convert-source-map 2.0.0

Source: https://github.com/thlorenz/convert-source-map
Tag scanned: v2.0.0
Compared with: v1.9.0 (0 signals introduced since)
Files: 7 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 5.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 13:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 README.md:9:67

[embedded javascript] base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var json = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .toJSON();
```
likely benign LLM, confidence 0.93 Markdown example showing convert-source-map parsing an inline base64 sourcemap comment.
Reasoning
The blob is the standard inline source-map data URL that convert-source-map's fromComment() parses. Its base64 decodes to a plain sourcemap JSON (version 3, file build/foo.min.js, sources src/foo.js, mappings AAAA). This is documentation of a legitimate API, and the raw-pass base64 signal has a high false-positive rate here.
info ~~warn~~ → info by review encoding-base64 README.md:13:67

[embedded javascript] base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var modified = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .setProperty('sources', [ 'SRC/FOO.JS' ])
  .toJSON();
```
likely benign LLM, confidence 0.93 Second README example of convert-source-map with the same inline base64 sourcemap, modifying the sources property.
Reasoning
Same benign inline sourcemap data URL as the other README example, decoding to ordinary sourcemap metadata. The following setProperty call only rewrites the sources field in a documentation example.
info ~~warn~~ → info by review encoding-base64 example/comment-to-json.js:6:67

base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var json = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .toJSON();
```
likely benign LLM, confidence 0.93 Example script parsing an inline base64 sourcemap comment with convert-source-map.
Reasoning
The example file uses the same standard base64 inline sourcemap comment, which decodes to benign sourcemap JSON. It is a normal use of the library's fromComment API, not a payload or hidden code.
info ~~warn~~ → info by review encoding-base64 example/comment-to-json.js:10:67

base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var modified = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .setProperty('sources', [ 'SRC/FOO.JS' ])
  .toJSON();
```
likely benign LLM, confidence 0.92 Example script modifying a parsed inline sourcemap's sources field.
Reasoning
Repeats the benign inline sourcemap pattern with a setProperty call that overrides sources. No execution or network behavior is involved.
info ~~warn~~ → info by review dynamic-execution index.js:41:36

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
function decodeBase64WithAtob(base64) {
  return decodeURIComponent(escape(atob(base64)));
}
```
likely benign LLM, confidence 0.85 Helper that base64-decodes a string to UTF-8 text using atob, escape, and decodeURIComponent.
Reasoning
The function is the common UTF-8-safe base64 decode idiom, decodeURIComponent(escape(atob(base64))). It only decodes a string into text and does not eval it, fetch anything, or spawn processes. The ast rule over-fires on atob alone, and nothing in the snippet shows the decoded value being executed.
info dynamic-execution index.js:118:10

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  var json = this.toJSON();
  return btoa(unescape(encodeURIComponent(json)));
}
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/thlorenz/convert-source-map convert-source-map && cd convert-source-map
git checkout v2.0.0
disclude scan --severity info --diff v1.9.0 .