npm / browserslist / 4.29.4

browserslist 4.29.4

Source

https://github.com/browserslist/browserslist

Artifact scanned

browserslist-4.29.4.tgz (npm tarball · 18.3 KB · SHA-256 9336d0f09dde…)

Compared with

browserslist-4.29.3.tgz (0 signals introduced since)

Files

10 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 19:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import node.js:264:19

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       }
       var queries = require(require.resolve(name, { paths: ['.', ctx.path] }))
       if (typeof queries === 'object' && queries !== null && queries.__esModule) {
         queries = queries.default

   likely benign LLM, confidence 0.90 Browserslist resolves and requires a named query module via require.resolve with project paths.

   Reasoning

   This is browserslist's loader for user-named config/query modules. The specifier is resolved with require.resolve against the project paths and then required, which is a normal plugin/query resolution pattern. No decoding, shell use or network access is involved.

2. info warn → info by review dynamic-import node.js:288:17

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       }
       var stats = require(
         // Use forward slashes for module paths, also on Windows.
         require.resolve(path.posix.join(name, 'browserslist-stats.json'), {

   likely benign LLM, confidence 0.90 Loads browserslist-stats.json through require.resolve, a routine data-file load.

   Reasoning

   The require target is produced by require.resolve on a fixed filename, browserslist-stats.json, joined under a package name. This is a standard data-file load in browserslist and does not execute attacker-controlled content.

3. info warn → info by review dynamic-import node.js:341:22

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

         try {
           compressed = require('caniuse-lite/data/regions/' + code + '.js')
         } catch (e) {
           throw new BrowserslistError('Unknown region name `' + code + '`.')

   likely benign LLM, confidence 0.90 Dynamically requires a caniuse-lite region data file by code, with error handling.

   Reasoning

   The path is a fixed prefix 'caniuse-lite/data/regions/' plus a region code, wrapped in try/catch that rethrows a BrowserslistError. This is the usual dynamic data lookup in caniuse-lite consumers and is limited to that data directory.

4. info warn → info by review dynamic-import node.js:361:20

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

       try {
         compressed = require('caniuse-lite/data/features/' + name + '.js')
       } catch (e) {
         throw new BrowserslistError('Unknown feature name `' + name + '`.')

   likely benign LLM, confidence 0.90 Dynamically requires a caniuse-lite feature data file by name, with error handling.

   Reasoning

   The same pattern as the region loader: a fixed caniuse-lite features directory with a user-supplied name concatenated in, guarded by try/catch. It is a data lookup, not a code-execution or exfiltration path. Path traversal would only reach other local files and does not show malicious intent.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o browserslist-4.29.4.tgz https://registry.npmjs.org/browserslist/-/browserslist-4.29.4.tgz
printf '%s  %s\n' 9336d0f09dde62450e27b68a2d421ebd212453b576f14fe855fbbc95828ab5d0 browserslist-4.29.4.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf browserslist-4.29.4.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg