disclude.iojs-yaml 5.5.0
- Source
- https://github.com/nodeca/js-yaml
- Tag scanned
5.5.0- Compared with
5.4.3(4 signals introduced since)- Files
- 120 scanned, 7 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 20 info
- Scan time
- 6.4 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
- Disclude version
- 4.1.0
- Scanned (UTC)
- 2026-10-22 11:42
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
-
-
}) -
}) -
const filepath = const code = await IMPLS.likely benign Benchmark loader dynamically imports local implementation modules by name.Reasoning
Dynamic import with a template-built path is a benchmark harness loading its own bundled implementations by name; the path is local and not attacker-controlled in this context.
-
"\x28\x72\x5A\xD2\x26\x72\xCD\xBB\x3D\x9B\xB6\x88\x1F\x33\x25\x0C\x19\x7A\x87\xD7\x95\x2D\x22\xB3\x9A\x05\x9A\x26\x49\x37\x71\xF5\x5F\xF4\x80\x9E\xB8\xE9\x81\xDB\xC8\xBE\x87\x23\x22\x99\x82\x2A\xF3\x9A\xBE\x5E\x86\x5E\x63\x6A\xC0\x7E\xF4\xB6\xA3\x0F\xD2\xE3\xCD\x22\xB9\x51\xF7\x43\x3F\x9A\x79\xFD\x5A\x16\xC3\x52\xD9\x5 -
info
warn→ info by reviewencoding-escape-soupbenchmark/samples/scalar_double_quoted_binary_01.yaml:1:2"\x28\x72\x5A\xD2\x26\x72\xCD\xBB\x3D\x9B\xB6\x88\x1F\x33\x25\x0C\x19\x7A\x87\xD7\x95\x2D\x22\xB3\x9A\x05\x9A\x26\x49\x37\x71\xF5\x5F\xF4\x80\x9E\xB8\xE9\x81\xDB\xC8\xBE\x87\x23\x22\x99\x82\x2A\xF3\x9A\xBE\x5E\x86\x5E\x63\x6A\xC0\x7E\xF4\xB6\xA3\x0F\xD2\xE3\xCD\x22\xB9\x51\xF7\x43\x3F\x9A\x79\xFD\x5A\x16\xC3\x52\xD9\x5likely benign YAML parser test sample containing a long hex-escaped binary string.Reasoning
This is a YAML test sample of a binary scalar written as hex escapes, which is expected for a YAML parser's binary tag test data, not an obfuscated payload.
-
"\x0C\xB7\x50\x70\x7E\xF5\xAB\x7D\x68\xFE\xB7\x87\xC9\x5C\x7E\xD3\x99\xF1\xC6\xC3\x4D\x7D\x94\x55\x56\x1D\xA5\xA3\xA0\xC8\xF5\x62\x15\xD3\x3A\x65\x1A\x6C\x68\x1A\x0F\x20\x2D\x0A\xD0\x57\x74\x5B\x38\xD5\xE4\x4F\x9B\x39\x60\xC4\x4A\x80\x87\xB4\x11\x81\x33\xB5\xBA\x70\xFC\x79\x8A\x5D\xB4\x4C\xC0\xB4\xEA\x9B\x1B\xBD\x6A\x6likely benign Long YAML benchmark fixture line of binary-escaped data.Reasoning
Long line of binary escape data in a YAML benchmark sample; the length is inherent to the test fixture's purpose.
-
info
warn→ info by reviewencoding-escape-soupbenchmark/samples/scalar_double_quoted_binary_02.yaml:1:2"\x0C\xB7\x50\x70\x7E\xF5\xAB\x7D\x68\xFE\xB7\x87\xC9\x5C\x7E\xD3\x99\xF1\xC6\xC3\x4D\x7D\x94\x55\x56\x1D\xA5\xA3\xA0\xC8\xF5\x62\x15\xD3\x3A\x65\x1A\x6C\x68\x1A\x0F\x20\x2D\x0A\xD0\x57\x74\x5B\x38\xD5\xE4\x4F\x9B\x39\x60\xC4\x4A\x80\x87\xB4\x11\x81\x33\xB5\xBA\x70\xFC\x79\x8A\x5D\xB4\x4C\xC0\xB4\xEA\x9B\x1B\xBD\x6A\x6likely benign Benchmark fixture with a very long run of hex escapes representing binary data.Reasoning
Same benchmark fixture; the escape run is the intended binary test payload for a YAML parser and is not executed or decoded into code.
-
"Lorem ipsum dolor sit amet, consectetur adipiscing elit.\nDonec a diam lectus. Sed sit amet ipsum mauris.\nMaecenas congue ligula ac quam viverra nec consectetur ante hendrerit.\tDonec et mollis dolor.\0Praesent et diam eget libero egestas mattis sit amet vitae augue.\NNam tincidunt congue enim, ut porta lorem lacinialikely benign YAML benchmark fixture with long lorem-ipsum escaped string.Reasoning
Lorem ipsum text with standard escape sequences in a YAML test fixture; long line is just generated filler.
-
"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec a diam lectus. Sed sit amet ipsum mauris. Maecenas congue ligula ac quam viverra nec consectetur ante hendrerit. Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia conslikely benign YAML benchmark fixture with long plain lorem-ipsum string.Reasoning
Plain lorem ipsum text in a single long YAML line; generated benchmark data with no obfuscation.
-
const binary = const result =likely benign YAML binary tag implementation decoding base64 with atob.Reasoning
This is a YAML !!binary tag decoder using atob to convert base64 into bytes; decoding base64 to a Uint8Array is its legitimate function, not dynamic execution.
-
} return } -
-
-
likely benign Demo helper that base64-decodes a string to UTF-8 text.
Reasoning
A small helper decoding base64 into a string via TextDecoder in a demo template; no eval or fetch of the decoded content is shown.
-
+f/++f/++f/++f/++f/++SH+Dk1hZGUgd2l0aCBHSU1QACwAAAAADAAMAAAFLC\\ AgjoEwnuNAFOhpEMTRiggcz4BNJHrv/zCFcLiwMWYNG84BwwEeECcgggoBADs=" generic: !!binary |likely benign Base64 binary test fixture for the YAML !!binary tag.Reasoning
Base64 blob in a YAML !!binary test, whose content decodes to a GIF-like test asset ('Made with GIMP'); expected test data rather than a hidden payload.
-
// BOM sits in the printable range but is excluded, so it must be escaped. assert. }) -
-
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&