disclude.ionpm / emoji-regex / 11.0.0
emoji-regex 11.0.0
- Source
- https://github.com/mathiasbynens/emoji-regex
- Artifact scanned
emoji-regex-11.0.0.tgz- Compared with
emoji-regex-10.6.0.tgz(1 signals introduced since)- Files
- 5 scanned, 0 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 1 info
- Scan time
- 3.3 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 13:39
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
return /[#*0-9]\uFE0F?\u20E3|[\xA9\xAE\u203C\u2049\u2122\u2139\u2194-\u2199\u21A9\u21AA\u231A\u231B\u2328\u23CF\u23ED-\u23EF\u23F1\u23F2\u23F8-\u23FA\u24C2\u25AA\u25AB\u25B6\u25C0\u25FB\u25FC\u25FE\u2600-\u2604\u260E\u2611\u2614\u2615\u2618\u2620\u2622\u2623\u2626\u262A\u262E\u262F\u2638-\u263A\u2640\u2642\u2648-\u265likely benign A minified, generated emoji-matching regular expression returned from an ES module.Reasoning
The flagged line is a 14115-character regular expression of Unicode escape sequences for emoji code points, returned from a function. This is the typical shape of a generated emoji-matching regex, such as the emoji-regex package. Its length comes from the generated character class, not from encoded or executed payload. The signal is a raw-pass long-line heuristic, which has a higher false-positive rate, and nothing in the snippet suggests execution, network access, or hidden instructions. Residual doubt comes from seeing only the first part of the line.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&