npm / esutils / 2.0.3

esutils 2.0.3

Source

https://github.com/estools/esutils

Tag scanned

2.0.3

Compared with

2.0.2 (4 signals introduced since)

Files

7 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

6.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 19:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review long-line lib/code.js:34:1 new in this release

   line length 4345 characters (raw pass, confidence 0.65)

           NonAsciiIdentifierStart: /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u

   likely benign LLM, confidence 0.95 Generated Unicode identifier-start regex table in a parser library.

   Reasoning

   Long lines containing Unicode identifier-range regex character classes are typical of generated Unicode ID_Start/ID_Part tables used by parsers like acorn/esprima. Raw long-line signal on generated data tables is a known false-positive pattern.

2. info warn → info by review long-line lib/code.js:36:1 new in this release

   line length 5133 characters (raw pass, confidence 0.65)

           NonAsciiIdentifierPart: /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05

   likely benign LLM, confidence 0.95 Generated Unicode identifier-part regex table.

   Reasoning

   Same generated Unicode identifier-part regex table; long lines of code-point ranges are expected output of a generator, not obfuscation.

3. info warn → info by review long-line lib/code.js:41:1 new in this release

   line length 6907 characters (raw pass, confidence 0.65)

           NonAsciiIdentifierStart: /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u

   likely benign LLM, confidence 0.95 Generated Unicode identifier-start regex table.

   Reasoning

   Generated Unicode identifier regex data with long lines; raw-pass long-line finding with no executable obfuscation present.

4. info warn → info by review long-line lib/code.js:43:1 new in this release

   line length 8376 characters (raw pass, confidence 0.65)

           NonAsciiIdentifierPart: /[\xAA\xB5\xB7\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5

   likely benign LLM, confidence 0.94 Generated Unicode identifier-part regex table.

   Reasoning

   Generated Unicode identifier-part regex table consistent with a parser's identifier data; the long line alone signals nothing malicious.

5. info warn → info by review dynamic-import tools/generate-identifier-regex.js:11:12

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

   const get = function(what) {
       return require('unicode-' + version + '/' + what + '/code-points');
   };

   likely benign LLM, confidence 0.90 A developer tool helper that requires Unicode code-point data packages using a computed version/category path to generate identifier regexes.

   Reasoning

   The require specifier is built from a version string and a category name, which is the normal pattern for a build-time generator that loads per-version Unicode data packages (unicode-<version>/<what>/code-points). The file name and the surrounding helper function both indicate a developer tool that generates identifier regexes. No network, shell, or decode behavior is shown, and the require targets a standard Unicode data package. This is a benign dynamic require, flagged only because the specifier is non-literal.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/estools/esutils esutils && cd esutils
git checkout 2.0.3
disclude scan --severity info --diff 2.0.2 .