jsdom 30.1.3

Source: https://github.com/jsdom/jsdom
Artifact scanned: jsdom-30.1.3.tgz (npm tarball · 542.4 KB · SHA-256 48dc5a26cec3…)
Compared with: jsdom-30.1.2.tgz (0 signals introduced since)
Files: 666 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 5.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 00:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution lib/jsdom/browser/Window.js:787:14

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
    try {
      return atob(str);
    } catch {
      // Convert Node.js DOMException to one from our global.
```
likely benign LLM, confidence 0.95 Implementation of the window.atob base64 decoding method in jsdom's Window.js.
Reasoning
The snippet is the body of window.atob, a standard browser API that jsdom implements by wrapping Node's atob and converting its DOMException. The flagged call only decodes a value and does not evaluate it or fetch anything. It is a legitimate implementation of a web platform method, and the pass is AST, which is more reliable than raw.
info dynamic-execution lib/jsdom/browser/Window.js:799:14

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
    try {
      return btoa(str);
    } catch {
      // Convert Node.js DOMException to one from our global.
```
info ~~critical~~ → info by review dynamic-execution lib/jsdom/living/helpers/create-event-accessor.js:128:7

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
      // eslint-disable-next-line no-new-func
      Function(body); // properly error out on syntax errors
      // Note: this won't execute body; that would require `Function(body)()`.
    } catch (e) {
```
likely benign LLM, confidence 0.90 Syntax check that compiles an inline event handler body via the Function constructor without invoking it.
Reasoning
The Function(body) call is inside a try block with an eslint-disable comment for no-new-func. Its purpose is to surface syntax errors when an inline event handler attribute body is compiled, and the comment states that the body is not executed. This matches the HTML spec's event handler compilation in a DOM library. The finding is a non-literal Function constructor, which is a dynamic-code pattern, but the context shows a deliberate, documented syntax check rather than malicious execution. The residual doubt is that compiling attacker-controlled attribute text is itself a dynamic-code surface, but that is inherent to browser-like behavior.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o jsdom-30.1.3.tgz https://registry.npmjs.org/jsdom/-/jsdom-30.1.3.tgz
printf '%s  %s\n' 48dc5a26cec36bbc2fecf88aa95583af6e9e566a67006077a97b71f5b3a8dec1 jsdom-30.1.3.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf jsdom-30.1.3.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg