form-data 4.0.6

Source: https://github.com/form-data/form-data
Tag scanned: v4.0.6
Compared with: v4.0.5 (1 signals introduced since)
Files: 41 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 30 info
Scan time: 17.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 29 of 29 warn and critical signals; 29 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 18:00

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import test/integration/test-header-injection.js:6:16 new in this release

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testFieldNameCRLFInjection() {
```
dismissed LLM, confidence 0.96 Header-injection test that loads the local form_data module via a computed path.
Reasoning
Computed require of the local library. The CRLF injection test checks that headers are sanitized, so the content is a defensive test.
info ~~warn~~ → info by review dynamic-import test/integration/test-boundary-prediction.js:3:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var satisfies = require('semver').satisfies;
var jsrp = satisfies(process.version, '>= 17') && require('js-randomness-predictor'); // eslint-disable-line global-require
```
dismissed LLM, confidence 0.95 Test file that requires the local form_data library through a computed path and conditionally loads a randomness-predictor test helper.
Reasoning
The non-literal require resolves a path under common.dir.lib to the library's own form_data module, a standard pattern in a test harness. The same file loads js-randomness-predictor only when semver reports a Node version of 17 or later, with an eslint-disable comment, which fits a security regression test for boundary predictability.
info ~~warn~~ → info by review dynamic-import test/integration/test-custom-content-type.js:10:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

/*
```
dismissed LLM, confidence 0.96 Test that loads the local form_data module via a computed path.
Reasoning
The require of common.dir.lib + '/form_data' loads the project's own library in a test file. The flag is a generic dynamic-require heuristic with no obfuscation or execution of untrusted data.
info ~~warn~~ → info by review dynamic-import test/integration/test-custom-filename.js:15:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
```
dismissed LLM, confidence 0.96 Test that loads the local form_data module via a computed path.
Reasoning
Computed require of the project's own form_data library in a test, alongside an ordinary formidable import. Nothing suspicious.
info ~~warn~~ → info by review dynamic-import test/integration/test-custom-headers-object.js:10:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

var testHeader = { 'X-Test-Fake': 123 };
```
dismissed LLM, confidence 0.96 Header-object test that loads the local form_data module via a computed path.
Reasoning
Same standard test harness pattern loading the local library. The header object is plain test data.
info ~~warn~~ → info by review dynamic-import test/integration/test-custom-headers-string.js:10:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

var CRLF = '\r\n';
```
dismissed LLM, confidence 0.96 Header-string test that loads the local form_data module via a computed path.
Reasoning
Same standard test harness pattern. The CRLF constant is ordinary HTTP multipart formatting used in tests.
info ~~warn~~ → info by review dynamic-import test/integration/test-errors.js:3:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var fake = require('fake').create();
var path = require('path');
```
dismissed LLM, confidence 0.96 Error-handling test that loads the local form_data module via a computed path.
Reasoning
Computed require of the local library in a test file. The fake module is a test stub, not a payload.
info ~~warn~~ → info by review dynamic-import test/integration/test-form-get-length-sync.js:5:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var fs = require('fs');
var Readable = require('stream').Readable;
```
dismissed LLM, confidence 0.96 Synchronous form-length test that loads the local library via a computed path.
Reasoning
Computed require of the local form_data library in a test, with standard fs and stream imports.
info ~~warn~~ → info by review dynamic-import test/integration/test-form-get-length.js:3:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var fake = require('fake').create();
var fs = require('fs');
```
dismissed LLM, confidence 0.96 Form-length test that loads the local library via a computed path.
Reasoning
Computed require of the local form_data library in a test file, with standard test imports.
info ~~warn~~ → info by review dynamic-import test/integration/test-get-boundary.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testOneBoundaryPerForm() {
```
dismissed LLM, confidence 0.96 Boundary test that loads the local form_data module via a computed path.
Reasoning
Computed require of the local library in a boundary test. The IIFE is a plain test wrapper.
info ~~warn~~ → info by review dynamic-import test/integration/test-get-buffer.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testTypeIsBuffer() {
```
dismissed LLM, confidence 0.96 Buffer-type test that loads the local form_data module via a computed path.
Reasoning
Computed require of the local library in a buffer-type test. Nothing executes untrusted data.

info long-line test/integration/test-get-buffer.js:37:1

line length 584 characters (raw pass, confidence 0.50)

    Buffer.from('--' + boundary + FormData.LINE_BREAK + 'Content-Disposition: form-data; name="' + stringName + '"' + FormData.LINE_BREAK + FormData.LINE_BREAK + stringValue + FormData.LINE_BREAK + '--' + boundary + FormData.LINE_BREAK + 'Content-Disposition: form-data; name="' + intName + '"' + FormData.LINE_BREAK + F

info ~~warn~~ → info by review dynamic-import test/integration/test-http-response.js:7:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var parseUrl = require('url').parse;
var FormData = require(common.dir.lib + '/form_data');

// static server prepared for all tests
```
dismissed LLM, confidence 0.96 HTTP response test that loads the local form_data module via a computed path.
Reasoning
Computed require of the local library in an HTTP integration test with a static test server.
info ~~warn~~ → info by review dynamic-import test/integration/test-last_boundary-line_break.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var server;
```
dismissed LLM, confidence 0.96 Boundary line-break test that loads the local form_data module via a computed path.
Reasoning
Computed require of the local library in a boundary-format test.
info ~~warn~~ → info by review dynamic-import test/integration/test-options-override.js:5:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');

var form = new FormData({ maxDataSize: 20 * 1024 * 1024 });
```
dismissed LLM, confidence 0.96 Options-override test that loads the local form_data module via a computed path.
Reasoning
Computed require of the local library. The options object is ordinary test configuration.
info ~~warn~~ → info by review dynamic-import test/integration/test-pipe.js:9:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var fs = require('fs');
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
var hasOwn = require('hasown');
```
dismissed LLM, confidence 0.95 Piping test that loads the local form_data module via a computed path.
Reasoning
Computed require of the local library alongside ordinary dependency imports such as fs and hasown. Standard test code.
info ~~warn~~ → info by review dynamic-import test/integration/test-ranged-filestream.js:14:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
```
dismissed LLM, confidence 0.96 Ranged file-stream test that loads the local form_data module via a computed path.
Reasoning
Computed require of the local library in a ranged file-stream test. Standard test harness code.
info ~~warn~~ → info by review dynamic-import test/integration/test-request.js:13:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var request = require('request');
var FormData = require(common.dir.lib + '/form_data');
var fs = require('fs');
var IncomingForm = require('formidable').IncomingForm;
```
likely benign LLM, confidence 0.93 Test file requiring the library's own form_data module via a harness path.
Reasoning
The require uses a path built from a test-harness object (common.dir.lib) pointing at the library's own form_data module. The surrounding code is ordinary test setup with standard requires, and there is no sign of obfuscation or dynamic payload loading.
info ~~warn~~ → info by review dynamic-import test/integration/test-return-http-request.js:14:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

var expectedLength;
```
likely benign LLM, confidence 0.93 Test requiring the local form_data module through a harness-provided directory path.
Reasoning
The non-literal require resolves common.dir.lib + '/form_data', a local library module in a test directory. This is a common test-harness pattern with no external or encoded input.
info ~~warn~~ → info by review dynamic-import test/integration/test-set-boundary.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testSetBoundary() {
```
likely benign LLM, confidence 0.93 Boundary test loading the local form_data module via harness path.
Reasoning
The require loads the local form_data module through common.dir.lib in a boundary-setting unit test. Nothing in the snippet suggests attacker-controlled input or hidden execution.
info ~~warn~~ → info by review dynamic-import test/integration/test-set-nonstring.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var FormData = require(common.dir.lib + '/form_data');

(function testSetUndefined() {
```
likely benign LLM, confidence 0.93 Non-string setter test loading local form_data module via harness path.
Reasoning
Same harness-relative require of the local form_data module in a non-string setter test. It is a legitimate test pattern.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-custom-header.js:9:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var fs = require('fs');
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
```
likely benign LLM, confidence 0.93 Custom-header submit test requiring local form_data module.
Reasoning
The dynamic require points at the library's own form_data module through the test harness. The surrounding requires (fs, formidable) are typical for a submit test.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-custom.js:8:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var fs = require('fs');
var FormData = require(common.dir.lib + '/form_data');

var remoteFile = 'http://localhost:' + common.staticPort + '/unicycle.jpg';
```
likely benign LLM, confidence 0.93 Custom submit test loading local form_data module via harness path.
Reasoning
The require resolves a local library path via common.dir.lib, which is standard for this test suite. No obfuscation or remote code loading is present.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-https.js:7:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');
var server;
```
likely benign LLM, confidence 0.93 HTTPS submit test loading local form_data module.
Reasoning
The harness-relative require of form_data in an HTTPS submit test is a benign test-setup pattern.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-multi-nocallback.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var http = require('http');
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
```
likely benign LLM, confidence 0.93 Multi-submit test requiring local form_data module via harness path.
Reasoning
The non-literal require loads the local form_data module through the test harness. The file otherwise contains plain http and formidable test setup.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-multi.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var http = require('http');
var FormData = require(common.dir.lib + '/form_data');
var IncomingForm = require('formidable').IncomingForm;
var times = 10;
```
likely benign LLM, confidence 0.93 Multi-submit test loading local form_data module.
Reasoning
The require uses common.dir.lib to load the library's own form_data module. This is an ordinary test-suite pattern.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-readable-stream.js:6:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var http = require('http');
var FormData = require(common.dir.lib + '/form_data');
var Readable = require('stream').Readable;
var util = require('util');
```
likely benign LLM, confidence 0.93 Readable-stream submit test loading local form_data module.
Reasoning
The dynamic require targets the local form_data module via the test harness. Stream and util requires are standard test imports.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit-url-parsing.js:7:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');

/**
```
likely benign LLM, confidence 0.93 URL-parsing submit test loading local form_data module.
Reasoning
The require of form_data via common.dir.lib is a harness-relative path to the library under test, which is normal for URL parsing tests.
info ~~warn~~ → info by review dynamic-import test/integration/test-submit.js:8:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var fs = require('fs');
var FormData = require(common.dir.lib + '/form_data');

var remoteFile = 'http://localhost:' + common.staticPort + '/unicycle.jpg';
```
likely benign LLM, confidence 0.93 Submit test loading local form_data module via harness path.
Reasoning
The non-literal require resolves the local form_data module through the test harness. The snippet shows an ordinary submit test setup with no hidden behavior.
info ~~warn~~ → info by review dynamic-import test/integration/test-to-string.js:5:16

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
var assert = common.assert;
var FormData = require(common.dir.lib + '/form_data');

assert(String(new FormData()) === '[object FormData]');
```
likely benign LLM, confidence 0.93 toString test loading local form_data module.
Reasoning
Harness-relative require of form_data followed by a simple String() assertion. This is a benign unit test.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/form-data/form-data form-data && cd form-data
git checkout v4.0.6
disclude scan --severity info --diff v4.0.5 .