js-yaml 5.5.0

Source: https://github.com/nodeca/js-yaml
Tag scanned: 5.5.0
Compared with: 5.4.3 (4 signals introduced since)
Files: 119 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 19 info
Scan time: 6.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 07:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info unicode-surrogate test/core/common/tagname.test.mjs:76:46 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

  it('does not throw on malformed encodings', () => {
    assert.doesNotThrow(() => tagNameShort('!\uD800'))
    assert.doesNotThrow(() => tagNameFull('!%FF'))
    assert.doesNotThrow(() => parseEvents('!%FF value'))

info unicode-surrogate test/core/units/load-error.test.mjs:192:21 new in this release

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

    assertMark('a: b\r\n  c\x01', 9, 1, 3)
    assertMark('a: x\udc00', 4, 0, 4)
    assertMark('a: \udc00', 3, 0, 3)
    assertMark('a: x\ud800', 4, 0, 4)

info unicode-surrogate test/core/units/load-error.test.mjs:193:20 new in this release

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
    assertMark('a: x\udc00', 4, 0, 4)
    assertMark('a: \udc00', 3, 0, 3)
    assertMark('a: x\ud800', 4, 0, 4)
  })
```
info unicode-surrogate test/core/units/load-error.test.mjs:194:21 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
    assertMark('a: \udc00', 3, 0, 3)
    assertMark('a: x\ud800', 4, 0, 4)
  })
```
info ~~warn~~ → info by review dynamic-import benchmark/benchmark.mjs:18:22

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  const filepath = new URL(`./implementations/${name}/index.mjs`, import.meta.url)
  const code = await import(filepath)

  IMPLS.push({ name, code })
```
likely benign LLM, confidence 0.80 Benchmark harness dynamically imports local implementation modules by name.
Reasoning
Dynamic import of a path built from a benchmark implementation name inside a local benchmark harness; the specifier is a local file URL under the repo, not a remote fetch, so it's a benign plugin-loading pattern, though the non-literal specifier is worth a glance.

info long-line benchmark/samples/scalar_double_quoted_binary_01.yaml:1:1

line length 806 characters (raw pass, confidence 0.50)

"\x28\x72\x5A\xD2\x26\x72\xCD\xBB\x3D\x9B\xB6\x88\x1F\x33\x25\x0C\x19\x7A\x87\xD7\x95\x2D\x22\xB3\x9A\x05\x9A\x26\x49\x37\x71\xF5\x5F\xF4\x80\x9E\xB8\xE9\x81\xDB\xC8\xBE\x87\x23\x22\x99\x82\x2A\xF3\x9A\xBE\x5E\x86\x5E\x63\x6A\xC0\x7E\xF4\xB6\xA3\x0F\xD2\xE3\xCD\x22\xB9\x51\xF7\x43\x3F\x9A\x79\xFD\x5A\x16\xC3\x52\xD9\x5

info ~~warn~~ → info by review encoding-escape-soup benchmark/samples/scalar_double_quoted_binary_01.yaml:1:2

201 consecutive `\xNN` escapes (entropy 6.9 bits/byte) (raw pass, confidence 0.80)
```
"\x28\x72\x5A\xD2\x26\x72\xCD\xBB\x3D\x9B\xB6\x88\x1F\x33\x25\x0C\x19\x7A\x87\xD7\x95\x2D\x22\xB3\x9A\x05\x9A\x26\x49\x37\x71\xF5\x5F\xF4\x80\x9E\xB8\xE9\x81\xDB\xC8\xBE\x87\x23\x22\x99\x82\x2A\xF3\x9A\xBE\x5E\x86\x5E\x63\x6A\xC0\x7E\xF4\xB6\xA3\x0F\xD2\xE3\xCD\x22\xB9\x51\xF7\x43\x3F\x9A\x79\xFD\x5A\x16\xC3\x52\xD9\x5
```
dismissed LLM, confidence 0.90 YAML parser test fixture containing a long hex-escaped binary string.
Reasoning
This is a YAML test sample of a double-quoted binary scalar full of hex escapes; it is test data for a YAML parser's escape handling, not obfuscated code.
info ~~warn~~ → info by review long-line benchmark/samples/scalar_double_quoted_binary_02.yaml:1:1

line length 12006 characters (raw pass, confidence 0.65)
```
"\x0C\xB7\x50\x70\x7E\xF5\xAB\x7D\x68\xFE\xB7\x87\xC9\x5C\x7E\xD3\x99\xF1\xC6\xC3\x4D\x7D\x94\x55\x56\x1D\xA5\xA3\xA0\xC8\xF5\x62\x15\xD3\x3A\x65\x1A\x6C\x68\x1A\x0F\x20\x2D\x0A\xD0\x57\x74\x5B\x38\xD5\xE4\x4F\x9B\x39\x60\xC4\x4A\x80\x87\xB4\x11\x81\x33\xB5\xBA\x70\xFC\x79\x8A\x5D\xB4\x4C\xC0\xB4\xEA\x9B\x1B\xBD\x6A\x6
```
dismissed LLM, confidence 0.90 Long YAML benchmark fixture line of escaped binary bytes.
Reasoning
Long single line in a YAML benchmark sample consisting of escaped binary data; a parser performance fixture, not a threat.
info ~~warn~~ → info by review encoding-escape-soup benchmark/samples/scalar_double_quoted_binary_02.yaml:1:2

3001 consecutive `\xNN` escapes (entropy 7.9 bits/byte) (raw pass, confidence 0.80)
```
"\x0C\xB7\x50\x70\x7E\xF5\xAB\x7D\x68\xFE\xB7\x87\xC9\x5C\x7E\xD3\x99\xF1\xC6\xC3\x4D\x7D\x94\x55\x56\x1D\xA5\xA3\xA0\xC8\xF5\x62\x15\xD3\x3A\x65\x1A\x6C\x68\x1A\x0F\x20\x2D\x0A\xD0\x57\x74\x5B\x38\xD5\xE4\x4F\x9B\x39\x60\xC4\x4A\x80\x87\xB4\x11\x81\x33\xB5\xBA\x70\xFC\x79\x8A\x5D\xB4\x4C\xC0\xB4\xEA\x9B\x1B\xBD\x6A\x6
```
dismissed LLM, confidence 0.90 Benchmark YAML fixture with thousands of \xNN escapes.
Reasoning
Same benchmark fixture as the other binary sample; the escape run is intentional test data for YAML scalar parsing.
info ~~warn~~ → info by review long-line benchmark/samples/scalar_double_quoted_escaped_02.yaml:1:1

line length 3443 characters (raw pass, confidence 0.65)
```
"Lorem ipsum dolor sit amet, consectetur adipiscing elit.\nDonec a diam lectus. Sed sit amet ipsum mauris.\nMaecenas congue ligula ac quam viverra nec consectetur ante hendrerit.\tDonec et mollis dolor.\0Praesent et diam eget libero egestas mattis sit amet vitae augue.\NNam tincidunt congue enim, ut porta lorem lacinia
```
dismissed LLM, confidence 0.90 Long lorem-ipsum YAML fixture exercising escape sequences.
Reasoning
Lorem ipsum text with standard YAML escapes in a benchmark fixture; long line is just generated test content.

info ~~warn~~ → info by review long-line benchmark/samples/scalar_double_quoted_simple_02.yaml:1:1

line length 3352 characters (raw pass, confidence 0.65)

"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec a diam lectus. Sed sit amet ipsum mauris. Maecenas congue ligula ac quam viverra nec consectetur ante hendrerit. Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia cons

dismissed LLM, confidence 0.92 Long plain-text YAML benchmark fixture.

Reasoning

Plain lorem ipsum text on one line in a YAML benchmark sample; no obfuscation.

info ~~warn~~ → info by review dynamic-execution src/tag/scalar/binary.ts:10:18

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
  const binary = atob(input)
  const result = new Uint8Array(binary.length)
  for (let index = 0; index < binary.length; index++) {
```
likely benign LLM, confidence 0.80 YAML binary tag decoder using atob to produce a Uint8Array.
Reasoning
This is a YAML !!binary tag implementation decoding base64 with atob into bytes; standard parser code. The flag is a generic heuristic on atob with no fetch or eval following it.
info dynamic-execution src/tag/scalar/binary.ts:23:10

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  }
  return btoa(binary)
}
```
info dynamic-execution support/demo_template/index.mjs:17:10

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
function encodeBase64 (str) {
  return btoa(String.fromCharCode(...new TextEncoder().encode(str)))
}
```
info ~~warn~~ → info by review dynamic-execution support/demo_template/index.mjs:21:51

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
function decodeBase64 (str) {
  return new TextDecoder().decode(Uint8Array.from(atob(str), (char) => {
    return char.charCodeAt(0)
  }))
```
likely benign LLM, confidence 0.80 Base64-to-string helper in a demo template.
Reasoning
A small helper decoding base64 to a UTF-8 string via atob and TextDecoder; ordinary utility code with no dynamic execution or fetch in the snippet.
info ~~warn~~ → info by review encoding-base64 test/core/tags/binary.test.mjs:16:2

base64-like blob (62 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
```
 +f/++f/++f/++f/++f/++SH+Dk1hZGUgd2l0aCBHSU1QACwAAAAADAAMAAAFLC\\
 AgjoEwnuNAFOhpEMTRiggcz4BNJHrv/zCFcLiwMWYNG84BwwEeECcgggoBADs="

generic: !!binary |
```
dismissed LLM, confidence 0.85 Base64 test vector for YAML binary tag parsing.
Reasoning
Test fixture for YAML !!binary containing a base64 blob that encodes a GIF header ('Made with GIMP'); expected test data, not a payload.

info unicode-zero-width test/core/units/dump-scalar-styles.test.mjs:100:33

U+FEFF ZERO WIDTH NO-BREAK SPACE (BOM) in source (in string/comment) (raw pass, confidence 0.45)

      // BOM sits in the printable range but is excluded, so it must be escaped.
      assert.strictEqual(dump('a⟨U+FEFF⟩b'), '"a\\uFEFFb"\n')
    })

info unicode-surrogate test/core/units/load-error.test.mjs:214:33

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
  it('forbid lone surrogates', () => {
    assert.throws(() => { load('\udc00\ud800') }, YAMLException)
  })
```
info unicode-surrogate test/core/units/load-error.test.mjs:214:39

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
  it('forbid lone surrogates', () => {
    assert.throws(() => { load('\udc00\ud800') }, YAMLException)
  })
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodeca/js-yaml js-yaml && cd js-yaml
git checkout 5.5.0
disclude scan --severity info --diff 5.4.3 .