npm / keyv / 6.1.0

keyv 6.1.0

Source

https://github.com/jaredwray/keyv

Artifact scanned

keyv-6.1.0.tgz (npm tarball · 81.6 KB · SHA-256 98afbf1bea4f…)

Compared with

keyv-5.6.0.tgz (6 signals introduced since)

Files

6 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

2.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 22:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info dynamic-execution dist/index.cjs:861:9 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

   	for (const byte of bytes) binary += String.fromCharCode(byte);
   	return btoa(binary);
   }
   function base64ToBytes(value) {

2. info warn → info by review dynamic-execution dist/index.cjs:866:17 new in this release

   `atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)

   	if (buffer) return buffer.from(value, "base64");
   	const binary = atob(value);
   	const bytes = new Uint8Array(binary.length);
   	for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);

   likely benign LLM, confidence 0.90 Bundled base64 decoding helper that falls back from Buffer to atob to produce a Uint8Array.

   Reasoning

   The snippet is a standard base64-to-bytes helper: it uses Buffer when available and falls back to atob, then copies chars into a Uint8Array. The decoded bytes are not passed to eval, Function, or a process spawn. This is a common polyfill pattern in bundled libraries and the flagged step is only data conversion.

3. info long-line dist/index.d.cts:1541:1 new in this release

   line length 1190 characters (raw pass, confidence 0.50)

   export { type DeserializedData, Keyv, Keyv as default, type KeyvAny, type KeyvAnyArray, KeyvBridgeAdapter, type KeyvBridgeAdapterOptions, type KeyvBridgeStore, type KeyvCapability, type KeyvCompression, type KeyvCompressionAdapter, type KeyvCompressionCapability, type KeyvCompressionMethods, type KeyvEncryptionAdapter,

4. info long-line dist/index.d.mts:1541:1 new in this release

   line length 1190 characters (raw pass, confidence 0.50)

   export { type DeserializedData, Keyv, Keyv as default, type KeyvAny, type KeyvAnyArray, KeyvBridgeAdapter, type KeyvBridgeAdapterOptions, type KeyvBridgeStore, type KeyvCapability, type KeyvCompression, type KeyvCompressionAdapter, type KeyvCompressionCapability, type KeyvCompressionMethods, type KeyvEncryptionAdapter,

5. info dynamic-execution dist/index.mjs:857:9 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

   	for (const byte of bytes) binary += String.fromCharCode(byte);
   	return btoa(binary);
   }
   function base64ToBytes(value) {

6. info warn → info by review dynamic-execution dist/index.mjs:862:17 new in this release

   `atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)

   	if (buffer) return buffer.from(value, "base64");
   	const binary = atob(value);
   	const bytes = new Uint8Array(binary.length);
   	for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);

   likely benign LLM, confidence 0.90 ESM bundle copy of a base64-to-bytes helper using Buffer with an atob fallback.

   Reasoning

   This is the ESM build of the same base64 decoding helper, with identical logic: Buffer if present, otherwise atob into a Uint8Array. Nothing in the snippet executes or fetches the decoded data, and the pattern is typical of compiled dependencies.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o keyv-6.1.0.tgz https://registry.npmjs.org/keyv/-/keyv-6.1.0.tgz
printf '%s  %s\n' 98afbf1bea4f51cd00b79c4bb1e047ae8ae5ffe0a6f08d027fd7b26a265ecff5 keyv-6.1.0.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf keyv-6.1.0.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg