ignore 7.0.13

Source: https://github.com/kaelzhang/node-ignore
Tag scanned: 7.0.13
Compared with: 7.0.12 (0 signals introduced since)
Files: 18 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 2.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 11:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import benchmark/worker.js:19:16

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
const ignore = require(process.argv[2])

const NS_PER_MS = 1e6
```
likely benign LLM, confidence 0.85 A benchmark worker script calls require on a module path taken from the command-line argument process.argv[2].
Reasoning
The require call takes its specifier from process.argv[2], a command-line argument supplied by whoever runs the benchmark worker. This is a developer tool loading a module chosen at invocation time, not hidden or fetched payload code. The file sits in a benchmark directory alongside timing constants, consistent with a benchmark harness. Dynamic require is a legitimate pattern here, though it does allow loading arbitrary local modules from the command line, which is why confidence is not higher.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/kaelzhang/node-ignore node-ignore && cd node-ignore
git checkout 7.0.13
disclude scan --severity info --diff 7.0.12 .