d3-array 3.2.5

Source: https://github.com/d3/d3-array
Artifact scanned: d3-array-3.2.5.tgz (npm tarball · 27.4 KB · SHA-256 90139c20a9a7…)
Compared with: d3-array-3.2.4.tgz (3 signals introduced since)
Files: 5 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 2.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-11-03 07:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info identifier-low-length dist/d3-array.min.mjs:1:1 new in this release

1785 of 3215 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
info ~~warn~~ → info by review long-line dist/d3-array.min.mjs:2:1 new in this release

line length 17188 characters (raw pass, confidence 0.65)
```
function t(t,n){return null==t||null==n?NaN:t<n?-1:t>n?1:t>=n?0:NaN}function n(t,n){return null==t||null==n?NaN:n<t?-1:n>t?1:n>=t?0:NaN}function r(r){let e,f,i;function u(t,n,r=0,o=t.length){if(r<o){if(0!==e(n,n))return o;do{const e=r+o>>>1;f(t[e],n)<0?r=e+1:o=e}while(r<o)}return r}return 2!==r.length?(e=t,f=(n,o)=>t(r
```
likely benign LLM, confidence 0.97 Minified d3-array library bundle with a very long line containing ordinary comparator and bisector helper functions.
Reasoning
The finding is a long-line signal on a minified JavaScript distribution file of d3-array. The snippet shows standard minified d3 comparator and bisector code (ascending, descending, bisector functions). Minified bundles routinely have very long lines; this is a packaging artifact, not obfuscation or malicious intent. The raw pass has a higher false-positive rate and the line length alone carries no malicious signal.

info long-line dist/d3-array.mjs:1373:1 new in this release

line length 781 characters (raw pass, confidence 0.50)

export { Adder, InternMap, InternSet, ascending, bin, bisectRight as bisect, bisectCenter, bisectLeft, bisectRight, bisector, blur, blur2, blurImage, count, cross, cumsum, descending, deviation, difference, disjoint, every, extent, fcumsum, filter, flatGroup, flatRollup, fsum, greatest, greatestIndex, group, groupSort,

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o d3-array-3.2.5.tgz https://registry.npmjs.org/d3-array/-/d3-array-3.2.5.tgz
printf '%s  %s\n' 90139c20a9a7678badb0ddeb9aafd504c935dc24f5a53c3e61ccf866e4479572 d3-array-3.2.5.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf d3-array-3.2.5.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg