npm / eslint-plugin-react-hooks / 0.0.0-experimental-9ffcb463-20261021

eslint-plugin-react-hooks 0.0.0-experimental-9ffcb463-20261021

Source: https://github.com/react/react
Artifact scanned: eslint-plugin-react-hooks-0.0.0-experimental-9ffcb463-20261021.tgz (npm tarball · 588.9 KB · SHA-256 8c314e0cded9…)
Compared with: eslint-plugin-react-hooks-0.0.0-experimental-9ff738f53-20220826.tgz (18 signals introduced since)
Files: 7 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 19 info
Scan time: 4.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 22:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line cjs/eslint-plugin-react-hooks.development.js:4588:1 new in this release

line length 2200 characters (raw pass, confidence 0.65)
```
	const astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 8, 70, 5, 3, 0, 2, 4
```
likely benign LLM, confidence 0.96 A generated array of Unicode identifier-start code points inside the bundled eslint-plugin-react-hooks development build, flagged only for line length.
Reasoning
The flagged line is a long array literal of Unicode astral identifier-start code ranges, the kind of table acorn and Babel embed for identifier validation. The raw pass flags it only for its length (2200 characters), and this is a generated bundled build file of a well-known open-source package. No decoding, execution, or network behaviour is present, so this is a legitimate data table rather than obfuscation.

info long-line cjs/eslint-plugin-react-hooks.development.js:5098:1 new in this release

line length 661 characters (raw pass, confidence 0.50)

	constants.UPDATE_OPERATORS = constants.UNARY_OPERATORS = constants.STRING_UNARY_OPERATORS = constants.STATEMENT_OR_BLOCK_KEYS = constants.NUMBER_UNARY_OPERATORS = constants.NUMBER_BINARY_OPERATORS = constants.NOT_LOCAL_BINDING = constants.LOGICAL_OPERATORS = constants.INHERIT_KEYS = constants.FOR_INIT_KEYS = constants

info long-line cjs/eslint-plugin-react-hooks.development.js:15046:1 new in this release

line length 1472 characters (raw pass, confidence 0.50)

	generated.WHILE_TYPES = generated.USERWHITESPACABLE_TYPES = generated.UNARYLIKE_TYPES = generated.TYPESCRIPT_TYPES = generated.TSTYPE_TYPES = generated.TSTYPEELEMENT_TYPES = generated.TSENTITYNAME_TYPES = generated.TSBASETYPE_TYPES = generated.TERMINATORLESS_TYPES = generated.STATEMENT_TYPES = generated.STANDARDIZED_T

info long-line cjs/eslint-plugin-react-hooks.development.js:17148:1 new in this release

line length 635 characters (raw pass, confidence 0.50)

	jsTokens.default = /((['"])(?:(?!\2|\\).|\\(?:\r\n|[\s\S]))*(\2)?|`(?:[^`\\$]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{[^}]*\}?)*\}?)*(`)?)|(\/\/.*)|(\/\*(?:[^*]|\*(?!\/))*(\*\/)?)|(\/(?!\*)(?:\[(?:(?![\]\\]).|\\.)*\]|(?![\/\]\\]).|\\.)+\/(?:(?!\s*(?:\b|[\u0080-\uFFFF$\\'"~({]|[+\-!](?!=)|\.?\d))|[gmiyus]{1,6}\b(?![\u0080-\uF

info long-line cjs/eslint-plugin-react-hooks.development.js:28912:1 new in this release

line length 615 characters (raw pass, confidence 0.50)

	  type === REACT_FRAGMENT_TYPE || type === REACT_CONCURRENT_MODE_TYPE || type === REACT_PROFILER_TYPE || type === REACT_STRICT_MODE_TYPE || type === REACT_SUSPENSE_TYPE || type === REACT_SUSPENSE_LIST_TYPE || typeof type === 'object' && type !== null && (type.$$typeof === REACT_LAZY_TYPE || type.$$typeof === REACT_MEM

info long-line cjs/eslint-plugin-react-hooks.development.js:32001:1 new in this release

line length 641 characters (raw pass, confidence 0.50)

_Environment_globals = new WeakMap(), _Environment_shapes = new WeakMap(), _Environment_moduleTypes = new WeakMap(), _Environment_nextIdentifer = new WeakMap(), _Environment_nextBlock = new WeakMap(), _Environment_nextScope = new WeakMap(), _Environment_scope = new WeakMap(), _Environment_outlinedFunctions = new WeakMa

info long-line cjs/eslint-plugin-react-hooks.development.js:47478:1 new in this release

line length 506 characters (raw pass, confidence 0.50)

var _DependencyCollectionContext_instances, _DependencyCollectionContext_declarations, _DependencyCollectionContext_reassignments, _DependencyCollectionContext_scopes, _DependencyCollectionContext_dependencies, _DependencyCollectionContext_temporaries, _DependencyCollectionContext_temporariesUsedOutsideScope, _Dependen

info long-line cjs/eslint-plugin-react-hooks.development.js:47745:1 new in this release

line length 681 characters (raw pass, confidence 0.50)

_DependencyCollectionContext_declarations = new WeakMap(), _DependencyCollectionContext_reassignments = new WeakMap(), _DependencyCollectionContext_scopes = new WeakMap(), _DependencyCollectionContext_dependencies = new WeakMap(), _DependencyCollectionContext_temporaries = new WeakMap(), _DependencyCollectionContext_te

info whitespace-anomaly cjs/eslint-plugin-react-hooks.production.js:24:1 new in this release

file mixes tab and space indentation (17612 tab-indented and 33455 space-indented lines) (raw pass, confidence 0.40)

function getAdditionalEffectHooksFromSettings(settings) {
    var _a;
    const additionalHooks = (_a = settings[SETTINGS_KEY]) === null || _a === void 0 ? void 0 : _a[SETTINGS_ADDITIONAL_EFFECT_HOOKS_KEY];
    if (additionalHooks != null && typeof additionalHooks === 'string') {

info ~~warn~~ → info by review long-line cjs/eslint-plugin-react-hooks.production.js:4579:1 new in this release

line length 2200 characters (raw pass, confidence 0.65)
```
	const astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 8, 70, 5, 3, 0, 2, 4
```
likely benign LLM, confidence 0.96 A generated Unicode identifier-start code table in the production bundle of eslint-plugin-react-hooks, flagged only for its length.
Reasoning
This is the same astral identifier-start code table as in the development build, a generated constant from a bundled third-party parser dependency. The raw long-line signal fires on its length alone. Nothing in the snippet executes or hides code, so it is a legitimate data table.

info long-line cjs/eslint-plugin-react-hooks.production.js:5089:1 new in this release

line length 661 characters (raw pass, confidence 0.50)

	constants.UPDATE_OPERATORS = constants.UNARY_OPERATORS = constants.STRING_UNARY_OPERATORS = constants.STATEMENT_OR_BLOCK_KEYS = constants.NUMBER_UNARY_OPERATORS = constants.NUMBER_BINARY_OPERATORS = constants.NOT_LOCAL_BINDING = constants.LOGICAL_OPERATORS = constants.INHERIT_KEYS = constants.FOR_INIT_KEYS = constants

info long-line cjs/eslint-plugin-react-hooks.production.js:15037:1 new in this release

line length 1472 characters (raw pass, confidence 0.50)

	generated.WHILE_TYPES = generated.USERWHITESPACABLE_TYPES = generated.UNARYLIKE_TYPES = generated.TYPESCRIPT_TYPES = generated.TSTYPE_TYPES = generated.TSTYPEELEMENT_TYPES = generated.TSENTITYNAME_TYPES = generated.TSBASETYPE_TYPES = generated.TERMINATORLESS_TYPES = generated.STATEMENT_TYPES = generated.STANDARDIZED_T

info long-line cjs/eslint-plugin-react-hooks.production.js:17139:1 new in this release

line length 635 characters (raw pass, confidence 0.50)

	jsTokens.default = /((['"])(?:(?!\2|\\).|\\(?:\r\n|[\s\S]))*(\2)?|`(?:[^`\\$]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{[^}]*\}?)*\}?)*(`)?)|(\/\/.*)|(\/\*(?:[^*]|\*(?!\/))*(\*\/)?)|(\/(?!\*)(?:\[(?:(?![\]\\]).|\\.)*\]|(?![\/\]\\]).|\\.)+\/(?:(?!\s*(?:\b|[\u0080-\uFFFF$\\'"~({]|[+\-!](?!=)|\.?\d))|[gmiyus]{1,6}\b(?![\u0080-\uF

info long-line cjs/eslint-plugin-react-hooks.production.js:28873:1 new in this release

line length 649 characters (raw pass, confidence 0.50)

	function z(a){if("object"===typeof a&&null!==a){var u=a.$$typeof;switch(u){case c:switch(a=a.type,a){case l:case m:case e:case g:case f:case p:return a;default:switch(a=a&&a.$$typeof,a){case k:case n:case t:case r:case h:return a;default:return u}}case d:return u}}}function A(a){return z(a)===m}reactIs_production_min.

info long-line cjs/eslint-plugin-react-hooks.production.js:28874:1 new in this release

line length 643 characters (raw pass, confidence 0.50)

	reactIs_production_min.Profiler=g;reactIs_production_min.StrictMode=f;reactIs_production_min.Suspense=p;reactIs_production_min.isAsyncMode=function(a){return A(a)||z(a)===l};reactIs_production_min.isConcurrentMode=A;reactIs_production_min.isContextConsumer=function(a){return z(a)===k};reactIs_production_min.isContextP

info long-line cjs/eslint-plugin-react-hooks.production.js:31828:1 new in this release

line length 641 characters (raw pass, confidence 0.50)

_Environment_globals = new WeakMap(), _Environment_shapes = new WeakMap(), _Environment_moduleTypes = new WeakMap(), _Environment_nextIdentifer = new WeakMap(), _Environment_nextBlock = new WeakMap(), _Environment_nextScope = new WeakMap(), _Environment_scope = new WeakMap(), _Environment_outlinedFunctions = new WeakMa

info long-line cjs/eslint-plugin-react-hooks.production.js:47305:1 new in this release

line length 506 characters (raw pass, confidence 0.50)

var _DependencyCollectionContext_instances, _DependencyCollectionContext_declarations, _DependencyCollectionContext_reassignments, _DependencyCollectionContext_scopes, _DependencyCollectionContext_dependencies, _DependencyCollectionContext_temporaries, _DependencyCollectionContext_temporariesUsedOutsideScope, _Dependen

info long-line cjs/eslint-plugin-react-hooks.production.js:47572:1 new in this release

line length 681 characters (raw pass, confidence 0.50)

_DependencyCollectionContext_declarations = new WeakMap(), _DependencyCollectionContext_reassignments = new WeakMap(), _DependencyCollectionContext_scopes = new WeakMap(), _DependencyCollectionContext_dependencies = new WeakMap(), _DependencyCollectionContext_temporaries = new WeakMap(), _DependencyCollectionContext_te

info whitespace-anomaly cjs/eslint-plugin-react-hooks.development.js:14:1

file mixes tab and space indentation (17762 tab-indented and 33457 space-indented lines) (raw pass, confidence 0.40)
```
if (process.env.NODE_ENV !== "production") {
  (function() {
'use strict';
```

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o eslint-plugin-react-hooks-0.0.0-experimental-9ffcb463-20261021.tgz https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-0.0.0-experimental-9ffcb463-20261021.tgz
printf '%s  %s\n' 8c314e0cded971a9a85326a6430872a9e75070645fb2218713f8664e3c5fbc91 eslint-plugin-react-hooks-0.0.0-experimental-9ffcb463-20261021.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf eslint-plugin-react-hooks-0.0.0-experimental-9ffcb463-20261021.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg