disclude.iojson5 2.2.3
- Source
- https://github.com/json5/json5
- Artifact scanned
json5-2.2.3.tgz- Compared with
json5-2.2.2.tgz(0 signals introduced since)- Files
- 19 scanned, 0 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 15 info
- Scan time
- 8.4 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 11 of 11 warn and critical signals; 11 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 16:57
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
var ID_Start = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u0671-\u06D3\u06D5likely benign Generated Unicode ID_Start character-class regex in a bundled JavaScript file.Reasoning
The line is a long Unicode-range regex for ID_Start, the kind of table generated by parser libraries. Length alone is expected in a generated, minified bundle, and nothing in the snippet is executable or hidden.
-
var ID_Continue = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\u05C7\u05Dlikely benign Generated Unicode ID_Continue character-class regex in a bundled JavaScript file.Reasoning
This is the ID_Continue Unicode regex table, the same generated pattern as ID_Start. The long line is a formatting artifact of a bundled parser.
-
var Space_Separator=/[\u1680\u2000-\u200A\u202F\u205F\u3000]/,ID_Start=/[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\ulikely benign Minified parser bundle whose first line defines Unicode identifier regexes.Reasoning
The line is a minified bundle that defines ID_Start and related Unicode-class regexes, consistent with a JSON5/parser library. Long minified lines are expected and the snippet shows no decoding or execution.
-
"Z"||u>="0"&&u<="9"||"$"===u||"_"===u||"⟨U+200C⟩"===u||"⟨U+200D⟩"===u||unicode..),isDigit:,isHexDigit:};let source,parseState,stack,pos,line,column,token,key,root;var -
&&u<="9"||"$"===u||"_"===u||"⟨U+200C⟩"===u||"⟨U+200D⟩"===u||unicode..),isDigit:,isHexDigit:};let source,parseState,stack,pos,line,column,token,key,root;var -
,likely benign Zero-width non-joiner literal used as a valid identifier-continue character in a lexer.Reasoning
The literal ZWNJ inside a switch case in an identifier-lexing routine is there because ECMAScript permits U+200C in identifier-continue positions. It is a spec-conformance detail of a parser, not a disguised payload.
-
return ;buffer+=},likely benign Zero-width joiner literal in a lexer's identifier-continue case list.Reasoning
The ZWJ literal appears in the same identifier-continue case list, matching the ECMAScript identifier rules. A minified lexer is the expected context, and the character does not drive any dangerous behavior.
-
;buffer+=u,lexState="identifierName"},likely benign Zero-width non-joiner in the identifier-escape validation branch of a lexer.Reasoning
This occurrence sits in the identifier-escape handling of the same lexer, where ZWNJ is a permitted identifier character per spec. The code validates characters rather than hiding logic.
-
buffer+=u,lexState="identifierName"},likely benign Zero-width joiner in the identifier-escape validation branch of a lexer.Reasoning
The ZWJ literal in the identifier-escape validation is part of the spec-defined identifier character set, in the same lexer. It is a legitimate parsing detail.
-
var ID_Start = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u0671-\u06D3\u06D5\likely benign Generated Unicode ID_Start regex in an ES module build.Reasoning
This is the unminified ID_Start Unicode regex in the ESM build of the same library. The long line is only a generated-table artifact.
-
var ID_Continue = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\u05C7\u05D0likely benign Generated Unicode ID_Continue regex in an ES module build.Reasoning
This is the generated ID_Continue Unicode regex in the ES module build, the same benign table as its siblings.
-
var unicode = -
module.exports. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u0671-\ulikely benign Exported ID_Start Unicode regex table in a library source module.Reasoning
The source module exports the ID_Start regex table as a CommonJS module, which is how parser libraries ship Unicode tables. Long lines here are normal for generated data.
-
module.exports. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\likely benign Exported ID_Continue Unicode regex table in a library source module.Reasoning
The module exports the ID_Continue regex table, consistent with the dist builds. This is ordinary generated Unicode data.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&