disclude.io

npm / esbuild / 0.28.2

esbuild 0.28.2

Source
https://github.com/evanw/esbuild
Artifact scanned
esbuild-0.28.2.tgz (npm tarball · 33.4 KB · SHA-256 e045f94c235c…)
Compared with
esbuild-0.28.1.tgz (0 signals introduced since)
Files
7 scanned, 0 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 1 info
Scan time
5.7 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-23 15:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review dynamic-import install.js:96:19

    `require` called with a non-literal specifier (ast pass, confidence 0.60)

    var child_process = require("child_process");
var packageJSON = require(path2.join(__dirname, "package.json"));
var toPath = path2.join(__dirname, "bin", "esbuild");
var isToPathJS = true;
    likely benign LLM, confidence 0.90 A require of package.json via path.join with __dirname, flagged for a non-literal specifier in an esbuild-style install script.
    Reasoning

    The require call uses path2.join(__dirname, "package.json"), a fixed local file resolved relative to the package directory. This is a common pattern for reading package metadata in an installer script and does not load attacker-controlled code. The non-literal specifier is the only signal and the context is benign, consistent with esbuild's install script which legitimately spawns child_process to verify its binary.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o esbuild-0.28.2.tgz https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz
printf '%s  %s\n' e045f94c235c7adc50e77ba2a579c7bec41b496b6b47c3a7845f7c1e19959a88 esbuild-0.28.2.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf esbuild-0.28.2.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg