npm / lru-cache / 11.5.3

lru-cache 11.5.3

Source

https://github.com/isaacs/node-lru-cache

Tag scanned

v11.5.3

Compared with

v11.5.2 (0 signals introduced since)

Files

62 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 7 info

Scan time

4.9 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:58

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import benchmark/impls.js:7:17

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     if (impl.startsWith('lru-cache_')) {
       const req = require(impl)
       const LRUCache = req.LRUCache || req
       exports[impl] = max => new LRUCache({ max })

   likely benign LLM, confidence 0.93 Benchmark loader that requires an LRU cache library chosen by name.

   Reasoning

   The require specifier is the name of a benchmark implementation taken from a local list, and the code is in a benchmark harness. This is a plugin-style loader for comparing LRU cache libraries, not an attack.

2. info warn → info by review dynamic-import benchmark/impls.js:11:23

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

     } else if (impl.startsWith('mnemonist_')) {
       MnemonistLRUMap = require(impl + '/lru-map-with-delete')
       MnemonistLRUCache = require(impl + '/lru-cache-with-delete')
       exports[impl + '_obj'] = max => new MnemonistLRUCache(max)

   likely benign LLM, confidence 0.93 Benchmark loader that requires mnemonist submodules by computed path.

   Reasoning

   Requires of impl plus a fixed suffix select sub-modules of a benchmarked package. The specifier is derived from the benchmark's own impl name, consistent with a benchmark harness.

3. info warn → info by review dynamic-import benchmark/impls.js:12:25

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

       MnemonistLRUMap = require(impl + '/lru-map-with-delete')
       MnemonistLRUCache = require(impl + '/lru-cache-with-delete')
       exports[impl + '_obj'] = max => new MnemonistLRUCache(max)
       exports[impl + '_map'] = max => new MnemonistLRUMap(max)

   likely benign LLM, confidence 0.93 Benchmark loader that requires a second mnemonist submodule by computed path.

   Reasoning

   Same pattern as the adjacent finding: a computed require for a benchmark library's submodule, with no network, shell, or decoding involved.

4. info warn → info by review dynamic-import benchmark/impls.js:16:21

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     } else if (impl.startsWith('hashlru_')) {
       exports[impl] = require(impl)
     } else if (impl.startsWith('lru-fast_')) {
       const { LRUCache } = require(impl)

   likely benign LLM, confidence 0.93 Benchmark registry that requires the hashlru package by name.

   Reasoning

   Requires the library named by impl in a benchmark implementation registry. The dynamic specifier is the expected way to load several competing packages in one benchmark.

5. info warn → info by review dynamic-import benchmark/impls.js:18:26

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     } else if (impl.startsWith('lru-fast_')) {
       const { LRUCache } = require(impl)
       exports[impl] = max => new LRUCache(max)
     } else {

   likely benign LLM, confidence 0.92 Benchmark registry that requires the lru-fast package by name.

   Reasoning

   Requires the lru-fast package named by impl inside a benchmark registry. No suspicious behavior appears in the snippet.

6. info warn → info by review dynamic-import benchmark/worker.js:6:16

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

   const dir = process.env.__LRU_BENCH_DIR || __dirname
   const caches = require(dir + '/impls.js')
   const num = +process.env.N || 10_000
   const evict = num * 2

   likely benign LLM, confidence 0.80 Benchmark worker that requires impls.js from a directory set by an environment variable.

   Reasoning

   The require path comes from the __LRU_BENCH_DIR environment variable with __dirname as fallback, so it is dynamic and env-controlled. Within a benchmark worker this is a configuration convenience. Env-controlled require paths merit a note, but the code only loads the local impls.js and no payload or exfiltration is visible.

7. info identifier-low-length test/delete-while-iterating.ts:1:1

   83 of 195 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/isaacs/node-lru-cache node-lru-cache && cd node-lru-cache
git checkout v11.5.3
disclude scan --severity info --diff v11.5.2 .