convert-source-map 2.0.0

Source: https://github.com/thlorenz/convert-source-map
Artifact scanned: convert-source-map-2.0.0.tgz (npm tarball · 4.8 KB · SHA-256 17f7253ec7e4…)
Compared with: convert-source-map-1.9.0.tgz (0 signals introduced since)
Files: 3 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 4.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 16:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 README.md:9:67

[embedded javascript] base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var json = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .toJSON();
```
dismissed LLM, confidence 0.93 A base64 inline source map embedded in a README code example for convert-source-map.
Reasoning
The blob is a standard inline source map (version 3, file build/foo.min.js, sources src/foo.js) inside a markdown code sample for a source-map conversion library. It is documentation of a legitimate pattern, not hidden code, and nothing in the snippet decodes it into execution.
info ~~warn~~ → info by review encoding-base64 README.md:13:67

[embedded javascript] base64-like blob (148 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
var modified = convert
  .fromComment('//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQvZm9vLm1pbi5qcyIsInNvdXJjZXMiOlsic3JjL2Zvby5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSIsInNvdXJjZVJvb3QiOiIvIn0=')
  .setProperty('sources', [ 'SRC/FOO.JS' ])
  .toJSON();
```
dismissed LLM, confidence 0.92 A second README example reuses the same base64 inline source map while rewriting the sources field.
Reasoning
This is the same base64 source-map comment as the previous finding, used in a second documentation example that calls setProperty on the sources list. It is a usage illustration in markdown with no executable payload.
info ~~warn~~ → info by review dynamic-execution index.js:41:36

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
function decodeBase64WithAtob(base64) {
  return decodeURIComponent(escape(atob(base64)));
}
```
likely benign LLM, confidence 0.80 A utility function that base64-decodes a string to UTF-8 text using atob, escape and decodeURIComponent.
Reasoning
The helper is the conventional UTF-8-aware base64 decoder, decodeURIComponent(escape(atob(x))). The snippet shows no eval, Function constructor, network fetch, or other downstream execution of the decoded value, and the function name matches its purpose. The residual doubt is that the decoded output's use is not visible.
info dynamic-execution index.js:118:10

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  var json = this.toJSON();
  return btoa(unescape(encodeURIComponent(json)));
}
```

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o convert-source-map-2.0.0.tgz https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz
printf '%s  %s\n' 17f7253ec7e4e09f68371192fded2b5241a5cf85e610e5059b1d49e878fe1898 convert-source-map-2.0.0.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf convert-source-map-2.0.0.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg