npm / es-module-lexer / 3.0.4

es-module-lexer 3.0.4

Source

https://github.com/guybedford/es-module-lexer

Artifact scanned

es-module-lexer-3.0.4.tgz (npm tarball · 87.3 KB · SHA-256 eeade444eaa8…)

Compared with

es-module-lexer-3.0.3.tgz (12 signals introduced since)

Files

10 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 12 info

Scan time

7.3 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 20:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info identifier-low-length dist/lexer.asm.js:1:1 new in this release

   6410 of 10216 non-conventional identifiers are single-character (63%) (token pass, confidence 0.50)

2. info warn → info by review long-line dist/lexer.asm.js:2:1 new in this release

   line length 67598 characters (raw pass, confidence 0.65)

   const e=!1;let a,i,r,s=2<<19;const f=1===new Uint8Array(new Uint16Array([1]).buffer)[0]?function(e,a){const i=e.length;let r=0;for(;r<i;)a[r]=e.charCodeAt(r++)}:function(e,a){const i=e.length;let r=0;for(;r<i;){const i=e.charCodeAt(r);a[r++]=(255&i)<<8|i>>>8}},c="xportportlassrometavoyiedeleinstantyreturdebuggeawaithrw

   likely benign LLM, confidence 0.90 Minified asm.js build of a JavaScript module lexer, with a long single line.

   Reasoning

   A 67 KB minified line of asm.js-style JavaScript, with a keyword lookup string and a UTF-16/byte copy helper, is typical of a bundled parser lexer build. The raw long-line signal is a formatting artifact and nothing in the snippet shows exfiltration or dropper behaviour.

3. info identifier-low-length dist/lexer.cjs:1:1 new in this release

   483 of 855 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)

4. info warn → info by review dynamic-execution dist/lexer.cjs:1:44443 new in this release

   `atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)

   of Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0));var A};let H;const init=()=>H||(H=w?Promise.resolve():WebAssembly.compile(R()).then(WebAssembly.instantiate).then(({exports:A})=>{w||(w=A)}));exports.init=init;const k=()=>{if(w)return;const A=new WebAssembly.Module(R());w=new WebAssembly.Ins

   likely benign LLM, confidence 0.88 Base64-embedded WebAssembly module decoded with atob and instantiated for a lexer's init function.

   Reasoning

   The atob decode feeds WebAssembly.compile/Module of an embedded module blob, which is the normal way a bundled WASM lexer initialises. The decoded bytes go only to WebAssembly, not to eval or a shell or network call, and the surrounding code is a standard init pattern.

5. info identifier-low-length dist/lexer.js:1:1 new in this release

   488 of 854 non-conventional identifiers are single-character (57%) (token pass, confidence 0.50)

6. info warn → info by review dynamic-execution dist/lexer.js:2:44405 new in this release

   `atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)

   of Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0));var A};let H;export const init=()=>H||(H=w?Promise.resolve():WebAssembly.compile(R()).then(WebAssembly.instantiate).then(({exports:A})=>{w||(w=A)}));const k=()=>{if(w)return;const A=new WebAssembly.Module(R());w=new WebAssembly.Instance(A).ex

   likely benign LLM, confidence 0.88 ES-module build that decodes an embedded base64 WebAssembly binary and instantiates it.

   Reasoning

   Same pattern as the CJS build: atob decodes an embedded base64 WASM binary that is compiled and instantiated through WebAssembly APIs. There is no eval, process spawn or network fetch of decoded content.

7. info identifier-low-length dist/lexer.minimal.asm.js:1:1 new in this release

   2871 of 4262 non-conventional identifiers are single-character (67%) (token pass, confidence 0.50)

8. info warn → info by review long-line dist/lexer.minimal.asm.js:2:1 new in this release

   line length 26225 characters (raw pass, confidence 0.65)

   let e,a,r,i=2<<19;const s=1===new Uint8Array(new Uint16Array([1]).buffer)[0]?function(e,a){const r=e.length;let i=0;for(;i<r;)a[i]=e.charCodeAt(i++)}:function(e,a){const r=e.length;let i=0;for(;i<r;){const r=e.charCodeAt(i);a[i++]=(255&r)<<8|r>>>8}},f="xportportlassrometavoyiedeleinstantyreturdebuggeawaithrwhileforifca

   likely benign LLM, confidence 0.90 Minified asm.js lexer build with a keyword string table on one long line.

   Reasoning

   Minified asm.js lexer with a keyword table and byte-copy helpers. Long lines are common in generated bundles, and the code contains no dangerous sinks.

9. info identifier-low-length dist/lexer.minimal.cjs:1:1 new in this release

   309 of 561 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)

10. info warn → info by review dynamic-execution dist/lexer.minimal.cjs:1:17401 new in this release

    `atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)

    of Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0));var A};let w;const init=()=>w||(w=o?Promise.resolve():WebAssembly.compile(i()).then(WebAssembly.instantiate).then(({exports:A})=>{o||(o=A)}));exports.init=init;const D=()=>{if(o)return;const A=new WebAssembly.Module(i());o=new WebAssembly.Ins

    likely benign LLM, confidence 0.88 Minimal CJS lexer that decodes an embedded base64 WebAssembly module with atob.

    Reasoning

    The minimal CJS build uses the same atob-to-WebAssembly.compile init path for an embedded module. The decoded data is only used as WASM bytes, which is consistent with a legitimate WASM-backed parser.

11. info identifier-low-length dist/lexer.minimal.js:1:1 new in this release

    312 of 558 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)

12. info warn → info by review dynamic-execution dist/lexer.minimal.js:2:17368 new in this release

    `atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)

    of Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0));var A};let w;export const init=()=>w||(w=o?Promise.resolve():WebAssembly.compile(i()).then(WebAssembly.instantiate).then(({exports:A})=>{o||(o=A)}));const D=()=>{if(o)return;const A=new WebAssembly.Module(i());o=new WebAssembly.Instance(A).ex

    likely benign LLM, confidence 0.88 Minimal ESM lexer with an embedded base64 WebAssembly module decoded at init.

    Reasoning

    The minimal ESM build repeats the embedded-WASM init pattern: atob, then WebAssembly.compile and instantiate. No eval, shell or network sink is reached from the decoded blob.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o es-module-lexer-3.0.4.tgz https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-3.0.4.tgz
printf '%s  %s\n' eeade444eaa8d5f3d3f9bbaebe24af1b9b44b62e854a095726adca4580c8e1d7 es-module-lexer-3.0.4.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf es-module-lexer-3.0.4.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg