convert-source-map 2.0.0

Source: https://github.com/thlorenz/convert-source-map
Tag scanned: v2.0.0
Compared with: v1.9.0 (0 signals introduced since)
Files: 7 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 5.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:23

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 README.md:9:67

[embedded javascript] base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var json = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .toJSON();
```
dismissed LLM, confidence 0.95 Base64-encoded inline source map passed to convert.fromComment in a markdown usage example.
Reasoning
The blob is an inline sourceMappingURL data URI. Decoded, it is a small source map JSON (version, file, sources, mappings). This is the documented input for convert-source-map's fromComment(), so it is a legitimate example, not a hidden payload.
info ~~warn~~ → info by review encoding-base64 README.md:13:67

[embedded javascript] base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var modified = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .setProperty('sources', [ 'SRC/FOO.JS' ])
  .toJSON();
```
dismissed LLM, confidence 0.95 Same base64 source map blob in a second README example that modifies the sources property.
Reasoning
Same inline source map data URI as the earlier README example, followed by setProperty('sources') and toJSON(). It is ordinary documentation for manipulating source map JSON.
info ~~warn~~ → info by review encoding-base64 example/comment-to-json.js:6:67

base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var json = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .toJSON();
```
dismissed LLM, confidence 0.95 Example script that parses an inline base64 source map comment into JSON.
Reasoning
The blob is a standard base64 inline source map comment decoded by convert-source-map's fromComment. The file is an example script, and the decoded content is ordinary source map metadata with no executable code.
info ~~warn~~ → info by review encoding-base64 example/comment-to-json.js:10:67

base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var modified = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .setProperty('sources', [ 'SRC/FOO.JS' ])
  .toJSON();
```
dismissed LLM, confidence 0.94 Second example in the script that modifies the sources of a decoded inline source map.
Reasoning
Repeats the same inline source map parsing with a setProperty call on the sources field. It is a benign demonstration of the library API.
info ~~warn~~ → info by review dynamic-execution index.js:41:36

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
function decodeBase64WithAtob(base64) {
  return decodeURIComponent(escape(atob(base64)));
}
```
likely benign LLM, confidence 0.80 Helper function that base64-decodes and UTF-8-decodes a string using atob.
Reasoning
atob is used with escape and decodeURIComponent, which is the classic idiom for decoding a base64 UTF-8 string in JavaScript. The function only decodes a value it is given and does not eval or fetch anything. The ast rule flags atob generically, and the snippet shows no dropper behaviour, though the surrounding file is not visible.
info dynamic-execution index.js:118:10

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  var json = this.toJSON();
  return btoa(unescape(encodeURIComponent(json)));
}
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/thlorenz/convert-source-map convert-source-map && cd convert-source-map
git checkout v2.0.0
disclude scan --severity info --diff v1.9.0 .