disclude.io

npm / esutils / 2.0.3

esutils 2.0.3

Source
https://github.com/estools/esutils
Tag scanned
2.0.3
Compared with
2.0.2 (4 signals introduced since)
Files
7 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 5 info
Scan time
4.4 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-14 20:05

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review long-line lib/code.js:34:1 new in this release

    line length 4345 characters (raw pass, confidence 0.65)

            NonAsciiIdentifierStart: /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u
    likely benign LLM, confidence 0.95 Generated Unicode identifier-start regex table in a parser library.
    Reasoning

    Long lines containing Unicode identifier-range regex character classes are typical of generated parser tables (acorn-style NonASCII identifier tables). The raw long-line signal fires on minified/generated data, which is a known false-positive pattern; no executable payload is present.

  2. info warn → info by review long-line lib/code.js:36:1 new in this release

    line length 5133 characters (raw pass, confidence 0.65)

            NonAsciiIdentifierPart: /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05
    likely benign LLM, confidence 0.95 Generated Unicode identifier-part regex table in a parser library.
    Reasoning

    Same generated Unicode identifier-part regex table as the neighboring finding; a large static character class with no dynamic execution or encoded payload. Raw long-line heuristic on generated data.

  3. info warn → info by review long-line lib/code.js:41:1 new in this release

    line length 6907 characters (raw pass, confidence 0.65)

            NonAsciiIdentifierStart: /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u
    likely benign LLM, confidence 0.94 Generated Unicode identifier-start regex table.
    Reasoning

    Continuation of the generated Unicode identifier regex data; long static character class with no executable behavior.

  4. info warn → info by review long-line lib/code.js:43:1 new in this release

    line length 8376 characters (raw pass, confidence 0.65)

            NonAsciiIdentifierPart: /[\xAA\xB5\xB7\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5
    likely benign LLM, confidence 0.94 Generated Unicode identifier-part regex table.
    Reasoning

    Generated Unicode identifier-part regex table; long static literal typical of generated code, not obfuscation.

  5. info warn → info by review dynamic-import tools/generate-identifier-regex.js:11:12

    `require` called with a non-literal specifier (ast pass, confidence 0.80)

    const get = function(what) {
    return require('unicode-' + version + '/' + what + '/code-points');
};
    likely benign LLM, confidence 0.80 Build tool dynamically requires a Unicode data package by version and category.
    Reasoning

    The require specifier is built from a version string and a path segment. In a build-time generator tool that loads Unicode data packages (unicode-<version>/<category>/code-points), this is a normal pattern for selecting dataset versions. The inputs are developer-controlled, not attacker-supplied at install time, though a dynamic require in a package is worth a glance to confirm version is not externally sourced.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/estools/esutils esutils && cd esutils
git checkout 2.0.3
disclude scan --severity info --diff 2.0.2 .