disclude.io

npm / acorn / 8.19.0

acorn 8.19.0

Source
https://github.com/acornjs/acorn
Artifact scanned
acorn-8.19.0.tgz (npm tarball · 131.1 KB · SHA-256 c6fad21ffa1f…)
Compared with
acorn-8.18.0.tgz (2 signals introduced since)
Files
9 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 4 info
Scan time
2.6 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-23 16:54

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review long-line dist/acorn.js:11:1 new in this release

    line length 2338 characters (raw pass, confidence 0.65)

      var astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 13, 65, 5, 3, 0, 2, 4
    likely benign LLM, confidence 0.97 Generated acorn parser data table of Unicode astral identifier code points on a long line in a distributed bundle.
    Reasoning

    A long line in a minified/bundled dist file containing a numeric array of Unicode code point ranges used by the acorn JavaScript parser for identifier validation. This is standard generated data from a well-known, legitimate library; long-line is a formatting signal with no obfuscation or malicious behavior present.

  2. info warn → info by review long-line dist/acorn.mjs:5:1 new in this release

    line length 2336 characters (raw pass, confidence 0.65)

    var astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 13, 65, 5, 3, 0, 2, 43,
    likely benign LLM, confidence 0.97 Generated acorn parser Unicode identifier range table in the ESM distribution file, a benign long line.
    Reasoning

    Same generated acorn Unicode identifier range table as the CommonJS build, in the ESM distribution. Long single-line numeric data in a bundled library is expected and benign; raw long-line findings have high false-positive rates.

  3. info long-line dist/acorn.d.mts:589:1

    line length 537 characters (raw pass, confidence 0.50)

      core: Statement | Expression | Declaration | ModuleDeclaration | Literal | Program | SwitchCase | CatchClause | Property | Super | SpreadElement | TemplateElement | AssignmentProperty | ObjectPattern | ArrayPattern | RestElement | AssignmentPattern | ClassBody | MethodDefinition | MetaProperty | ImportAttribute | Imp
  4. info long-line dist/acorn.d.ts:589:1

    line length 537 characters (raw pass, confidence 0.50)

      core: Statement | Expression | Declaration | ModuleDeclaration | Literal | Program | SwitchCase | CatchClause | Property | Super | SpreadElement | TemplateElement | AssignmentProperty | ObjectPattern | ArrayPattern | RestElement | AssignmentPattern | ClassBody | MethodDefinition | MetaProperty | ImportAttribute | Imp

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o acorn-8.19.0.tgz https://registry.npmjs.org/acorn/-/acorn-8.19.0.tgz
printf '%s  %s\n' c6fad21ffa1f2ba20338bf1dde1de911c2093c1aaf7b3af17c477661bd3bfaaf acorn-8.19.0.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf acorn-8.19.0.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg