disclude.io

npm / json5 / 2.2.3

json5 2.2.3

Source
https://github.com/json5/json5
Tag scanned
v2.2.3
Compared with
v2.2.2 (0 signals introduced since)
Files
28 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 3 info
Scan time
2.5 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-14 19:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review long-line lib/unicode.js:3:1

    line length 7119 characters (raw pass, confidence 0.65)

    module.exports.ID_Start = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u0671-\u
    likely benign LLM, confidence 0.97 Generated Unicode ID_Start regex character class, a very long line of code point ranges.
    Reasoning

    Raw pass long-line signal on a generated Unicode ID_Start character-class regex (the standard ECMAScript/esutils-style tables). The content is a sequence of ranges of Unicode code points with no execution, encoding, or payload; long length is simply the size of the generated table. Classic false positive for raw-pass findings.

  2. info warn → info by review long-line lib/unicode.js:4:1

    line length 8577 characters (raw pass, confidence 0.65)

    module.exports.ID_Continue = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\
    likely benign LLM, confidence 0.97 Generated Unicode ID_Continue regex character class, a very long line of code point ranges.
    Reasoning

    Same pattern as the sibling finding: a generated ID_Continue Unicode range regex in a lib/unicode.js module. Only a long line of escaped code point ranges is shown, with no dynamic execution or obfuscated payload; benign generated data.

  3. info identifier-low-length lib/util.js:1:1

    31 of 62 non-conventional identifiers are single-character (50%) (token pass, confidence 0.50)

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/json5/json5 json5 && cd json5
git checkout v2.2.3
disclude scan --severity info --diff v2.2.2 .