npm / emoji-regex / 11.0.0

emoji-regex 11.0.0

Source

https://github.com/mathiasbynens/emoji-regex

Tag scanned

v11.0.0

Compared with

v10.6.0 (3 signals introduced since)

Files

10 scanned, 0 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 10:24

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review long-line index.mjs:3:1 new in this release

   line length 14115 characters (raw pass, confidence 0.65)

   	return /[#*0-9]\uFE0F?\u20E3|[\xA9\xAE\u203C\u2049\u2122\u2139\u2194-\u2199\u21A9\u21AA\u231A\u231B\u2328\u23CF\u23ED-\u23EF\u23F1\u23F2\u23F8-\u23FA\u24C2\u25AA\u25AB\u25B6\u25C0\u25FB\u25FC\u25FE\u2600-\u2604\u260E\u2611\u2614\u2615\u2618\u2620\u2622\u2623\u2626\u262A\u262E\u262F\u2638-\u263A\u2640\u2642\u2648-\u265

   likely benign LLM, confidence 0.93 A generated emoji-matching regex module with a very long single line.

   Reasoning

   A 14115-character line in a generated emoji regex module is typical of data tables produced by build tools; the snippet is a regex with a long character class of Unicode escapes, a legitimate emoji-matching pattern with no encoded payload or execution.

2. info warn → info by review dynamic-import test/get-sequences.mjs:3:41 new in this release

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

   
   const { default: rawSequences } = await import(
   	`${unicodeDataPackage}/Sequence_Property/RGI_Emoji/index.mjs`
   );

   likely benign LLM, confidence 0.90 Test file dynamically imports Unicode emoji sequence data from a package.

   Reasoning

   The dynamic import specifier is a template built from a package name variable pointing to a Unicode data package, in a test file. This is a common pattern for loading generated test data and shows no attacker-controlled input or execution of decoded content.

3. info warn → info by review dynamic-import test/tests.mjs:9:48 new in this release

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

   
   const { default: Emoji_Modifier_Base } = await import(
   	`${unicodeDataPackage}/Binary_Property/Emoji_Modifier_Base/symbols.mjs`
   );

   likely benign LLM, confidence 0.90 Test file dynamically imports Unicode emoji modifier data from a package.

   Reasoning

   Same pattern as the sibling test file: a dynamic import of a Unicode property data module via a package path template, within test code. No sign of malicious loading or obfuscation.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/mathiasbynens/emoji-regex emoji-regex && cd emoji-regex
git checkout v11.0.0
disclude scan --severity info --diff v10.6.0 .