npm / jsesc / 3.1.0

jsesc 3.1.0

Source

https://github.com/mathiasbynens/jsesc

Artifact scanned

jsesc-3.1.0.tgz (npm tarball · 9.8 KB · SHA-256 0c712225ccca…)

Compared with

jsesc-3.0.2.tgz (0 signals introduced since)

Files

5 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

0.1 s

LLM review

LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 20:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info unicode-surrogate bin/jsesc:38:37

   surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

   				'\nExamples:\n',
   				'\tjsesc \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\tjsesc --json \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',

2. info unicode-surrogate bin/jsesc:39:44

   surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

   				'\tjsesc \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\tjsesc --json \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',

3. info unicode-surrogate bin/jsesc:40:64

   surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

   				'\tjsesc --json \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\techo \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\' | jsesc'

4. info unicode-surrogate bin/jsesc:41:60

   surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

   				'\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\techo \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\' | jsesc'
   			].join('\n'));

5. info unicode-surrogate bin/jsesc:42:36

   surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

   				'\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',
   				'\techo \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\' | jsesc'
   			].join('\n'));
   			return process.exit(1);

6. info whitespace-anomaly jsesc.js:6:1

   file mixes tab and space indentation (254 tab-indented and 13 space-indented lines) (raw pass, confidence 0.40)

   const forOwn = (object, callback) => {
   	for (const key in object) {
   		if (hasOwnProperty.call(object, key)) {
   			callback(key, object[key]);

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o jsesc-3.1.0.tgz https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz
printf '%s  %s\n' 0c712225ccca9a70bf83f2ac2f52a268c858c7df3b3df196f1623239d80d3c09 jsesc-3.1.0.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf jsesc-3.1.0.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg