js-yaml 5.4.3

Source: https://github.com/nodeca/js-yaml
Tag scanned: 5.4.3
Compared with: 5.4.2 (0 signals introduced since)
Files: 119 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 15 info
Scan time: 6.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import benchmark/benchmark.mjs:18:22

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  const filepath = new URL(`./implementations/${name}/index.mjs`, import.meta.url)
  const code = await import(filepath)

  IMPLS.push({ name, code })
```
likely benign LLM, confidence 0.80 Benchmark loader dynamically imports local implementation modules by name.
Reasoning
Dynamic import of a path built from a fixed local directory of implementation names inside a benchmark harness; the specifier is constructed from known local files, not remote or attacker-controlled input.

info long-line benchmark/samples/scalar_double_quoted_binary_01.yaml:1:1

line length 806 characters (raw pass, confidence 0.50)

"\x28\x72\x5A\xD2\x26\x72\xCD\xBB\x3D\x9B\xB6\x88\x1F\x33\x25\x0C\x19\x7A\x87\xD7\x95\x2D\x22\xB3\x9A\x05\x9A\x26\x49\x37\x71\xF5\x5F\xF4\x80\x9E\xB8\xE9\x81\xDB\xC8\xBE\x87\x23\x22\x99\x82\x2A\xF3\x9A\xBE\x5E\x86\x5E\x63\x6A\xC0\x7E\xF4\xB6\xA3\x0F\xD2\xE3\xCD\x22\xB9\x51\xF7\x43\x3F\x9A\x79\xFD\x5A\x16\xC3\x52\xD9\x5

info ~~warn~~ → info by review encoding-escape-soup benchmark/samples/scalar_double_quoted_binary_01.yaml:1:2

201 consecutive `\xNN` escapes (entropy 6.9 bits/byte) (raw pass, confidence 0.80)
```
"\x28\x72\x5A\xD2\x26\x72\xCD\xBB\x3D\x9B\xB6\x88\x1F\x33\x25\x0C\x19\x7A\x87\xD7\x95\x2D\x22\xB3\x9A\x05\x9A\x26\x49\x37\x71\xF5\x5F\xF4\x80\x9E\xB8\xE9\x81\xDB\xC8\xBE\x87\x23\x22\x99\x82\x2A\xF3\x9A\xBE\x5E\x86\x5E\x63\x6A\xC0\x7E\xF4\xB6\xA3\x0F\xD2\xE3\xCD\x22\xB9\x51\xF7\x43\x3F\x9A\x79\xFD\x5A\x16\xC3\x52\xD9\x5
```
likely benign LLM, confidence 0.90 Test sample YAML containing a long hex-escaped binary string.
Reasoning
This is a YAML test fixture for a binary scalar parser; long runs of \x escapes are deliberate test data exercising the YAML double-quoted escape handling, not an obfuscated payload.
info ~~warn~~ → info by review long-line benchmark/samples/scalar_double_quoted_binary_02.yaml:1:1

line length 12006 characters (raw pass, confidence 0.65)
```
"\x0C\xB7\x50\x70\x7E\xF5\xAB\x7D\x68\xFE\xB7\x87\xC9\x5C\x7E\xD3\x99\xF1\xC6\xC3\x4D\x7D\x94\x55\x56\x1D\xA5\xA3\xA0\xC8\xF5\x62\x15\xD3\x3A\x65\x1A\x6C\x68\x1A\x0F\x20\x2D\x0A\xD0\x57\x74\x5B\x38\xD5\xE4\x4F\x9B\x39\x60\xC4\x4A\x80\x87\xB4\x11\x81\x33\xB5\xBA\x70\xFC\x79\x8A\x5D\xB4\x4C\xC0\xB4\xEA\x9B\x1B\xBD\x6A\x6
```
likely benign LLM, confidence 0.90 Generated YAML benchmark fixture with a very long line.
Reasoning
Long single line is a generated benchmark fixture for YAML binary scalars; the length is expected from the test generator and there is no executable behavior.
info ~~warn~~ → info by review encoding-escape-soup benchmark/samples/scalar_double_quoted_binary_02.yaml:1:2

3001 consecutive `\xNN` escapes (entropy 7.9 bits/byte) (raw pass, confidence 0.80)
```
"\x0C\xB7\x50\x70\x7E\xF5\xAB\x7D\x68\xFE\xB7\x87\xC9\x5C\x7E\xD3\x99\xF1\xC6\xC3\x4D\x7D\x94\x55\x56\x1D\xA5\xA3\xA0\xC8\xF5\x62\x15\xD3\x3A\x65\x1A\x6C\x68\x1A\x0F\x20\x2D\x0A\xD0\x57\x74\x5B\x38\xD5\xE4\x4F\x9B\x39\x60\xC4\x4A\x80\x87\xB4\x11\x81\x33\xB5\xBA\x70\xFC\x79\x8A\x5D\xB4\x4C\xC0\xB4\xEA\x9B\x1B\xBD\x6A\x6
```
likely benign LLM, confidence 0.90 Benchmark YAML fixture with a 3001-escape binary string.
Reasoning
Same benchmark fixture; the escape run is test data for a YAML parser's binary and escape handling, consistent with a parser benchmark corpus.
info ~~warn~~ → info by review long-line benchmark/samples/scalar_double_quoted_escaped_02.yaml:1:1

line length 3443 characters (raw pass, confidence 0.65)
```
"Lorem ipsum dolor sit amet, consectetur adipiscing elit.\nDonec a diam lectus. Sed sit amet ipsum mauris.\nMaecenas congue ligula ac quam viverra nec consectetur ante hendrerit.\tDonec et mollis dolor.\0Praesent et diam eget libero egestas mattis sit amet vitae augue.\NNam tincidunt congue enim, ut porta lorem lacinia
```
likely benign LLM, confidence 0.90 Lorem ipsum YAML sample with many escape sequences on one long line.
Reasoning
Lorem ipsum text with escape sequences in a YAML benchmark sample; it is plain test content with no code execution or hidden payload.
info ~~warn~~ → info by review long-line benchmark/samples/scalar_double_quoted_simple_02.yaml:1:1

line length 3352 characters (raw pass, confidence 0.65)
```
"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec a diam lectus. Sed sit amet ipsum mauris. Maecenas congue ligula ac quam viverra nec consectetur ante hendrerit. Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia cons
```
likely benign LLM, confidence 0.92 Lorem ipsum YAML sample with a long single line.
Reasoning
Plain lorem ipsum text in a YAML benchmark fixture; the long line is just generated filler.
info ~~warn~~ → info by review dynamic-execution src/tag/scalar/binary.ts:10:18

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
  const binary = atob(input)
  const result = new Uint8Array(binary.length)
  for (let index = 0; index < binary.length; index++) {
```
likely benign LLM, confidence 0.85 YAML binary tag decoder uses atob to decode base64 into bytes.
Reasoning
atob is the standard way to decode a !!binary base64 scalar in a YAML library; the decoded bytes are copied into a Uint8Array and returned as data, not evaluated or fetched.
info dynamic-execution src/tag/scalar/binary.ts:23:10

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  }
  return btoa(binary)
}
```
info dynamic-execution support/demo_template/index.mjs:17:10

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
function encodeBase64 (str) {
  return btoa(String.fromCharCode(...new TextEncoder().encode(str)))
}
```
info ~~warn~~ → info by review dynamic-execution support/demo_template/index.mjs:21:51

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
function decodeBase64 (str) {
  return new TextDecoder().decode(Uint8Array.from(atob(str), (char) => {
    return char.charCodeAt(0)
  }))
```
likely benign LLM, confidence 0.85 Demo helper decodes base64 input to a UTF-8 string.
Reasoning
A small helper decoding a base64 string to text in a demo template; the decoded value is only converted to text and not passed to eval or a network call.
info ~~warn~~ → info by review encoding-base64 test/core/tags/binary.test.mjs:16:2

base64-like blob (62 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
```
 +f/++f/++f/++f/++f/++SH+Dk1hZGUgd2l0aCBHSU1QACwAAAAADAAMAAAFLC\\
 AgjoEwnuNAFOhpEMTRiggcz4BNJHrv/zCFcLiwMWYNG84BwwEeECcgggoBADs="

generic: !!binary |
```
likely benign LLM, confidence 0.90 Base64 test blob for YAML !!binary tag parsing.
Reasoning
The blob is embedded in a YAML !!binary test fixture; the snippet shows the 'Made with GIMP' image header, consistent with a real binary test value rather than a hidden payload.

info unicode-zero-width test/core/units/dump-scalar-styles.test.mjs:100:33

U+FEFF ZERO WIDTH NO-BREAK SPACE (BOM) in source (in string/comment) (raw pass, confidence 0.45)

      // BOM sits in the printable range but is excluded, so it must be escaped.
      assert.strictEqual(dump('a⟨U+FEFF⟩b'), '"a\\uFEFFb"\n')
    })

info unicode-surrogate test/core/units/load-error.test.mjs:178:33

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
  it('forbid lone surrogates', () => {
    assert.throws(() => { load('\udc00\ud800') }, YAMLException)
  })
```
info unicode-surrogate test/core/units/load-error.test.mjs:178:39

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
  it('forbid lone surrogates', () => {
    assert.throws(() => { load('\udc00\ud800') }, YAMLException)
  })
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodeca/js-yaml js-yaml && cd js-yaml
git checkout 5.4.3
disclude scan --severity info --diff 5.4.2 .