espree 11.2.0

Source: https://github.com/eslint/js
Tag scanned: espree-v11.2.0
Directory: packages/espree (only this part of the repository was scanned)
Compared with: espree-v11.1.1 (0 signals introduced since)
Files: 1866 scanned, 98 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 36 info
Scan time: 15.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 21 of 21 warn and critical signals; 21 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 18:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/basic.src.js:2:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
async function main() {
    const foo = await import(source)
}
```
likely benign LLM, confidence 0.90 Test fixture for dynamic import syntax inside an async function.
Reasoning
Parser fixture testing dynamic import syntax with an identifier argument; no malicious payload.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/first-of-statement.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(source)
```
likely benign LLM, confidence 0.90 Parser fixture with a bare dynamic import statement.
Reasoning
Syntax fixture for parser conformance; the non-literal import is intentional test input.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/invalid-multi-sources.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(source1, source2)
```
likely benign LLM, confidence 0.90 Invalid-syntax fixture with two arguments to import().
Reasoning
Deliberately invalid syntax fixture used to test parser error handling.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/invalid-new-import.src.js:1:5

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
new import(source)
```
likely benign LLM, confidence 0.90 Invalid-syntax fixture using new with import.
Reasoning
Deliberately invalid syntax fixture testing parser rejection of new import().
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/invalid-trailing-comma.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(source,)
```
likely benign LLM, confidence 0.90 Parser fixture with a trailing comma in import().
Reasoning
Syntax fixture for trailing comma handling in import(); test input only.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/invalid-wrap-import.src.js:1:2

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
(import)(source)
```
likely benign LLM, confidence 0.90 Parser fixture with a parenthesized import keyword.
Reasoning
Syntax fixture for parenthesized import keyword; test input only.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/new-import.src.js:1:6

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
new (import(source))
```
likely benign LLM, confidence 0.90 Parser fixture wrapping import() in new.
Reasoning
Syntax fixture testing new applied to a dynamic import expression.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/with-assign.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(source = "foo.js")
```
likely benign LLM, confidence 0.90 Parser fixture with an assignment inside import().
Reasoning
Syntax fixture with an assignment expression as import argument; no malicious behavior.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/ecma-version/11/dynamic-import/with-sequence.src.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import((dummy, source))
```
likely benign LLM, confidence 0.90 Parser fixture with a sequence expression inside import().
Reasoning
Syntax fixture with a sequence expression as import argument; test input only.
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.result.js:143:37

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
                        "value": " 👶 ",
                        "raw": "\" \\uD83D\\uDC76 \""
                    }
                }
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.result.js:143:44

orphaned low surrogate \uDC76 (no preceding high surrogate) (token pass, confidence 0.65)
```
                        "value": " 👶 ",
                        "raw": "\" \\uD83D\\uDC76 \""
                    }
                }
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.result.js:280:27

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
            "type": "String",
            "value": "\" \\uD83D\\uDC76 \"",
            "loc": {
                "start": {
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.result.js:280:34

orphaned low surrogate \uDC76 (no preceding high surrogate) (token pass, confidence 0.65)
```
            "type": "String",
            "value": "\" \\uD83D\\uDC76 \"",
            "loc": {
                "start": {
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/export-exported-with-escapes.src.js:2:19

surrogate pair \uD83D\uDC76 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
let foo;
export { foo as " \uD83D\uDC76 " };
```

info unicode-surrogate

packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.result.js:68:37

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

                        "value": " 👶 ",
                        "raw": "\" \\uD83D\\uDC76 \""
                    },
                    "local": {

info unicode-surrogate

packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.result.js:68:44

orphaned low surrogate \uDC76 (no preceding high surrogate) (token pass, confidence 0.65)

                        "value": " 👶 ",
                        "raw": "\" \\uD83D\\uDC76 \""
                    },
                    "local": {

info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.result.js:151:27

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
            "type": "String",
            "value": "\" \\uD83D\\uDC76 \"",
            "loc": {
                "start": {
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.result.js:151:34

orphaned low surrogate \uDC76 (no preceding high surrogate) (token pass, confidence 0.65)
```
            "type": "String",
            "value": "\" \\uD83D\\uDC76 \"",
            "loc": {
                "start": {
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/import-imported-with-escapes.src.js:1:12

surrogate pair \uD83D\uDC76 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
import { " \uD83D\uDC76 " as foo } from "mod";
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/invalid-lone-surrogate-export-exported.src.js:2:19

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
let foo;
export { foo as " \uD83D " };
```
info unicode-surrogate packages/espree/tests/fixtures/ecma-version/13/modules/arbitrary-module-namespace-names/invalid-lone-surrogate-import-imported.src.js:1:12

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
import { " \uD83D " as foo } from "mod";
```
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/benchmark.js:214:31

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
      // http://bugzil.la/559438
      support.decompilation = Function(
        'return (' + (function(x) { return { 'x': '' + (1 + x) + '', 'y': 0 }; }) + ')'
      )()(0).x === '1';
```
likely benign LLM, confidence 0.85 Feature detection using Function constructor in a bundled benchmark library.
Reasoning
Known Benchmark.js feature-detection code for decompilation support; the Function body is built from a fixed local function, not external input.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/libraries/escodegen.browser.js:158:34

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
        var require_ = function (file) {
            var requiredModule = require(file, dirname);
            var cached = require.cache[require.resolve(file, dirname)];
```
likely benign LLM, confidence 0.85 Browser require shim resolving modules in a bundled library.
Reasoning
Browser shim of require inside the escodegen bundle; the specifier is a module path resolved internally.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/fixtures/libraries/esmangle.browser.js:157:34

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
        var require_ = function (file) {
            var requiredModule = require(file, dirname);
            var cached = require.cache[require.resolve(file, dirname)];
```
likely benign LLM, confidence 0.85 Browser require shim in a bundled esmangle library.
Reasoning
Same browser require shim pattern as in escodegen; standard bundler code.
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/jquery-1.9.1.js:560:15

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
					return ( new Function( "return " + data ) )();
				}
			}
```
likely benign LLM, confidence 0.85 jQuery JSON parsing fallback using new Function.
Reasoning
jQuery parseJSON fallback that evaluates JSON-like data via Function; a known legacy pattern in a genuine library, not a dropper.
info whitespace-anomaly packages/espree/tests/fixtures/libraries/mootools-1.4.5.js:6:1

file mixes tab and space indentation (3908 tab-indented and 10 space-indented lines) (raw pass, confidence 0.40)
```
web build:
 - http://mootools.net/core/76bf47062d6c1983d66ce47ad66aa0e0

packager build:
```
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/mootools-1.4.5.js:6097:9

`eval` called with a non-literal expression (ast pass, confidence 0.90)
```
	return eval('(' + string + ')');
};
```
likely benign LLM, confidence 0.85 MooTools JSON decoding helper using eval.
Reasoning
MooTools JSON decode via eval in a vendored library; expected legacy code, not malicious.
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/mootools-1.4.5.js:6443:9

`eval` called with a non-literal expression (ast pass, confidence 0.75)
```
	var rs = obj.CallFunction('<invoke name="' + fn + '" returntype="javascript">' + __flash__argumentsToXML(arguments, 2) + '</invoke>');
	return eval(rs);
};
```
likely benign LLM, confidence 0.85 MooTools Flash bridge calling eval on the response.
Reasoning
MooTools Flash bridge evaluating a returned string; legacy vendored library code.
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/fixtures/libraries/underscore-1.5.2.js:1206:16

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
    try {
      render = new Function(settings.variable || 'obj', '_', source);
    } catch (e) {
      e.source = source;
```
likely benign LLM, confidence 0.85 Underscore template compiler building a function from template source.
Reasoning
Underscore template compilation via new Function, a documented library feature, not an attack.
info whitespace-anomaly packages/espree/tests/fixtures/libraries/yui-3.12.0.js:20:1

file mixes tab and space indentation (12 tab-indented and 8055 space-indented lines) (raw pass, confidence 0.40)
```
if (typeof YUI != 'undefined') {
    YUI._YUI = YUI;
}
```
info ~~warn~~ → info by review dynamic-import packages/espree/tests/lib/ecma-features.test.js:71:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
				const expected = await import(
					`${pathToFileURL(path.resolve(__dirname, "../../", FIXTURES_DIR, filename)).href}.result.js`
				);
```
likely benign LLM, confidence 0.90 Test code dynamically importing expected-result fixture modules.
Reasoning
Test harness dynamically importing a fixture path built from the repository's own directory; no external or malicious input.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/lib/ecma-version.test.js:81:29

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
					);
					const expected = await import(
						`${pathToFileURL(absolutePath).href}.result.js`
					);
```
likely benign LLM, confidence 0.88 Test code dynamically imports a companion expected-result fixture file by file URL.
Reasoning
The specifier is a template literal built from pathToFileURL(absolutePath) plus a fixed '.result.js' suffix. The import loads expected-result fixtures inside an ESLint test file, which is a common test-harness pattern. The path comes from the test's own fixture directory, not from untrusted input, so the non-literal specifier does not indicate malicious behavior.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/lib/ecma-version.test.js:107:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
					try {
						expected = await import(
							`${pathToFileURL(absolutePath).href}.module-result.js`
						);
```
likely benign LLM, confidence 0.88 Test code tries to import a module-result fixture file, with a fallback import, using a path derived from a local fixture.
Reasoning
Same pattern as the other finding in this file: the import specifier is a fixed suffix appended to a file URL derived from a local fixture path. It is inside a try block that falls back to a second expected-result file, consistent with testing ES module versus script behavior. No network source or attacker-controlled input is involved.
info ~~warn~~ → info by review dynamic-import packages/espree/tests/lib/ecma-version.test.js:111:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
					} catch {
						expected = await import(
							`${pathToFileURL(absolutePath).href}.result.js`
						);
```
likely benign LLM, confidence 0.88 Test code's catch fallback dynamically imports a result fixture file via a local file URL.
Reasoning
This is the catch-branch fallback of the same fixture-loading logic. The specifier is built only from the local absolute fixture path and a constant '.result.js' suffix, so it only loads test expectation files. Nothing here is a dropper or remote-loading pattern.
info ~~critical~~ → info by review dynamic-execution packages/espree/tests/lib/tester.test.js:72:11

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
			// eslint-disable-next-line no-new-func -- it's okay to eval code in tests
			return Function(`return ${code};`)();
		}
```
likely benign LLM, confidence 0.90 Test helper wraps a test case's code string in Function(...) to evaluate it, with an explicit lint suppression.
Reasoning
The critical severity comes from Function(...) with a non-literal body. The code is in a test helper, and the preceding eslint-disable comment explicitly says evaluating code is intended in tests. The string is the test case's own source code wrapped in a return statement, which is a standard way to evaluate rule test snippets. This is a legitimate test-harness pattern, not obfuscation or an attack, though it does execute dynamic code.
info whitespace-anomaly packages/espree/tests/util/conditional-regex-value.js:16:1

file mixes tab and space indentation (11 tab-indented and 21 space-indented lines) (raw pass, confidence 0.40)
```
export default function (literalNode) {
	if (literalNode.regex) {
		try {
			literalNode.value = new RegExp(
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/eslint/js js && cd js
git checkout espree-v11.2.0
disclude scan --severity info --diff espree-v11.1.1 packages/espree