form-data 4.0.6

Source: https://github.com/form-data/form-data
Tag scanned: v4.0.6
Compared with: v4.0.5 (1 signals introduced since)
Files: 41 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 30 info
Scan time: 18.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 29 of 29 warn and critical signals; 29 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:55

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import test/integration/test-header-injection.js:6:16 new in this release

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testFieldNameCRLFInjection() {
```
likely benign LLM, confidence 0.94 Header-injection test requires form_data via a harness-computed path.
Reasoning
The file is a header-injection test, so CRLF content is expected test input. The require itself is a benign computed path to the local library.
info ~~warn~~ → info by review dynamic-import test/integration/test-boundary-prediction.js:3:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var satisfies = require('semver').satisfies;
var jsrp = satisfies(process.version, '>= 17') && require('js-randomness-predictor'); // eslint-disable-line global-require
```
likely benign LLM, confidence 0.93 Test file requires the local form_data library via a computed path from the test harness.
Reasoning
The non-literal require uses common.dir.lib, a test-harness path to the local form_data library, with the same pattern repeated across the test suite. Standard test setup, not a dropper or obfuscation. Only the static-analysis signal fires.
info ~~warn~~ → info by review dynamic-import test/integration/test-custom-content-type.js:10:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

/*
```
likely benign LLM, confidence 0.94 Test requires the local form_data module through a harness-computed path.
Reasoning
require(common.dir.lib + '/form_data') is a benign path join to the project's own library in a test file. The snippet shows nothing malicious.
info ~~warn~~ → info by review dynamic-import test/integration/test-custom-filename.js:15:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
```
likely benign LLM, confidence 0.94 Test loads the local form_data library via common.dir.lib path concatenation.
Reasoning
Same benign pattern: a computed require of the in-repo form_data module, alongside a normal formidable require used in tests.
info ~~warn~~ → info by review dynamic-import test/integration/test-custom-headers-object.js:10:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

var testHeader = { 'X-Test-Fake': 123 };
```
likely benign LLM, confidence 0.94 Header test requires form_data through a harness path.
Reasoning
Computed require of the local library path in a header-test file. No execution of untrusted input or encoded payload is visible.
info ~~warn~~ → info by review dynamic-import test/integration/test-custom-headers-string.js:10:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

var CRLF = '\r\n';
```
likely benign LLM, confidence 0.94 String-header test requires the local form_data module via a computed path.
Reasoning
Same harness-path require of form_data. The snippet only shows CRLF string constants, which are normal for multipart header tests.
info ~~warn~~ → info by review dynamic-import test/integration/test-errors.js:3:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var fake = require('fake').create();
var path = require('path');
```
likely benign LLM, confidence 0.94 Error test loads form_data through common.dir.lib concatenation.
Reasoning
The computed require points at the local form_data library, a routine pattern in this test suite. Other requires are ordinary npm modules.
info ~~warn~~ → info by review dynamic-import test/integration/test-form-get-length-sync.js:5:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var fs = require('fs');
var Readable = require('stream').Readable;
```
likely benign LLM, confidence 0.94 Sync length test requires the local form_data module via a computed path.
Reasoning
Standard harness-computed require of the in-repo library. No obfuscation or dynamic execution of external data.
info ~~warn~~ → info by review dynamic-import test/integration/test-form-get-length.js:3:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var fake = require('fake').create();
var fs = require('fs');
```
likely benign LLM, confidence 0.94 Length test loads form_data through a harness-computed path.
Reasoning
Computed require of the local form_data module, consistent with the rest of the test directory.
info ~~warn~~ → info by review dynamic-import test/integration/test-get-boundary.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testOneBoundaryPerForm() {
```
likely benign LLM, confidence 0.94 Boundary test requires form_data via common.dir.lib concatenation.
Reasoning
Harness-path require of the project's own library in a boundary-generation test. No suspicious constructs in the snippet.
info ~~warn~~ → info by review dynamic-import test/integration/test-get-buffer.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testTypeIsBuffer() {
```
likely benign LLM, confidence 0.94 Buffer test loads the local form_data library through a computed path.
Reasoning
Same computed require of the in-repo form_data module in a buffer test. Nothing in the snippet indicates malicious behavior.

info long-line test/integration/test-get-buffer.js:37:1

line length 584 characters (raw pass, confidence 0.50)

    Buffer.from('--' + boundary + FormData.LINE_BREAK + 'Content-Disposition: form-data; name="' + stringName + '"' + FormData.LINE_BREAK + FormData.LINE_BREAK + stringValue + FormData.LINE_BREAK + '--' + boundary + FormData.LINE_BREAK + 'Content-Disposition: form-data; name="' + intName + '"' + FormData.LINE_BREAK + F

info ~~warn~~ → info by review dynamic-import test/integration/test-http-response.js:7:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var parseUrl = require('url').parse;
var FormData = require(common.dir.lib + '/form_data');

// static server prepared for all tests
```
likely benign LLM, confidence 0.93 HTTP response test loads form_data through a harness path.
Reasoning
Computed require of the local form_data library in an HTTP test. The other requires are standard Node and npm modules. No payload or dropper behavior is shown.
info ~~warn~~ → info by review dynamic-import test/integration/test-last_boundary-line_break.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var server;
```
likely benign LLM, confidence 0.94 Boundary line-break test requires the local library through a computed path.
Reasoning
Computed require of form_data via common.dir.lib, matching the repo's test convention. Nothing suspicious in the snippet.
info ~~warn~~ → info by review dynamic-import test/integration/test-options-override.js:5:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');

var form = new FormData({ maxDataSize: 20 * 1024 * 1024 });
```
likely benign LLM, confidence 0.93 Test file requiring the form_data library via a computed test-directory path.
Reasoning
The require path is built from common.dir.lib, a test-harness helper that points at the library's own lib directory. This is a standard test-setup pattern in the form-data test suite, not a dropper or hidden loader.
info ~~warn~~ → info by review dynamic-import test/integration/test-pipe.js:9:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var fs = require('fs');
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
var hasOwn = require('hasown');
```
likely benign LLM, confidence 0.93 Test requiring the local form_data module through the harness path helper.
Reasoning
The non-literal require resolves to common.dir.lib + '/form_data', a local library path set up by the test harness. The surrounding requires are ordinary test dependencies, so this is a legitimate pattern.
info ~~warn~~ → info by review dynamic-import test/integration/test-ranged-filestream.js:14:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
```
likely benign LLM, confidence 0.93 Integration test loading form_data from the harness lib directory.
Reasoning
The dynamic specifier is the test harness's lib directory joined with '/form_data'. It is only used inside a test, and the form-data test suite does this throughout.
info ~~warn~~ → info by review dynamic-import test/integration/test-request.js:13:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var request = require('request');
var FormData = require(common.dir.lib + '/form_data');
var fs = require('fs');
var IncomingForm = require('formidable').IncomingForm;
```
likely benign LLM, confidence 0.93 Test requiring form_data from the local lib path, alongside request and formidable.
Reasoning
The require uses a fixed harness path (common.dir.lib) plus a constant suffix, with no external or user-controlled input. It matches the normal test layout of the library.
info ~~warn~~ → info by review dynamic-import test/integration/test-return-http-request.js:14:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

var expectedLength;
```
likely benign LLM, confidence 0.93 Test loading the local form_data module via the common.dir.lib helper.
Reasoning
This is the same harness-relative require of form_data inside a test file. Nothing in the snippet executes or fetches remote code.
info ~~warn~~ → info by review dynamic-import test/integration/test-set-boundary.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testSetBoundary() {
```
likely benign LLM, confidence 0.93 Boundary test requiring the local form_data library by computed path.
Reasoning
The non-literal require points at the library's lib directory through the test harness. The file is a boundary-setting unit test and the pattern is routine.
info ~~warn~~ → info by review dynamic-import test/integration/test-set-nonstring.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testSetUndefined() {
```
likely benign LLM, confidence 0.93 Non-string option test loading form_data from the test harness lib path.
Reasoning
The require builds a path from common.dir.lib, a fixed local harness location. The test exercises non-string option handling and the loader is benign.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-custom-header.js:9:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var fs = require('fs');
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
```
likely benign LLM, confidence 0.93 Custom header submit test requiring form_data via harness path.
Reasoning
The dynamic require resolves to the local form_data library through the harness helper, with no external source. The rest of the file is ordinary test setup.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-custom.js:8:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var fs = require('fs');
var FormData = require(common.dir.lib + '/form_data');

var remoteFile = 'http://localhost:' + common.staticPort + '/unicycle.jpg';
```
likely benign LLM, confidence 0.93 Custom submit test loading form_data from the lib directory.
Reasoning
common.dir.lib plus a fixed suffix is a local test-path construction. The file only fetches a local staticPort URL in a test, so there is no malicious indicator.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-https.js:7:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var server;
```
likely benign LLM, confidence 0.93 HTTPS submit test requiring form_data via the common.dir.lib path.
Reasoning
The require path is the test harness lib directory plus '/form_data'. HTTPS submit tests commonly use this layout, so the finding is a false positive from the non-literal-require heuristic.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-multi-nocallback.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var http = require('http');
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
```
likely benign LLM, confidence 0.93 Multi-part submit test loading the local form_data module.
Reasoning
The non-literal require uses the harness's local lib path with a constant suffix. The file is a multipart submit test and contains no execution or network-loading pattern beyond that.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-multi.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var http = require('http');
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
var times = 10;
```
likely benign LLM, confidence 0.93 Multipart submit test requiring form_data through the harness path.
Reasoning
The dynamic require resolves a fixed local library path via common.dir.lib. The surrounding code is a standard multipart upload test with no suspicious behavior.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-readable-stream.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var http = require('http');
var FormData = require(common.dir.lib + '/form_data');
var Readable = require('stream').Readable;
var util = require('util');
```
likely benign LLM, confidence 0.93 Readable stream submit test loading form_data from the local lib directory.
Reasoning
The require path comes from the harness's lib directory and a literal suffix, which is a local, non-attacker-controlled path. The readable-stream test uses only standard Node modules otherwise.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-url-parsing.js:7:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');

/**
```
likely benign LLM, confidence 0.93 Test file loads the local form_data library via a path built from the test harness's lib directory.
Reasoning
The require specifier is built from common.dir.lib, a test-harness path helper, plus a fixed module name. This is a standard pattern in the form-data library's test suite for loading the local library. No untrusted input reaches the specifier, and the AST signal is only a generic non-literal require warning.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit.js:8:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var fs = require('fs');
var FormData = require(common.dir.lib + '/form_data');

var remoteFile = 'http://localhost:' + common.staticPort + '/unicycle.jpg';
```
likely benign LLM, confidence 0.93 Integration test requires the local form_data module through a harness-provided path.
Reasoning
The non-literal require uses common.dir.lib with a fixed suffix to load the library under test. The surrounding code is ordinary integration test setup (fs, a localhost static server URL). Nothing here is dynamic or attacker-controlled.
info ~~warn~~ → info by review dynamic-import test/integration/test-to-string.js:5:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');

assert(String(new FormData()) === '[object FormData]');
```
likely benign LLM, confidence 0.94 Unit test loads the local FormData module via a harness path and checks its string tag.
Reasoning
Same pattern as the sibling test files: the module path is composed from common.dir.lib and a constant suffix, and the module is then used only to check String(new FormData()). This is a benign test idiom.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/form-data/form-data form-data && cd form-data
git checkout v4.0.6
disclude scan --severity info --diff v4.0.5 .