jiti 2.7.0

Source: https://github.com/unjs/jiti
Tag scanned: v2.7.0
Compared with: v2.6.1 (1 signals introduced since)
Files: 153 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 5.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:44

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import lib/jiti-static.mjs:10:30 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const nativeImport = (id) => import(id);

export function createJiti(id, opts = {}) {
```
likely benign LLM, confidence 0.88 Wrapper function nativeImport that forwards an id to dynamic import in the jiti loader.
Reasoning
A thin wrapper around import() used by a module loader to load user-requested modules. Expected behaviour for jiti; the AST pass flags any non-literal import as a generic dynamic-import signal.

info long-line README.md:15:1

line length 945 characters (raw pass, confidence 0.50)

[Docusaurus](https://docusaurus.io/), [ESLint](https://github.com/eslint/eslint), [FormKit](https://formkit.com/), [Histoire](https://histoire.dev/), [Knip](https://knip.dev/), [Nitro](https://nitro.unjs.io/), [Nuxt](https://nuxt.com/), [PostCSS loader](https://github.com/webpack-contrib/postcss-loader), [Rsbuild](http

info ~~warn~~ → info by review dynamic-import lib/jiti-native.mjs:58:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
          }
          return await import(resolved, importAttrs);
        } catch (error) {
          if (error.code === 'ERR_MODULE_NOT_FOUND' || error.code === 'ERR_UNSUPPORTED_DIR_IMPORT') {
```
likely benign LLM, confidence 0.85 Dynamic import of a resolved module path inside the jiti loader's native import fallback.
Reasoning
This is jiti, a legitimate TypeScript/ESM loader; dynamically importing a resolved module path is its core purpose. The import is of a resolved file path inside a loader, not an obfuscated payload.
info ~~warn~~ → info by review dynamic-import lib/jiti.cjs:8:30

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const nativeImport = (id) => import(id);

let _transform;
```
likely benign LLM, confidence 0.88 Wrapper around import() in the jiti CJS entry point.
Reasoning
Same nativeImport wrapper pattern as the other jiti build; the indirection exists so bundlers do not rewrite import(). Legitimate loader design.
info ~~warn~~ → info by review dynamic-import lib/jiti.mjs:8:30

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const nativeImport = (id) => import(id);

let _transform;
```
likely benign LLM, confidence 0.88 Wrapper around import() in the jiti ESM entry point.
Reasoning
Identical nativeImport wrapper in the ESM entry of a known loader library; no obfuscation or malicious behaviour shown.
info ~~warn~~ → info by review dynamic-import test/fixtures/data-uri/index.ts:6:3

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
try {
  require(uri);
  throw null;
} catch (error) {
```
likely benign LLM, confidence 0.85 Test fixture calling require on a data URI to check loader behaviour.
Reasoning
This is a test fixture for data URI handling in a loader. The require of a variable is intentional to exercise the loader and the throw null is a test assertion path, not malicious.
info ~~warn~~ → info by review dynamic-import test/fixtures/data-uri/index.ts:14:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
}
await import(uri);
```
likely benign LLM, confidence 0.85 Test fixture dynamically importing a data URI.
Reasoning
Test fixture performing a dynamic import of a data URI to verify loader support. Expected in a test suite for a module loader.
info ~~warn~~ → info by review dynamic-import test/node-register.test.mjs:13:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  test("fixtures/" + fixture + " (ESM)", async () => {
    const promise = import(`./fixtures/${fixture}`);
    const shouldReject =
      fixture === "error-parse" || fixture === "error-runtime";
```
likely benign LLM, confidence 0.90 Test that dynamically imports each fixture file in a relative fixtures path.
Reasoning
Test iterating over fixture names and importing them from a relative fixtures directory. Fixture names come from a fixed list in the test, so this is ordinary test code.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/unjs/jiti jiti && cd jiti
git checkout v2.7.0
disclude scan --severity info --diff v2.6.1 .