npm / emoji-regex / 11.0.0

emoji-regex 11.0.0

Source

https://github.com/mathiasbynens/emoji-regex

Tag scanned

v11.0.0

Compared with

v10.6.0 (3 signals introduced since)

Files

10 scanned, 0 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

2.9 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 19:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review long-line index.mjs:3:1 new in this release

   line length 14115 characters (raw pass, confidence 0.65)

   	return /[#*0-9]\uFE0F?\u20E3|[\xA9\xAE\u203C\u2049\u2122\u2139\u2194-\u2199\u21A9\u21AA\u231A\u231B\u2328\u23CF\u23ED-\u23EF\u23F1\u23F2\u23F8-\u23FA\u24C2\u25AA\u25AB\u25B6\u25C0\u25FB\u25FC\u25FE\u2600-\u2604\u260E\u2611\u2614\u2615\u2618\u2620\u2622\u2623\u2626\u262A\u262E\u262F\u2638-\u263A\u2640\u2642\u2648-\u265

   likely benign LLM, confidence 0.90 Minified generated emoji regex literal on one very long line.

   Reasoning

   A 14115-character line is a generated regex character class of emoji codepoints, typical of emoji-regex style libraries. The long-line signal on a raw pass has a high false-positive rate, and the visible content is a plain regex literal with no encoding or execution.

2. info warn → info by review dynamic-import test/get-sequences.mjs:3:41 new in this release

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

   
   const { default: rawSequences } = await import(
   	`${unicodeDataPackage}/Sequence_Property/RGI_Emoji/index.mjs`
   );

   likely benign LLM, confidence 0.85 Test helper dynamically imports Unicode emoji sequence data from a package.

   Reasoning

   This is a test script importing a Unicode data package by a template path built from a package constant. The specifier is not attacker-controlled input and the import target is a fixed data module, so it is a common build/test pattern rather than a dropper.

3. info warn → info by review dynamic-import test/tests.mjs:9:48 new in this release

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

   
   const { default: Emoji_Modifier_Base } = await import(
   	`${unicodeDataPackage}/Binary_Property/Emoji_Modifier_Base/symbols.mjs`
   );

   likely benign LLM, confidence 0.85 Test file dynamically imports Unicode emoji modifier data from a package.

   Reasoning

   Same pattern as the sibling test file: a dynamic import of a fixed Unicode property module via a package-name template. It is a test fixture loader with no network, decoding, or execution of untrusted content.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/mathiasbynens/emoji-regex emoji-regex && cd emoji-regex
git checkout v11.0.0
disclude scan --severity info --diff v10.6.0 .