()),{exports:Q}=new WebAssembly.
```
likely benign LLM, confidence 0.80 Base64-to-bytes helper that feeds an embedded WebAssembly module compile/instantiate in a bundled automock library.
Reasoning
The atob call sits in a helper that decodes a base64 blob into bytes feeding WebAssembly.compile/instantiate. This is the standard inlined WASM-loading pattern used by bundled libraries (the wasm bytes are embedded and compiled, not eval'd as text). Nothing shown is a dropper or a network fetch; the decoded data is a wasm module, a legitimate bundler output.
info ~~warn~~ → info by review dynamic-execution dist/chunk-automock.js:254:17516

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
of Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0));var A;};const init=WebAssembly.compile(C()).then(WebAssembly.instantiate).then(({exports:A})=>{E=A;});
```
likely benign LLM, confidence 0.80 Inline base64 WebAssembly initializer in a bundled JavaScript chunk.
Reasoning
Same embedded-WASM loader pattern: atob converts an inline base64 string into a Uint8Array passed to WebAssembly.compile, then exports are stored. This is a typical bundled wasm initializer in a test-mocking package, with no eval of decoded text or process/network activity visible.
info whitespace-anomaly dist/chunk-hoistMocks.js:10:1

file mixes tab and space indentation (421 tab-indented and 180 space-indented lines) (raw pass, confidence 0.40)
```
function makeTest(test) {
  if (typeof test === "string")
    { return function (type) { return type === test; } }
  else if (!test)
```
info ~~warn~~ → info by review dynamic-import dist/chunk-mocker.js:393:39

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		const actualUrl = `${url.pathname}${url.search ? `${url.search}&${query}` : `?${query}`}${url.hash}`;
		return this.wrapDynamicImport(() => import(
			/* @vite-ignore */
			actualUrl
```
likely benign LLM, confidence 0.85 Dynamic import of a computed module URL inside a test-mocker wrapper.
Reasoning
This is a module loader in a mocking library that imports a computed URL with a vite-ignore hint. Dynamic import with a runtime specifier is the expected mechanism for loading mocked ES modules in Vitest-style tooling; the specifier is built from the module's own URL and query, not from untrusted remote input.
info ~~warn~~ → info by review dynamic-import dist/chunk-mocker.js:430:31

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
			const query = url.search ? `${url.search}&t=${now()}` : `?t=${now()}`;
			const moduleObject = await import(
				/* @vite-ignore */
				`${url.pathname}${query}&mock=${mock.type}${url.hash}`
```
likely benign LLM, confidence 0.85 Dynamic import with a cache-busted, mock-tagged module path in a mocker.
Reasoning
The import specifier is built from the module path plus a timestamp query and mock type, which is the cache-busting pattern a module mocker uses to reload a mocked module. It is consistent with the surrounding mocker logic and shows no remote or decoded source.
info ~~warn~~ → info by review dynamic-import dist/chunk-mocker.js:436:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		}
		return import(
			/* @vite-ignore */
			mock.redirect
```
likely benign LLM, confidence 0.80 Dynamic import of a configured redirect module path in a mocker.
Reasoning
Returns import() of mock.redirect, a path configured by the mock definition itself. This is a redirect-to-module feature of a mocking library, a legitimate use of dynamic import with a configured specifier rather than attacker-controlled code.

info whitespace-anomaly dist/chunk-utils.js:3:1

file mixes tab and space indentation (11 tab-indented and 4 space-indented lines) (raw pass, confidence 0.40)

function cleanUrl(url) {
	return url.replace(postfixRE, "");
}
function createManualModuleSource(moduleUrl, exports, globalAccessor = "\"__vitest_mocker__\"", method = "getFactoryModule") {

info whitespace-anomaly dist/hoistMocks.d-D_olmqhK.d.ts:25:1

file mixes tab and space indentation (28 tab-indented and 367 space-indented lines) (raw pass, confidence 0.40)

interface BaseNodeWithoutComments {
    // Every leaf interface that extends BaseNode must specify a type property.
    // The type property should be a string literal. For example, Identifier
    // has: `type: "Identifier"`

info long-line dist/index.d.ts:2:1

line length 541 characters (raw pass, confidence 0.50)

export { A as AutomockedModule, g as AutomockedModuleSerialized, h as AutospiedModule, i as AutospiedModuleSerialized, j as ManualMockedModule, k as ManualMockedModuleSerialized, a as MockedModule, l as MockedModuleSerialized, d as MockedModuleType, M as MockerRegistry, e as ModuleMockContext, m as ModuleMockFactory, c

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o mocker-5.1.0-beta.1.tgz https://registry.npmjs.org/@vitest/mocker/-/mocker-5.1.0-beta.1.tgz
printf '%s  %s\n' f4c6c5246ed93fa83a45a9a76047e16dc85e27e229897277dec4f804b85b0ce8 mocker-5.1.0-beta.1.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf mocker-5.1.0-beta.1.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg