Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
4072 of 8925 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
-
line length 532 characters (raw pass, confidence 0.50)
var j = -1, qt = Object.prototype.hasOwnProperty, M = 1, Jt = 2, Yt = 3, Xt = 4, Zt = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x84\x86-\x9F\uFFFE\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF]/, Qt = /[,\[\]{}]/, $t = /^(?:!|!!|![0-9A-Za-z-]+!)$/, en = String.raw`(?:%[0-9A-Fa-f]{2}|[0-9A-Za-z\
-
line length 1067 characters (raw pass, confidence 0.50)
var ir = "[\\x09\\x0A\\x0D\\x20-\\x7E\\x85\\xA0-\\uD7FF\\uE000-\\uFFFD\\u{10000}-\\u{10FFFF}]", ar = "[\\n\\r]", or = "\\uFEFF", sr = "[ \\t]", cr = `(?:(?!(?:${ar}|${or}))${ir})`, lr = `(?:(?!${sr})${cr})`, ur = "[\\x09\\x20-\\uD7FF\\uE000-\\uFFFF\\u{10000}-\\u{10FFFF}]", dr = "[-?:,\\[\\]{}#&*!|>'\"%@`]", fr = "[,\\[
-
line length 1361 characters (raw pass, confidence 0.50)
export { Vi as CHOMPING_CLIP, Ui as CHOMPING_KEEP, E as CHOMPING_MODE, Hi as CHOMPING_STRIP, T as COLLECTION_STYLE, zi as COLLECTION_STYLE_BLOCK, Bi as COLLECTION_STYLE_FLOW, tt as CORE_SCHEMA, Yn as DEFAULT_SCALAR_STYLE_RULES, rt as DUMP_SCHEMA, Mi as EVENT_ALIAS, Oi as EVENT_DOCUMENT, C as EVENT_ID, Ai as EVENT_MAPPI
-
`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
if (n.length % 4 != 0 || !Me.test(n)) return e;
let r = atob(n), i = new Uint8Array(r.length);
for (let e = 0; e < r.length; e++) i[e] = r.charCodeAt(e);
return i;
likely benign
LLM, confidence 0.93
Minified js-yaml browser build decoding base64 for the YAML !!binary type.
Reasoning
This is js-yaml's standard YAML !!binary tag resolver. It validates base64 length and charset, decodes with atob, and copies bytes into a Uint8Array. The result is returned as data, with no eval, fetch, or dynamic execution of the decoded content.
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
for (let n = 0; n < e.length; n++) t += String.fromCharCode(e[n]);
return btoa(t);
}
var Fe = t("tag:yaml.org,2002:binary", {
-
file mixes tab and space indentation (2721 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function defineScalarTag(tagName, options) {
var _options$implicit, _options$matchByTagPr, _options$implicitFirs, _options$represent, _options$representTag;
return {
tagName,
-
`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
if (input.length % 4 !== 0 || !BASE64_PATTERN.test(input)) return NOT_RESOLVED;
const binary = atob(input);
const result = new Uint8Array(binary.length);
for (let index = 0; index < binary.length; index++) result[index] = binary.charCodeAt(index);
likely benign
LLM, confidence 0.94
js-yaml CJS build's base64 decoder for YAML binary values.
Reasoning
Same js-yaml !!binary resolver in the CJS build. The decoded bytes are only converted to a Uint8Array and returned. The pattern is a legitimate YAML type implementation, not a dropper.
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
for (let index = 0; index < object.length; index++) binary += String.fromCharCode(object[index]);
return btoa(binary);
}
-
line length 976 characters (raw pass, confidence 0.50)
export { CHOMPING_CLIP, CHOMPING_KEEP, CHOMPING_MODE, CHOMPING_STRIP, COLLECTION_STYLE, COLLECTION_STYLE_BLOCK, COLLECTION_STYLE_FLOW, CORE_SCHEMA, DEFAULT_SCALAR_STYLE_RULES, DUMP_SCHEMA, EVENT_ALIAS, EVENT_DOCUMENT, EVENT_ID, EVENT_MAPPING, EVENT_POP, EVENT_SCALAR, EVENT_SEQUENCE, FAILSAFE_SCHEMA, JSON_SCHEMA, NOT_RE
-
line length 554 characters (raw pass, confidence 0.50)
export type { AliasEvent, AliasNode, ChompingMode, CollectionStyle, ConstructorOptions, Document, DocumentDirective, DocumentEvent, DumpOptions, Event, EventId, FromEventsOptions, FromJsOptions, LoadOptions, MappingEvent, MappingNode, MappingTagDefinition, MappingTagOptions, Node, NodeBase, ParserOptions, PopEvent, Pre
-
file mixes tab and space indentation (2682 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function defineScalarTag(tagName, options) {
return {
tagName,
nodeKind: "scalar",
-
`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
if (input.length % 4 !== 0 || !BASE64_PATTERN.test(input)) return NOT_RESOLVED;
const binary = atob(input);
const result = new Uint8Array(binary.length);
for (let index = 0; index < binary.length; index++) result[index] = binary.charCodeAt(index);
likely benign
LLM, confidence 0.94
js-yaml ESM build's base64 decoder for YAML binary values.
Reasoning
Identical js-yaml !!binary base64 decoding in the ESM build. It converts base64 to bytes and returns them without executing or fetching anything, which is expected library behaviour.
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
for (let index = 0; index < object.length; index++) binary += String.fromCharCode(object[index]);
return btoa(binary);
}
-
line length 976 characters (raw pass, confidence 0.50)
export { CHOMPING_CLIP, CHOMPING_KEEP, CHOMPING_MODE, CHOMPING_STRIP, COLLECTION_STYLE, COLLECTION_STYLE_BLOCK, COLLECTION_STYLE_FLOW, CORE_SCHEMA, DEFAULT_SCALAR_STYLE_RULES, DUMP_SCHEMA, EVENT_ALIAS, EVENT_DOCUMENT, EVENT_ID, EVENT_MAPPING, EVENT_POP, EVENT_SCALAR, EVENT_SEQUENCE, FAILSAFE_SCHEMA, JSON_SCHEMA, NOT_RE
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io