npm / jose / 6.2.13

jose 6.2.13

Source

https://github.com/panva/jose

Artifact scanned

jose-6.2.13.tgz (npm tarball · 48.7 KB · SHA-256 f070cea39a54…)

Compared with

jose-6.2.12.tgz (0 signals introduced since)

Files

80 scanned, 0 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

2.3 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 23:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line dist/types/index.d.ts:49:1

   line length 919 characters (raw pass, confidence 0.50)

   export type { AnyJWK, CompactDecryptResult, CompactJWEHeaderParameters, CompactJWSHeaderParameters, CompactVerifyResult, CritOption, CryptoKey, DecryptOptions, EncryptOptions, FlattenedDecryptResult, FlattenedJWE, FlattenedJWS, FlattenedJWSInput, FlattenedVerifyResult, GeneralDecryptResult, GeneralJWE, GeneralJWS, Gene

2. info dynamic-execution dist/webapi/lib/buffer_utils.js:44:19

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

       arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
     const encoded = btoa(arr.join(""));
     return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
   }

3. info warn → info by review dynamic-execution dist/webapi/lib/buffer_utils.js:55:18

   `atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)

     }
     const binary = atob(encoded), bytes = new Uint8Array(binary.length);
     for (let i = 0; i < binary.length; i++)
       bytes[i] = binary.charCodeAt(i);

   likely benign LLM, confidence 0.90 A base64 decode helper that converts an atob result into a Uint8Array.

   Reasoning

   The snippet is a standard base64-to-bytes helper: atob decodes the string, then each char code is copied into a Uint8Array. It is a common utility in a webapi library, and nothing here evaluates or fetches the decoded data. The finding's message about a fetch or eval step is speculative and does not match what the code does.

4. info long-line dist/webapi/lib/jwe_encrypt.js:19:1

   line length 785 characters (raw pass, confidence 0.50)

     if (aad !== void 0 && assertUint8Array(aad, "JWE Additional Authenticated Data"), cek !== void 0 && assertUint8Array(cek, "JWE Content Encryption Key"), iv !== void 0 && assertUint8Array(iv, "JWE Initialization Vector"), !sharedHeadersNormalized && protectedHeader !== void 0 && (protectedHeader = serializeJoseHeader(

5. info long-line dist/webapi/lib/jwe_encrypt.js:50:1

   line length 532 characters (raw pass, confidence 0.50)

     algEntry.mode === "integrated-encryption" ? cek = await prepareKey(algEntry, key, "encrypt") : [cek, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, providedCek, keyManagementParameters), parameters && (unprotectedParameters ? unprotectedHeader = unprotectedHeader ? { ...un

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o jose-6.2.13.tgz https://registry.npmjs.org/jose/-/jose-6.2.13.tgz
printf '%s  %s\n' f070cea39a544b750514d14e9697b5305aa0564804f319f05b266a1e35761f89 jose-6.2.13.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf jose-6.2.13.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg