disclude.io

npm / eslint-plugin-react-hooks / 7.1.1-canary-ba39b32a-20261019

eslint-plugin-react-hooks 7.1.1-canary-ba39b32a-20261019

Source
https://github.com/react/react
Artifact scanned
eslint-plugin-react-hooks-7.1.1-canary-ba39b32a-20261019.tgz (npm tarball · 588.9 KB · SHA-256 759ecf813f7d…)
Compared with
eslint-plugin-react-hooks-7.1.1-canary-b740af25-20260715.tgz (0 signals introduced since)
Files
7 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 19 info
Scan time
4.6 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-24 00:39

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info whitespace-anomaly cjs/eslint-plugin-react-hooks.development.js:14:1

    file mixes tab and space indentation (17762 tab-indented and 33457 space-indented lines) (raw pass, confidence 0.40)

    if (process.env.NODE_ENV !== "production") {
  (function() {
'use strict';
  2. info warn → info by review long-line cjs/eslint-plugin-react-hooks.development.js:4588:1

    line length 2200 characters (raw pass, confidence 0.65)

    	const astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 8, 70, 5, 3, 0, 2, 4
    likely benign LLM, confidence 0.95 A bundled build of eslint-plugin-react-hooks contains a long line holding a standard Unicode astral identifier-start code-point table used by a parser.
    Reasoning

    A long line flagged by a raw long-line signal. The snippet is a numeric array of Unicode astral identifier start code ranges, the standard table used by the acorn/babel identifier-validation code bundled with eslint-plugin-react-hooks. This is a known, legitimate data table minified onto one line in a build artifact, from a well-known React package; the length alone is not obfuscation.

  3. info long-line cjs/eslint-plugin-react-hooks.development.js:5098:1

    line length 661 characters (raw pass, confidence 0.50)

    	constants.UPDATE_OPERATORS = constants.UNARY_OPERATORS = constants.STRING_UNARY_OPERATORS = constants.STATEMENT_OR_BLOCK_KEYS = constants.NUMBER_UNARY_OPERATORS = constants.NUMBER_BINARY_OPERATORS = constants.NOT_LOCAL_BINDING = constants.LOGICAL_OPERATORS = constants.INHERIT_KEYS = constants.FOR_INIT_KEYS = constants
  4. info long-line cjs/eslint-plugin-react-hooks.development.js:15046:1

    line length 1472 characters (raw pass, confidence 0.50)

    	generated.WHILE_TYPES = generated.USERWHITESPACABLE_TYPES = generated.UNARYLIKE_TYPES = generated.TYPESCRIPT_TYPES = generated.TSTYPE_TYPES = generated.TSTYPEELEMENT_TYPES = generated.TSENTITYNAME_TYPES = generated.TSBASETYPE_TYPES = generated.TERMINATORLESS_TYPES = generated.STATEMENT_TYPES = generated.STANDARDIZED_T
  5. info long-line cjs/eslint-plugin-react-hooks.development.js:17148:1

    line length 635 characters (raw pass, confidence 0.50)

    	jsTokens.default = /((['"])(?:(?!\2|\\).|\\(?:\r\n|[\s\S]))*(\2)?|`(?:[^`\\$]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{[^}]*\}?)*\}?)*(`)?)|(\/\/.*)|(\/\*(?:[^*]|\*(?!\/))*(\*\/)?)|(\/(?!\*)(?:\[(?:(?![\]\\]).|\\.)*\]|(?![\/\]\\]).|\\.)+\/(?:(?!\s*(?:\b|[\u0080-\uFFFF$\\'"~({]|[+\-!](?!=)|\.?\d))|[gmiyus]{1,6}\b(?![\u0080-\uF
  6. info long-line cjs/eslint-plugin-react-hooks.development.js:28912:1

    line length 615 characters (raw pass, confidence 0.50)

    	  type === REACT_FRAGMENT_TYPE || type === REACT_CONCURRENT_MODE_TYPE || type === REACT_PROFILER_TYPE || type === REACT_STRICT_MODE_TYPE || type === REACT_SUSPENSE_TYPE || type === REACT_SUSPENSE_LIST_TYPE || typeof type === 'object' && type !== null && (type.$$typeof === REACT_LAZY_TYPE || type.$$typeof === REACT_MEM
  7. info long-line cjs/eslint-plugin-react-hooks.development.js:32001:1

    line length 641 characters (raw pass, confidence 0.50)

    _Environment_globals = new WeakMap(), _Environment_shapes = new WeakMap(), _Environment_moduleTypes = new WeakMap(), _Environment_nextIdentifer = new WeakMap(), _Environment_nextBlock = new WeakMap(), _Environment_nextScope = new WeakMap(), _Environment_scope = new WeakMap(), _Environment_outlinedFunctions = new WeakMa
  8. info long-line cjs/eslint-plugin-react-hooks.development.js:47478:1

    line length 506 characters (raw pass, confidence 0.50)

    var _DependencyCollectionContext_instances, _DependencyCollectionContext_declarations, _DependencyCollectionContext_reassignments, _DependencyCollectionContext_scopes, _DependencyCollectionContext_dependencies, _DependencyCollectionContext_temporaries, _DependencyCollectionContext_temporariesUsedOutsideScope, _Dependen
  9. info long-line cjs/eslint-plugin-react-hooks.development.js:47745:1

    line length 681 characters (raw pass, confidence 0.50)

    _DependencyCollectionContext_declarations = new WeakMap(), _DependencyCollectionContext_reassignments = new WeakMap(), _DependencyCollectionContext_scopes = new WeakMap(), _DependencyCollectionContext_dependencies = new WeakMap(), _DependencyCollectionContext_temporaries = new WeakMap(), _DependencyCollectionContext_te
  10. info whitespace-anomaly cjs/eslint-plugin-react-hooks.production.js:24:1

    file mixes tab and space indentation (17612 tab-indented and 33455 space-indented lines) (raw pass, confidence 0.40)

    function getAdditionalEffectHooksFromSettings(settings) {
    var _a;
    const additionalHooks = (_a = settings[SETTINGS_KEY]) === null || _a === void 0 ? void 0 : _a[SETTINGS_ADDITIONAL_EFFECT_HOOKS_KEY];
    if (additionalHooks != null && typeof additionalHooks === 'string') {
  11. info warn → info by review long-line cjs/eslint-plugin-react-hooks.production.js:4579:1

    line length 2200 characters (raw pass, confidence 0.65)

    	const astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 8, 70, 5, 3, 0, 2, 4
    likely benign LLM, confidence 0.95 The production bundle of eslint-plugin-react-hooks has a long line containing the standard astral identifier-start code table used by a parser.
    Reasoning

    Same long-line raw finding in the production build of the same package. The snippet is the same Unicode astral identifier-start range table from the bundled parser, a legitimate data array in a minified React tooling build. No execution, decoding, or network behavior is shown.

  12. info long-line cjs/eslint-plugin-react-hooks.production.js:5089:1

    line length 661 characters (raw pass, confidence 0.50)

    	constants.UPDATE_OPERATORS = constants.UNARY_OPERATORS = constants.STRING_UNARY_OPERATORS = constants.STATEMENT_OR_BLOCK_KEYS = constants.NUMBER_UNARY_OPERATORS = constants.NUMBER_BINARY_OPERATORS = constants.NOT_LOCAL_BINDING = constants.LOGICAL_OPERATORS = constants.INHERIT_KEYS = constants.FOR_INIT_KEYS = constants
  13. info long-line cjs/eslint-plugin-react-hooks.production.js:15037:1

    line length 1472 characters (raw pass, confidence 0.50)

    	generated.WHILE_TYPES = generated.USERWHITESPACABLE_TYPES = generated.UNARYLIKE_TYPES = generated.TYPESCRIPT_TYPES = generated.TSTYPE_TYPES = generated.TSTYPEELEMENT_TYPES = generated.TSENTITYNAME_TYPES = generated.TSBASETYPE_TYPES = generated.TERMINATORLESS_TYPES = generated.STATEMENT_TYPES = generated.STANDARDIZED_T
  14. info long-line cjs/eslint-plugin-react-hooks.production.js:17139:1

    line length 635 characters (raw pass, confidence 0.50)

    	jsTokens.default = /((['"])(?:(?!\2|\\).|\\(?:\r\n|[\s\S]))*(\2)?|`(?:[^`\\$]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{[^}]*\}?)*\}?)*(`)?)|(\/\/.*)|(\/\*(?:[^*]|\*(?!\/))*(\*\/)?)|(\/(?!\*)(?:\[(?:(?![\]\\]).|\\.)*\]|(?![\/\]\\]).|\\.)+\/(?:(?!\s*(?:\b|[\u0080-\uFFFF$\\'"~({]|[+\-!](?!=)|\.?\d))|[gmiyus]{1,6}\b(?![\u0080-\uF
  15. info long-line cjs/eslint-plugin-react-hooks.production.js:28873:1

    line length 649 characters (raw pass, confidence 0.50)

    	function z(a){if("object"===typeof a&&null!==a){var u=a.$$typeof;switch(u){case c:switch(a=a.type,a){case l:case m:case e:case g:case f:case p:return a;default:switch(a=a&&a.$$typeof,a){case k:case n:case t:case r:case h:return a;default:return u}}case d:return u}}}function A(a){return z(a)===m}reactIs_production_min.
  16. info long-line cjs/eslint-plugin-react-hooks.production.js:28874:1

    line length 643 characters (raw pass, confidence 0.50)

    	reactIs_production_min.Profiler=g;reactIs_production_min.StrictMode=f;reactIs_production_min.Suspense=p;reactIs_production_min.isAsyncMode=function(a){return A(a)||z(a)===l};reactIs_production_min.isConcurrentMode=A;reactIs_production_min.isContextConsumer=function(a){return z(a)===k};reactIs_production_min.isContextP
  17. info long-line cjs/eslint-plugin-react-hooks.production.js:31828:1

    line length 641 characters (raw pass, confidence 0.50)

    _Environment_globals = new WeakMap(), _Environment_shapes = new WeakMap(), _Environment_moduleTypes = new WeakMap(), _Environment_nextIdentifer = new WeakMap(), _Environment_nextBlock = new WeakMap(), _Environment_nextScope = new WeakMap(), _Environment_scope = new WeakMap(), _Environment_outlinedFunctions = new WeakMa
  18. info long-line cjs/eslint-plugin-react-hooks.production.js:47305:1

    line length 506 characters (raw pass, confidence 0.50)

    var _DependencyCollectionContext_instances, _DependencyCollectionContext_declarations, _DependencyCollectionContext_reassignments, _DependencyCollectionContext_scopes, _DependencyCollectionContext_dependencies, _DependencyCollectionContext_temporaries, _DependencyCollectionContext_temporariesUsedOutsideScope, _Dependen
  19. info long-line cjs/eslint-plugin-react-hooks.production.js:47572:1

    line length 681 characters (raw pass, confidence 0.50)

    _DependencyCollectionContext_declarations = new WeakMap(), _DependencyCollectionContext_reassignments = new WeakMap(), _DependencyCollectionContext_scopes = new WeakMap(), _DependencyCollectionContext_dependencies = new WeakMap(), _DependencyCollectionContext_temporaries = new WeakMap(), _DependencyCollectionContext_te

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o eslint-plugin-react-hooks-7.1.1-canary-ba39b32a-20261019.tgz https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-7.1.1-canary-ba39b32a-20261019.tgz
printf '%s  %s\n' 759ecf813f7d0461af8a6c9103f513c3f382f884d454f18b9eec65325c1bf7c4 eslint-plugin-react-hooks-7.1.1-canary-ba39b32a-20261019.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf eslint-plugin-react-hooks-7.1.1-canary-ba39b32a-20261019.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg