disclude.io

npm / eslint-plugin-react-hooks / 0.0.0-experimental-a6b912fb-20261023

eslint-plugin-react-hooks 0.0.0-experimental-a6b912fb-20261023

Source
https://github.com/react/react
Artifact scanned
eslint-plugin-react-hooks-0.0.0-experimental-a6b912fb-20261023.tgz (npm tarball · 589.0 KB · SHA-256 400e41b78ab2…)
Compared with
eslint-plugin-react-hooks-0.0.0-experimental-a6792708-20261019.tgz (0 signals introduced since)
Files
7 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 19 info
Scan time
4.1 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-23 22:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info whitespace-anomaly cjs/eslint-plugin-react-hooks.development.js:14:1

    file mixes tab and space indentation (17762 tab-indented and 33487 space-indented lines) (raw pass, confidence 0.40)

    if (process.env.NODE_ENV !== "production") {
  (function() {
'use strict';
  2. info warn → info by review long-line cjs/eslint-plugin-react-hooks.development.js:4588:1

    line length 2200 characters (raw pass, confidence 0.65)

    	const astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 8, 70, 5, 3, 0, 2, 4
    likely benign LLM, confidence 0.95 A long array literal of Unicode identifier-start ranges inside the bundled eslint-plugin-react-hooks development build.
    Reasoning

    The long line is a numeric lookup table of Unicode astral identifier-start code point ranges, the standard table used by acorn/babel-style identifier parsers. It is data embedded in a bundled, legitimate React ESLint plugin, and the only signal is line length, which the raw pass flags with a high false-positive rate. Nothing decodes, executes, or reaches the network.

  3. info long-line cjs/eslint-plugin-react-hooks.development.js:5098:1

    line length 661 characters (raw pass, confidence 0.50)

    	constants.UPDATE_OPERATORS = constants.UNARY_OPERATORS = constants.STRING_UNARY_OPERATORS = constants.STATEMENT_OR_BLOCK_KEYS = constants.NUMBER_UNARY_OPERATORS = constants.NUMBER_BINARY_OPERATORS = constants.NOT_LOCAL_BINDING = constants.LOGICAL_OPERATORS = constants.INHERIT_KEYS = constants.FOR_INIT_KEYS = constants
  4. info long-line cjs/eslint-plugin-react-hooks.development.js:15046:1

    line length 1472 characters (raw pass, confidence 0.50)

    	generated.WHILE_TYPES = generated.USERWHITESPACABLE_TYPES = generated.UNARYLIKE_TYPES = generated.TYPESCRIPT_TYPES = generated.TSTYPE_TYPES = generated.TSTYPEELEMENT_TYPES = generated.TSENTITYNAME_TYPES = generated.TSBASETYPE_TYPES = generated.TERMINATORLESS_TYPES = generated.STATEMENT_TYPES = generated.STANDARDIZED_T
  5. info long-line cjs/eslint-plugin-react-hooks.development.js:17148:1

    line length 635 characters (raw pass, confidence 0.50)

    	jsTokens.default = /((['"])(?:(?!\2|\\).|\\(?:\r\n|[\s\S]))*(\2)?|`(?:[^`\\$]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{[^}]*\}?)*\}?)*(`)?)|(\/\/.*)|(\/\*(?:[^*]|\*(?!\/))*(\*\/)?)|(\/(?!\*)(?:\[(?:(?![\]\\]).|\\.)*\]|(?![\/\]\\]).|\\.)+\/(?:(?!\s*(?:\b|[\u0080-\uFFFF$\\'"~({]|[+\-!](?!=)|\.?\d))|[gmiyus]{1,6}\b(?![\u0080-\uF
  6. info long-line cjs/eslint-plugin-react-hooks.development.js:28912:1

    line length 615 characters (raw pass, confidence 0.50)

    	  type === REACT_FRAGMENT_TYPE || type === REACT_CONCURRENT_MODE_TYPE || type === REACT_PROFILER_TYPE || type === REACT_STRICT_MODE_TYPE || type === REACT_SUSPENSE_TYPE || type === REACT_SUSPENSE_LIST_TYPE || typeof type === 'object' && type !== null && (type.$$typeof === REACT_LAZY_TYPE || type.$$typeof === REACT_MEM
  7. info long-line cjs/eslint-plugin-react-hooks.development.js:32021:1

    line length 641 characters (raw pass, confidence 0.50)

    _Environment_globals = new WeakMap(), _Environment_shapes = new WeakMap(), _Environment_moduleTypes = new WeakMap(), _Environment_nextIdentifer = new WeakMap(), _Environment_nextBlock = new WeakMap(), _Environment_nextScope = new WeakMap(), _Environment_scope = new WeakMap(), _Environment_outlinedFunctions = new WeakMa
  8. info long-line cjs/eslint-plugin-react-hooks.development.js:47508:1

    line length 506 characters (raw pass, confidence 0.50)

    var _DependencyCollectionContext_instances, _DependencyCollectionContext_declarations, _DependencyCollectionContext_reassignments, _DependencyCollectionContext_scopes, _DependencyCollectionContext_dependencies, _DependencyCollectionContext_temporaries, _DependencyCollectionContext_temporariesUsedOutsideScope, _Dependen
  9. info long-line cjs/eslint-plugin-react-hooks.development.js:47775:1

    line length 681 characters (raw pass, confidence 0.50)

    _DependencyCollectionContext_declarations = new WeakMap(), _DependencyCollectionContext_reassignments = new WeakMap(), _DependencyCollectionContext_scopes = new WeakMap(), _DependencyCollectionContext_dependencies = new WeakMap(), _DependencyCollectionContext_temporaries = new WeakMap(), _DependencyCollectionContext_te
  10. info whitespace-anomaly cjs/eslint-plugin-react-hooks.production.js:24:1

    file mixes tab and space indentation (17612 tab-indented and 33485 space-indented lines) (raw pass, confidence 0.40)

    function getAdditionalEffectHooksFromSettings(settings) {
    var _a;
    const additionalHooks = (_a = settings[SETTINGS_KEY]) === null || _a === void 0 ? void 0 : _a[SETTINGS_ADDITIONAL_EFFECT_HOOKS_KEY];
    if (additionalHooks != null && typeof additionalHooks === 'string') {
  11. info warn → info by review long-line cjs/eslint-plugin-react-hooks.production.js:4579:1

    line length 2200 characters (raw pass, confidence 0.65)

    	const astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 8, 70, 5, 3, 0, 2, 4
    likely benign LLM, confidence 0.95 A long array literal of Unicode identifier-start ranges inside the bundled eslint-plugin-react-hooks production build.
    Reasoning

    This is the same Unicode identifier-start range table as the development build, in the production bundle of the same legitimate React package. A long-line warning on a generated data table is a stylistic signal, not evidence of obfuscation or malicious intent.

  12. info long-line cjs/eslint-plugin-react-hooks.production.js:5089:1

    line length 661 characters (raw pass, confidence 0.50)

    	constants.UPDATE_OPERATORS = constants.UNARY_OPERATORS = constants.STRING_UNARY_OPERATORS = constants.STATEMENT_OR_BLOCK_KEYS = constants.NUMBER_UNARY_OPERATORS = constants.NUMBER_BINARY_OPERATORS = constants.NOT_LOCAL_BINDING = constants.LOGICAL_OPERATORS = constants.INHERIT_KEYS = constants.FOR_INIT_KEYS = constants
  13. info long-line cjs/eslint-plugin-react-hooks.production.js:15037:1

    line length 1472 characters (raw pass, confidence 0.50)

    	generated.WHILE_TYPES = generated.USERWHITESPACABLE_TYPES = generated.UNARYLIKE_TYPES = generated.TYPESCRIPT_TYPES = generated.TSTYPE_TYPES = generated.TSTYPEELEMENT_TYPES = generated.TSENTITYNAME_TYPES = generated.TSBASETYPE_TYPES = generated.TERMINATORLESS_TYPES = generated.STATEMENT_TYPES = generated.STANDARDIZED_T
  14. info long-line cjs/eslint-plugin-react-hooks.production.js:17139:1

    line length 635 characters (raw pass, confidence 0.50)

    	jsTokens.default = /((['"])(?:(?!\2|\\).|\\(?:\r\n|[\s\S]))*(\2)?|`(?:[^`\\$]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{[^}]*\}?)*\}?)*(`)?)|(\/\/.*)|(\/\*(?:[^*]|\*(?!\/))*(\*\/)?)|(\/(?!\*)(?:\[(?:(?![\]\\]).|\\.)*\]|(?![\/\]\\]).|\\.)+\/(?:(?!\s*(?:\b|[\u0080-\uFFFF$\\'"~({]|[+\-!](?!=)|\.?\d))|[gmiyus]{1,6}\b(?![\u0080-\uF
  15. info long-line cjs/eslint-plugin-react-hooks.production.js:28873:1

    line length 649 characters (raw pass, confidence 0.50)

    	function z(a){if("object"===typeof a&&null!==a){var u=a.$$typeof;switch(u){case c:switch(a=a.type,a){case l:case m:case e:case g:case f:case p:return a;default:switch(a=a&&a.$$typeof,a){case k:case n:case t:case r:case h:return a;default:return u}}case d:return u}}}function A(a){return z(a)===m}reactIs_production_min.
  16. info long-line cjs/eslint-plugin-react-hooks.production.js:28874:1

    line length 643 characters (raw pass, confidence 0.50)

    	reactIs_production_min.Profiler=g;reactIs_production_min.StrictMode=f;reactIs_production_min.Suspense=p;reactIs_production_min.isAsyncMode=function(a){return A(a)||z(a)===l};reactIs_production_min.isConcurrentMode=A;reactIs_production_min.isContextConsumer=function(a){return z(a)===k};reactIs_production_min.isContextP
  17. info long-line cjs/eslint-plugin-react-hooks.production.js:31848:1

    line length 641 characters (raw pass, confidence 0.50)

    _Environment_globals = new WeakMap(), _Environment_shapes = new WeakMap(), _Environment_moduleTypes = new WeakMap(), _Environment_nextIdentifer = new WeakMap(), _Environment_nextBlock = new WeakMap(), _Environment_nextScope = new WeakMap(), _Environment_scope = new WeakMap(), _Environment_outlinedFunctions = new WeakMa
  18. info long-line cjs/eslint-plugin-react-hooks.production.js:47335:1

    line length 506 characters (raw pass, confidence 0.50)

    var _DependencyCollectionContext_instances, _DependencyCollectionContext_declarations, _DependencyCollectionContext_reassignments, _DependencyCollectionContext_scopes, _DependencyCollectionContext_dependencies, _DependencyCollectionContext_temporaries, _DependencyCollectionContext_temporariesUsedOutsideScope, _Dependen
  19. info long-line cjs/eslint-plugin-react-hooks.production.js:47602:1

    line length 681 characters (raw pass, confidence 0.50)

    _DependencyCollectionContext_declarations = new WeakMap(), _DependencyCollectionContext_reassignments = new WeakMap(), _DependencyCollectionContext_scopes = new WeakMap(), _DependencyCollectionContext_dependencies = new WeakMap(), _DependencyCollectionContext_temporaries = new WeakMap(), _DependencyCollectionContext_te

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o eslint-plugin-react-hooks-0.0.0-experimental-a6b912fb-20261023.tgz https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-0.0.0-experimental-a6b912fb-20261023.tgz
printf '%s  %s\n' 400e41b78ab2cb7184b27b83bd169e3ef2b3e24776e3791925f92a29ebe370d4 eslint-plugin-react-hooks-0.0.0-experimental-a6b912fb-20261023.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf eslint-plugin-react-hooks-0.0.0-experimental-a6b912fb-20261023.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg