npm / fdir / 6.5.0

fdir 6.5.0

Source

https://github.com/thecodrr/fdir

Tag scanned

v6.5.0

Compared with

v6.4.6 (0 signals introduced since)

Files

35 scanned, 11 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 16:24

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import benchmarks/fdir-benchmark.ts:17:20

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

     const normalized = normalizeVersion(version);
     const { fdir } = require(`fdir${normalized}`);
     addSuite(fdir, version);
   }

   likely benign LLM, confidence 0.85 A benchmark script dynamically requires a versioned fdir package to compare releases.

   Reasoning

   The require specifier is built from a normalized version string in a benchmark file that loads different published versions of the fdir package for comparison. The dynamic specifier is constrained by normalizeVersion and the benchmark's own version list, which is a typical way to load multiple package versions. No shell, encoding, or exfiltration behavior is shown. The residual risk is that normalizeVersion is not visible, so the input is not fully proven to be constrained.

2. info warn → info by review dynamic-import benchmarks/fdir-benchmark.ts:70:26

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

     const normalized = normalizeVersion(versions[3]);
     const { fdir } = await import(`fdir${normalized}`);
     return new fdir().onlyCounts().crawl("node_modules").sync();
   }

   likely benign LLM, confidence 0.85 A benchmark awaits a dynamically named fdir version import and runs a directory crawl.

   Reasoning

   The dynamic import specifier is derived from a normalized version taken from a fixed versions array, inside a benchmark that crawls node_modules with fdir. This matches the same benchmark pattern of loading different fdir releases by version. Nothing indicates malicious payload loading. The unseen normalizeVersion implementation is the main uncertainty.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/thecodrr/fdir fdir && cd fdir
git checkout v6.5.0
disclude scan --severity info --diff v6.4.6 .