disclude.io

npm / esutils / 2.0.3

esutils 2.0.3

Source
https://github.com/estools/esutils
Artifact scanned
esutils-2.0.3.tgz (npm tarball · 9.3 KB · SHA-256 c5adbd730a49…)
Compared with
esutils-2.0.2.tgz (4 signals introduced since)
Files
6 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 4 info
Scan time
3.8 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-23 22:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review long-line lib/code.js:34:1 new in this release

    line length 4345 characters (raw pass, confidence 0.65)

            NonAsciiIdentifierStart: /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u
    likely benign LLM, confidence 0.93 A long line holding a generated Unicode NonAsciiIdentifierStart regex character class.
    Reasoning

    The snippet is a Unicode identifier-start regex table of the kind found in JavaScript parsers such as acorn or esprima. The long line is generated data, not an obfuscated payload, and the raw pass flags only its length.

  2. info warn → info by review long-line lib/code.js:36:1 new in this release

    line length 5133 characters (raw pass, confidence 0.65)

            NonAsciiIdentifierPart: /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05
    likely benign LLM, confidence 0.93 A long line holding a generated Unicode NonAsciiIdentifierPart regex character class.
    Reasoning

    This is the companion NonAsciiIdentifierPart Unicode regex table used by JavaScript parsers. It is standard generated lookup data, and the only signal is line length.

  3. info warn → info by review long-line lib/code.js:41:1 new in this release

    line length 6907 characters (raw pass, confidence 0.65)

            NonAsciiIdentifierStart: /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u
    likely benign LLM, confidence 0.93 A long generated Unicode identifier-start regex table in a JavaScript parser file.
    Reasoning

    The snippet matches the same generated NonAsciiIdentifierStart Unicode table pattern as the other findings in this file. It is a legitimate parser data structure, and the raw long-line signal is a false positive.

  4. info warn → info by review long-line lib/code.js:43:1 new in this release

    line length 8376 characters (raw pass, confidence 0.65)

            NonAsciiIdentifierPart: /[\xAA\xB5\xB7\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5
    likely benign LLM, confidence 0.93 A long generated Unicode identifier-part regex table in a JavaScript parser file.
    Reasoning

    This is another generated NonAsciiIdentifierPart Unicode range table from a parser library. The flagged characteristic is only the line's length, and the content is ordinary identifier-range data.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o esutils-2.0.3.tgz https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz
printf '%s  %s\n' c5adbd730a495a3c635bbae9ee5f693b95c7e13b395f7036efab8232c5f0640f esutils-2.0.3.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf esutils-2.0.3.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg