keyv 6.1.0

Source: https://github.com/jaredwray/keyv
Tag scanned: v6.1.0
Directory: core/keyv (only this part of the repository was scanned)
Compared with: nothing (first release scanned in full)
Files: 35 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 2.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 20:05

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution core/keyv/src/json-serializer.ts:29:9

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
	return btoa(binary);
}
```
info ~~warn~~ → info by review dynamic-execution core/keyv/src/json-serializer.ts:38:17

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
	const binary = atob(value);
	const bytes = new Uint8Array(binary.length);
	for (let index = 0; index < binary.length; index++) {
```
likely benign LLM, confidence 0.90 Base64 decoding with atob into a Uint8Array inside a JSON serializer, with no execution or network activity shown.
Reasoning
The snippet shows atob used to decode a base64 string into bytes via a Uint8Array loop, which is a standard way to convert base64 to binary data in TypeScript. There is no evaluation, fetching, or dropper behavior visible; the decoded bytes are only copied into an array. The finding's message is generic and the file name suggests a serializer handling binary values, which fits this use.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jaredwray/keyv keyv && cd keyv
git checkout v6.1.0
disclude scan --severity info core/keyv