Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const loadStart = process.hrtime.bigint();
const { parse, init } = await import(build.path);
if (init) await init;
const load = ms(loadStart, process.hrtime.bigint());
likely benign
LLM, confidence 0.80
Benchmark loader that dynamically imports a built parser module from a configured path.
Reasoning
The import path comes from a build configuration object used by a benchmark harness that loads a freshly built parser. The variable-specifier pattern is common in benchmark and test tooling and carries no sign of hidden loading.
-
file mixes tab and space indentation (7 tab-indented and 33 space-indented lines) (raw pass, confidence 0.40)
const replacements = [
[/Module\["asm"\]=\s?\(\/\*\* @suppress {uselessCode} \*\/ function\(/, 'function asmInit('],
[/\)$/, ''],
[/,\s?_(\w+):/g, ',$1:', null, endFuncs],
-
`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
? Buffer.from(binary, 'base64')
: Uint8Array.from(atob(binary), x => x.charCodeAt(0))
)('WASM_BINARY');
likely benign
LLM, confidence 0.90
Decodes an embedded base64 WebAssembly binary at module load.
Reasoning
This is the standard pattern for embedding a WebAssembly binary as base64 in a TypeScript build and decoding it at load time. The atob call decodes the bundled wasm payload, which is expected for a WASM-based lexer.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
if (process.env.ASM) {
({ parse: lexerParse } = await import(
minimal ? '../dist/lexer.minimal.asm.js' : '../dist/lexer.asm.js'
));
likely benign
LLM, confidence 0.90
Test harness conditionally imports one of two local dist lexer builds.
Reasoning
The specifier is chosen from a fixed pair of local dist paths based on test flags, so it only loads the project's own built artifacts.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
else {
const lexer = await import(minimal ? '../dist/lexer.minimal.js' : '../dist/lexer.js');
await lexer.init();
lexerParse = lexer.parse;
likely benign
LLM, confidence 0.90
Test harness imports either the minimal or full local lexer build.
Reasoning
The specifier is one of two fixed local dist paths selected by a flag. This is ordinary test-target switching.
-
identifier `statehashထ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
assert.strictEqual(imports.length, 1);
assert.strictEqual(imports[0].n, './statehashထ.js');
assert.strictEqual(source.slice(imports[0].s, imports[0].e), '"./statehash\\u1011.js"');
});
-
base64-like blob (78 bytes, compression ratio 1.01) (raw pass, confidence 0.60)
test('Multiline string escapes', () => {
parse("const str = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB4AAAAeCAYAAAA7MK6iAAAABmJLR0QA/wAAAAAzJ3zzAAAGTElEQV\\\r\n\t\tRIx+VXe1BU1xn/zjn7ugvL4sIuQnll5U0ELAQxig7WiQYz6NRHa6O206qdSXXSxs60dTK200zNY9q0dcRpMs1jkrRNWmaijCVoaU';\r\n");
});
likely benign
LLM, confidence 0.95
Sample base64 PNG data URI used as parser test input.
Reasoning
The base64 string is a sample PNG data URI inside a string literal in a unit test for multiline string escapes. It is test data, not a payload.
-
base64-like blob (101 bytes, compression ratio 1.11) (raw pass, confidence 0.60)
test('Multiline string escapes', () => {
parse("const str = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB4AAAAeCAYAAAA7MK6iAAAABmJLR0QA/wAAAAAzJ3zzAAAGTElEQV\\\r\n\t\tRIx+VXe1BU1xn/zjn7ugvL4sIuQnll5U0ELAQxig7WiQYz6NRHa6O206qdSXXSxs60dTK200zNY9q0dcRpMs1jkrRNWmaijCVoaU';\r\n");
});
likely benign
LLM, confidence 0.95
Second base64 fragment from the same sample data URI test input.
Reasoning
This is the same sample data URI in the same test string literal, used as parser input. It is test data.
-
identifier `p𓀀s` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
test('Simple export with unicode conversions', () => {
const source = `export var p𓀀s,q`;
const [imports, exports] = parse(source);
assert.strictEqual(imports.length, 0);
-
identifier `p𓀀s` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
assert.strictEqual(exports.length, 2);
assertExportIs(source, exports[0], {n: 'p𓀀s', ln: 'p𓀀s' });
assertExportIs(source, exports[1], {n: 'q', ln: 'q' });
});
-
identifier `p𓀀s` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
assert.strictEqual(exports.length, 2);
assertExportIs(source, exports[0], {n: 'p𓀀s', ln: 'p𓀀s' });
assertExportIs(source, exports[1], {n: 'q', ln: 'q' });
});
-
identifier `a𓀀` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
const source = `
export function a𓀀 () {
}
-
identifier `a𓀀` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
assert.strictEqual(exports.length, 2);
assertExportIs(source, exports[0], {n: 'a𓀀', ln: 'a𓀀' });
assertExportIs(source, exports[1], {n: 'Q', ln: 'Q' });
});
-
identifier `a𓀀` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
assert.strictEqual(exports.length, 2);
assertExportIs(source, exports[0], {n: 'a𓀀', ln: 'a𓀀' });
assertExportIs(source, exports[1], {n: 'Q', ln: 'Q' });
});
-
identifier `x𓀀` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
braced as bracedOut,
x𓀀 as astral
};
import {
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const { parse } = await import(min ? '../dist/lexer.minimal.js?preinit' : '../dist/lexer.js?preinit');
const [imports, exports] = parse(`import 'a'; export var p = 5`);
assert.strictEqual(imports.length, 1);
likely benign
LLM, confidence 0.90
Test imports a local lexer build with a query string to test pre-init behavior.
Reasoning
The import chooses between two local dist builds with a preinit query string, which is a standard way to test init ordering in a parser test suite.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
test('Sourcename on the pre-init path', async () => {
const { parse } = await import(min ? '../dist/lexer.minimal.js?preinit-err' : '../dist/lexer.js?preinit-err');
assert.throws(() => parse('import{', 'my-file.js'), /^Error: Parse error my-file\.js:\d+:\d+$/);
});
likely benign
LLM, confidence 0.90
Test imports a local lexer build to check error source names on the pre-init path.
Reasoning
The specifier is one of two local dist builds chosen by a flag, used to test error sourcenames before init. It is ordinary test setup.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
test('Entry point exports parse and init only', async () => {
const m = await import(process.env.ASM
? (min ? '../dist/lexer.minimal.asm.js' : '../dist/lexer.asm.js')
: (min ? '../dist/lexer.minimal.js' : '../dist/lexer.js'));
likely benign
LLM, confidence 0.90
Test imports one of several local dist entry points based on flags.
Reasoning
The import is limited to fixed local dist paths selected by environment flags, used to check the entry point's exports.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
: '../dist/lexer.js';
const mod = await import(new URL(ENGINE, import.meta.url).href);
if (mod.init) await mod.init();
const parse = mod.parse;
likely benign
LLM, confidence 0.85
Fuzz harness loads the local parser engine via a URL resolved from import.meta.url.
Reasoning
The module is resolved relative to import.meta.url from a local ENGINE path, which is the project's own build output in a fuzzing harness.
-
file mixes tab and space indentation (9 tab-indented and 27 space-indented lines) (raw pass, confidence 0.40)
const init = (async () => {
if (parse) return;
if (process.env.WASM) {
const m = await import('../dist/lexer.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lexer = commonjs
? require(minimal ? '../../dist/lexer.minimal.cjs' : '../../dist/lexer.cjs')
: await import(minimal ? '../../dist/lexer.minimal.js' : '../../dist/lexer.js');
await lexer.init();
likely benign
LLM, confidence 0.90
No-eval test conditionally requires one of two local lexer builds.
Reasoning
The conditional require chooses between fixed local dist builds. The test name indicates it checks parser behavior without eval, so the loader is benign.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
? require(minimal ? '../../dist/lexer.minimal.cjs' : '../../dist/lexer.cjs')
: await import(minimal ? '../../dist/lexer.minimal.js' : '../../dist/lexer.js');
await lexer.init();
parse = lexer.parse;
likely benign
LLM, confidence 0.90
No-eval test dynamically imports one of two local lexer builds.
Reasoning
The dynamic import is one branch of the same fixed local-path selection, with the same test purpose.
-
identifier `unicode𠈄` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
[String.raw`import 'escaped\x2dspecifier'`, 'escaped-specifier'],
[String.raw`import 'unicode\u{20204}'`, 'unicode𠈄'],
["import 'line\\\ncontinuation'", 'linecontinuation'],
[String.raw`import 'nul\0character'`, 'nul\0character'],
-
line length 10326 characters (raw pass, confidence 0.65)
export { version, bisectRight as bisect, bisectRight, bisectLeft, ascending, bisector, cross, descending, deviation, extent, histogram, freedmanDiaconis as thresholdFreedmanDiaconis, scott as thresholdScott, thresholdSturges, max, mean, median, merge, min, pairs, permute, threshold as quantile, sequence as range, scan,
likely benign
LLM, confidence 0.95
Very long export statement in a bundled d3 library sample.
Reasoning
This is a single export statement in a bundled third-party library sample (d3). Long lines are normal for minified or bundled output, and the content is a plain export list.
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
SourceMap.prototype.toUrl = function toUrl () {
return 'data:application/json;charset=utf-8;base64,' + btoa(this.toString());
};
-
file mixes tab and space indentation (931 tab-indented and 19838 space-indented lines) (raw pass, confidence 0.40)
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
SourceMap.prototype.toUrl = function toUrl () {
return 'data:application/json;charset=utf-8;base64,' + btoa(this.toString());
};
-
line length 1190 characters (raw pass, confidence 0.50)
var astralIdentifierStartCodes = [0,11,2,25,2,18,2,1,2,14,3,13,35,122,70,52,268,28,4,48,48,31,14,29,6,37,11,29,3,35,5,7,2,4,43,157,19,35,5,35,5,39,9,51,157,310,10,21,11,7,153,5,3,0,2,43,2,1,4,0,3,22,11,22,10,30,66,18,2,1,11,21,11,25,71,55,7,1,65,0,16,3,2,2,2,28,43,28,4,28,36,7,2,27,28,53,11,21,11,18,14,17,111,72,56,50,
-
line length 594 characters (raw pass, confidence 0.50)
var astralIdentifierCodes = [509,0,227,0,150,4,294,9,1368,2,2,1,6,3,41,2,5,0,166,1,574,3,9,9,525,10,176,2,54,14,32,9,16,3,46,10,54,9,7,2,37,13,2,9,6,1,45,0,13,2,49,13,9,3,4,9,83,11,7,0,161,11,6,9,7,3,56,1,2,6,3,1,3,2,10,0,11,1,3,6,4,4,193,17,10,9,5,0,82,19,13,9,214,6,3,8,28,1,83,16,16,9,82,12,9,9,84,14,5,9,243,14,166,9
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io