eslint 10.13.0

Source: https://github.com/eslint/eslint
Artifact scanned: eslint-10.13.0.tgz (npm tarball · 614.4 KB · SHA-256 05da899bc160…)
Compared with: eslint-10.12.0.tgz (0 signals introduced since)
Files: 417 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 13 info
Scan time: 6.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 22:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import bin/eslint.js:107:21

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
		try {
			const template = require(`../messages/${error.messageTemplate}.js`);

			return template(error.messageData || {});
```
likely benign LLM, confidence 0.93 Loads an ESLint error message template module by name from the local messages folder.
Reasoning
The require uses a template literal over error.messageTemplate to load a message template file from the project's own messages directory. This is a bounded, internal lookup in ESLint's CLI error path, not attacker-controlled execution.
info whitespace-anomaly lib/cli-engine/formatters/html.js:12:1

file mixes tab and space indentation (95 tab-indented and 131 space-indented lines) (raw pass, confidence 0.40)
```
const encodeHTML = (function () {
	const encodeHTMLRules = {
		"&": "&#38;",
		"<": "&#60;",
```
info ~~warn~~ → info by review encoding-base64 lib/cli-engine/formatters/html.js:42:83

base64-like blob (1600 bytes, compression ratio 0.77) (raw pass, confidence 0.60)
```
mage/png" sizes="any" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAHaAAAB2gGFomX7AAAAGXRFWHRTb2Z0d2FyZQB3d3cuaW5rc2NhcGUub3Jnm+48GgAABD1JREFUWMPFl11sk2UUx3/nbYtjxS1MF7MLMTECMgSTtSSyrQkLhAj7UBPnDSEGoxegGzMwojhXVpmTAA5iYpSoMQa8GBhFOrMFk03buei6yRAlcmOM0SEmU9d90b19jxcM1o5+sGnsc/e+z/
```
likely benign LLM, confidence 0.90 Inline base64 PNG icon embedded in the HTML report formatter's head section.
Reasoning
The raw pass flags a base64 PNG embedded as a data URI in an HTML formatter's favicon link. The blob is a normal inline image asset for a standalone HTML report, and the raw pass has a higher false-positive rate. Nothing in the snippet indicates hidden code.
info ~~warn~~ → info by review dynamic-import lib/config/config-loader.js:185:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
async function dynamicImportConfig(filePath, fileURL, mtime) {
	const module = await import(fileURL.href);

	importedConfigFileModificationTime.set(filePath, mtime);
```
likely benign LLM, confidence 0.92 Dynamically imports an ESLint configuration module from a resolved file URL.
Reasoning
This dynamically imports a config file by its file URL, which is how ESLint loads flat configs (eslint.config.js) from disk. The non-literal specifier is inherent to the feature and the target is the user's own project configuration.
info ~~warn~~ → info by review dynamic-import lib/eslint/eslint-helpers.js:990:16

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
async function loadOptionsFromModule(optionsURL) {
	return (await import(optionsURL)).default;
}
```
likely benign LLM, confidence 0.90 Dynamically imports an options module from a URL and returns its default export.
Reasoning
Imports an options module from a URL supplied by ESLint's own options-loading path, returning its default export. This is a standard config-loading pattern; the flagged specifier reflects user-supplied configuration, not hidden remote code.
info ~~warn~~ → info by review dynamic-import lib/eslint/eslint.js:1273:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		try {
			formatter = (await import(pathToFileURL(formatterPath))).default;
		} catch (ex) {
			// check for formatters that have been removed
```
likely benign LLM, confidence 0.92 Dynamically imports an ESLint formatter module from a resolved path, with fallback handling for removed formatters.
Reasoning
Loads a formatter module from a resolved path, with a catch that handles removed formatters. This is ESLint's plugin/formatter loading mechanism, consistent with the surrounding code, and the import target is a locally resolved formatter path.
info whitespace-anomaly messages/all-matched-files-ignored.js:4:1

file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
module.exports = function (it) {
	const { pattern } = it;

	return `
```

info whitespace-anomaly messages/config-serialize-function.js:4:1

file mixes tab and space indentation (8 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)

module.exports = function ({ key, objectKey }) {
	// special case for parsers
	const isParser =
		objectKey === "parser" && (key === "parse" || key === "parseForESLint");

info whitespace-anomaly messages/eslintrc-plugins.js:4:1

file mixes tab and space indentation (2 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
```
module.exports = function ({ plugins }) {
	const isArrayOfStrings = typeof plugins[0] === "string";

	return `
```

info whitespace-anomaly messages/invalid-rule-options.js:6:1

file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)

module.exports = function ({ ruleId, value }) {
	return `
Configuration for rule "${ruleId}" is invalid. Each rule must have a severity ("off", 0, "warn", 1, "error", or 2) and may be followed by additional options for the rule.

info whitespace-anomaly messages/no-config-found.js:4:1

file mixes tab and space indentation (2 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
module.exports = function (it) {
	const { directoryPath } = it;

	return `
```
info whitespace-anomaly messages/plugin-missing.js:4:1

file mixes tab and space indentation (2 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
module.exports = function (it) {
	const { pluginName, resolvePluginsRelativeTo, importerName } = it;

	return `
```

info whitespace-anomaly messages/rule-unsupported-language.js:4:1

file mixes tab and space indentation (1 tab-indented and 4 space-indented lines) (raw pass, confidence 0.40)

module.exports = function ({ ruleIds, language }) {
	return `
The following rules do not support the language "${language}":
${ruleIds.map(id => `\t- "${id}"`).join("\n")}

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o eslint-10.13.0.tgz https://registry.npmjs.org/eslint/-/eslint-10.13.0.tgz
printf '%s  %s\n' 05da899bc1602385a199570db5ad7cff488010fb103e659994065eed38f479f3 eslint-10.13.0.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf eslint-10.13.0.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg