espree 11.2.0

Source: https://github.com/eslint/js
Tag scanned: espree-v11.2.0
Directory: packages/espree (only this part of the repository was scanned)
Compared with: espree-v11.1.1 (0 signals introduced since)
Files: 1865 scanned, 99 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 36 info
Scan time: 15.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 21 of 21 warn and critical signals; 21 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:59

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/basic.src.js:2:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
async function main() {
    const foo = await import(source)
}
```
likely benign LLM, confidence 0.85 Test fixture containing await import(source) inside an async function.
Reasoning
Parser fixture for ECMAScript dynamic import syntax inside an async function; the non-literal specifier is what the test exercises, not malicious behavior.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/first-of-statement.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(source)
```
likely benign LLM, confidence 0.85 Parser fixture with a bare import(source) statement.
Reasoning
Syntax fixture under tests/fixtures/ecma-version testing dynamic import at statement start; no payload or obfuscation.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/invalid-multi-sources.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(source1, source2)
```
likely benign LLM, confidence 0.85 Invalid-syntax parser fixture with import(source1, source2).
Reasoning
Deliberately invalid syntax fixture used to test parser error handling; not executable malware.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/invalid-new-import.src.js:1:5

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
new import(source)
```
likely benign LLM, confidence 0.85 Invalid-syntax fixture with new import(source).
Reasoning
Invalid-syntax parser fixture testing new import(); the finding is an artifact of the test corpus.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/invalid-trailing-comma.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(source,)
```
likely benign LLM, confidence 0.85 Invalid-syntax fixture import(source,).
Reasoning
Syntax-error fixture for trailing comma in import(); benign test input.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/invalid-wrap-import.src.js:1:2

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
(import)(source)
```
likely benign LLM, confidence 0.85 Parser fixture (import)(source).
Reasoning
Parser fixture for parenthesized import; no malicious intent evident.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/new-import.src.js:1:6

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
new (import(source))
```
likely benign LLM, confidence 0.85 Parser fixture new (import(source)).
Reasoning
Parser fixture for new (import(...)) syntax in the ecma-version test suite.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/with-assign.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(source = "foo.js")
```
likely benign LLM, confidence 0.85 Parser fixture import(source = "foo.js").
Reasoning
Syntax fixture for assignment expression inside import(); benign test input.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/with-sequence.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import((dummy, source))
```
likely benign LLM, confidence 0.85 Parser fixture import((dummy, source)).
Reasoning
Syntax fixture for sequence expression inside import(); benign test input.
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.result.js:143:37

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
                        "value": " 👶 ",
                        "raw": "\" \\uD83D\\uDC76 \""
                    }
                }
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.result.js:143:44

orphaned low surrogate \uDC76 (no preceding high surrogate) (token pass, confidence 0.65)
```
                        "value": " 👶 ",
                        "raw": "\" \\uD83D\\uDC76 \""
                    }
                }
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.result.js:280:27

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
            "type": "String",
            "value": "\" \\uD83D\\uDC76 \"",
            "loc": {
                "start": {
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.result.js:280:34

orphaned low surrogate \uDC76 (no preceding high surrogate) (token pass, confidence 0.65)
```
            "type": "String",
            "value": "\" \\uD83D\\uDC76 \"",
            "loc": {
                "start": {
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.src.js:2:19

surrogate pair \uD83D\uDC76 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
let foo;
export { foo as " \uD83D\uDC76 " };
```

info unicode-surrogate

packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.result.js:68:37

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

                        "value": " 👶 ",
                        "raw": "\" \\uD83D\\uDC76 \""
                    },
                    "local": {

info unicode-surrogate

packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.result.js:68:44

orphaned low surrogate \uDC76 (no preceding high surrogate) (token pass, confidence 0.65)

                        "value": " 👶 ",
                        "raw": "\" \\uD83D\\uDC76 \""
                    },
                    "local": {

info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.result.js:151:27

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
            "type": "String",
            "value": "\" \\uD83D\\uDC76 \"",
            "loc": {
                "start": {
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.result.js:151:34

orphaned low surrogate \uDC76 (no preceding high surrogate) (token pass, confidence 0.65)
```
            "type": "String",
            "value": "\" \\uD83D\\uDC76 \"",
            "loc": {
                "start": {
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.src.js:1:12

surrogate pair \uD83D\uDC76 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
import { " \uD83D\uDC76 " as foo } from "mod";
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/invalid-lone-surrogate-export-exported.src.js:2:19

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
let foo;
export { foo as " \uD83D " };
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/invalid-lone-surrogate-import-imported.src.js:1:12

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
import { " \uD83D " as foo } from "mod";
```
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/benchmark.js:214:31

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
      // http://bugzil.la/559438
      support.decompilation = Function(
        'return (' + (function(x) { return { 'x': '' + (1 + x) + '', 'y': 0 }; }) + ')'
      )()(0).x === '1';
```
likely benign LLM, confidence 0.80 Benchmark.js support check that builds and runs a Function from a serialized local function.
Reasoning
This is the Benchmark.js feature-detection idiom for decompilation support, using Function with a constructed body over a fixed local function. Not a payload, but it is a dynamic execution pattern in a vendored library.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/libraries/escodegen.browser.js:158:34

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
        var require_ = function (file) {
            var requiredModule = require(file, dirname);
            var cached = require.cache[require.resolve(file, dirname)];
```
likely benign LLM, confidence 0.85 Bundler-generated require_ wrapper resolving modules dynamically.
Reasoning
Browserified require shim from escodegen's bundle; the non-literal require is the module loader's own resolution logic, not an attack.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/libraries/esmangle.browser.js:157:34

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
        var require_ = function (file) {
            var requiredModule = require(file, dirname);
            var cached = require.cache[require.resolve(file, dirname)];
```
likely benign LLM, confidence 0.85 Bundler-generated require_ wrapper in esmangle browser build.
Reasoning
Same browserify require shim pattern as escodegen; standard bundler runtime code in a vendored library.
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/jquery-1.9.1.js:560:15

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
					return ( new Function( "return " + data ) )();
				}
			}
```
likely benign LLM, confidence 0.85 jQuery parseJSON fallback using new Function on input data.
Reasoning
This is jQuery's parseJSON fallback, which evaluates JSON-like data via new Function; well-known library code, flagged for dynamic execution but not malicious.
info whitespace-anomaly packages/espree/tests/fixtures/libraries/mootools-1.4.5.js:6:1

file mixes tab and space indentation (3908 tab-indented and 10 space-indented lines) (raw pass, confidence 0.40)
```
web build:
 - http://mootools.net/core/76bf47062d6c1983d66ce47ad66aa0e0

packager build:
```
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/mootools-1.4.5.js:6097:9

`eval` called with a non-literal expression (ast pass, confidence 0.90)
```
	return eval('(' + string + ')');
};
```
likely benign LLM, confidence 0.85 MooTools JSON.decode-style helper that evals a string.
Reasoning
MooTools JSON decoding helper using eval on a string wrapped in parentheses; a known legacy pattern in a vendored library, a real risk surface but not an injected payload.
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/mootools-1.4.5.js:6443:9

`eval` called with a non-literal expression (ast pass, confidence 0.75)
```
	var rs = obj.CallFunction('<invoke name="' + fn + '" returntype="javascript">' + __flash__argumentsToXML(arguments, 2) + '</invoke>');
	return eval(rs);
};
```
likely benign LLM, confidence 0.85 Vendored MooTools Flash bridge code that evals a response string from CallFunction.
Reasoning
This is a vendored MooTools 1.4.5 test fixture. The eval wraps the response from a Flash ExternalInterface bridge, which is a known legacy pattern in that library. It is dynamic execution of a non-literal string, but it sits in an upstream library fixture and is not a dropper or obfuscation.
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/underscore-1.5.2.js:1206:16

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
    try {
      render = new Function(settings.variable || 'obj', '_', source);
    } catch (e) {
      e.source = source;
```
likely benign LLM, confidence 0.90 Underscore template engine compiling a template into a function via the Function constructor.
Reasoning
This is the standard Underscore _.template compiler, which builds a function from a template source string. The Function constructor call is the documented design of the library, and the source is generated from template settings in a vendored fixture.
info whitespace-anomaly packages/espree/tests/fixtures/libraries/yui-3.12.0.js:20:1

file mixes tab and space indentation (12 tab-indented and 8055 space-indented lines) (raw pass, confidence 0.40)
```
if (typeof YUI != 'undefined') {
    YUI._YUI = YUI;
}
```
info ~~warn~~ → info by review dynamic-import packages/espree/tests/lib/ecma-features.test.js:71:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
				const expected = await import(
					`${pathToFileURL(path.resolve(__dirname, "../../", FIXTURES_DIR, filename)).href}.result.js`
				);
```
likely benign LLM, confidence 0.95 Test helper dynamically importing a fixture's expected-result module by computed path.
Reasoning
This is a test harness that dynamically imports expected result modules for fixture files. The specifier is built from a local path and a fixed suffix, with no attacker-controlled input.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/lib/ecma-version.test.js:81:29

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
					);
					const expected = await import(
						`${pathToFileURL(absolutePath).href}.result.js`
					);
```
likely benign LLM, confidence 0.95 Test helper dynamically importing expected-result files for ECMAScript version fixtures.
Reasoning
This is the same test-harness pattern: a dynamic import of a '.result.js' file derived from a local fixture path, with no untrusted input.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/lib/ecma-version.test.js:107:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
					try {
						expected = await import(
							`${pathToFileURL(absolutePath).href}.module-result.js`
						);
```
likely benign LLM, confidence 0.95 Test helper importing module-result fixtures with a fallback to result fixtures.
Reasoning
This is a fallback dynamic import of a '.module-result.js' fixture inside a try block, built from a local absolute path. It is ordinary test-runner logic.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/lib/ecma-version.test.js:111:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
					} catch {
						expected = await import(
							`${pathToFileURL(absolutePath).href}.result.js`
						);
```
likely benign LLM, confidence 0.95 Test helper fallback dynamic import of a result fixture in a catch block.
Reasoning
This is the catch-branch fallback of the same test loader, importing a '.result.js' fixture derived from a local path. It is benign test infrastructure.
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/lib/tester.test.js:72:11

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
			// eslint-disable-next-line no-new-func -- it's okay to eval code in tests
			return Function(`return ${code};`)();
		}
```
likely benign LLM, confidence 0.90 Test utility that evaluates test code strings via the Function constructor, with an explicit lint suppression.
Reasoning
This test helper evaluates a code string via Function. The code carries an explicit eslint-disable comment acknowledging the intentional eval in tests. The input comes from test cases, not untrusted external data.
info whitespace-anomaly packages/espree/tests/util/conditional-regex-value.js:16:1

file mixes tab and space indentation (11 tab-indented and 21 space-indented lines) (raw pass, confidence 0.40)
```
export default function (literalNode) {
	if (literalNode.regex) {
		try {
			literalNode.value = new RegExp(
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/eslint/js js && cd js
git checkout espree-v11.2.0
disclude scan --severity info --diff espree-v11.1.1 packages/espree