npm / browserslist / 4.29.4

browserslist 4.29.4

Source

https://github.com/browserslist/browserslist

Tag scanned

4.29.4

Compared with

4.29.3 (0 signals introduced since)

Files

68 scanned, 20 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-20 00:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import node.js:264:19

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       }
       var queries = require(require.resolve(name, { paths: ['.', ctx.path] }))
       if (typeof queries === 'object' && queries !== null && queries.__esModule) {
         queries = queries.default

   likely benign LLM, confidence 0.90 Dynamic require of a resolved query module in browserslist.

   Reasoning

   This is browserslist's own query loader resolving a named query module via require.resolve with explicit paths; the dynamic require is a standard plugin/query mechanism, not obfuscation.

2. info warn → info by review dynamic-import node.js:288:17

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       }
       var stats = require(
         // Use forward slashes for module paths, also on Windows.
         require.resolve(path.posix.join(name, 'browserslist-stats.json'), {

   likely benign LLM, confidence 0.90 Loads browserslist-stats.json via require.resolve with a computed path.

   Reasoning

   The require call resolves a path built from require.resolve of a fixed filename 'browserslist-stats.json' joined with a module-name variable. The comment shows deliberate path handling for Windows. This is the standard browserslist pattern for loading its own data files, not an attack.

3. info warn → info by review dynamic-import node.js:341:22

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

         try {
           compressed = require('caniuse-lite/data/regions/' + code + '.js')
         } catch (e) {
           throw new BrowserslistError('Unknown region name `' + code + '`.')

   likely benign LLM, confidence 0.92 Dynamically requires a caniuse-lite regions data file by region code.

   Reasoning

   The require specifier is a fixed prefix 'caniuse-lite/data/regions/' concatenated with a region code, wrapped in try/catch that throws a descriptive BrowserslistError. This is ordinary dynamic data loading within a known package, with the path constrained to a data directory.

4. info warn → info by review dynamic-import node.js:361:20

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

       try {
         compressed = require('caniuse-lite/data/features/' + name + '.js')
       } catch (e) {
         throw new BrowserslistError('Unknown feature name `' + name + '`.')

   likely benign LLM, confidence 0.92 Dynamically requires a caniuse-lite features data file by feature name.

   Reasoning

   Same pattern as the region loader: a fixed caniuse-lite features data prefix plus a feature name, with error handling. It is a legitimate data lookup, not code injection or a dropper.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/browserslist/browserslist browserslist && cd browserslist
git checkout 4.29.4
disclude scan --severity info --diff 4.29.3 .