npm / lru-cache / 11.5.3

lru-cache 11.5.3

Source

https://github.com/isaacs/node-lru-cache

Tag scanned

v11.5.3

Compared with

v11.5.2 (0 signals introduced since)

Files

62 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 7 info

Scan time

6.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 09:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import benchmark/impls.js:7:17

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     if (impl.startsWith('lru-cache_')) {
       const req = require(impl)
       const LRUCache = req.LRUCache || req
       exports[impl] = max => new LRUCache({ max })

   likely benign LLM, confidence 0.92 Benchmark loader that requires an LRU cache library chosen by name from a fixed list of implementations.

   Reasoning

   The require specifier is the `impl` name, which is selected from a fixed set of benchmark implementation prefixes (lru-cache_, mnemonist_, hashlru_, lru-fast_). This is the usual dynamic loading pattern in a benchmark harness comparing LRU libraries, with no sign of malicious intent.

2. info warn → info by review dynamic-import benchmark/impls.js:11:23

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

     } else if (impl.startsWith('mnemonist_')) {
       MnemonistLRUMap = require(impl + '/lru-map-with-delete')
       MnemonistLRUCache = require(impl + '/lru-cache-with-delete')
       exports[impl + '_obj'] = max => new MnemonistLRUCache(max)

   likely benign LLM, confidence 0.92 Benchmark loader that requires Mnemonist LRU submodules via a computed path.

   Reasoning

   The module paths are built from `impl` plus a fixed suffix inside a branch gated on the 'mnemonist_' prefix. This is routine benchmark code for loading sub-modules of a comparison library.

3. info warn → info by review dynamic-import benchmark/impls.js:12:25

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

       MnemonistLRUMap = require(impl + '/lru-map-with-delete')
       MnemonistLRUCache = require(impl + '/lru-cache-with-delete')
       exports[impl + '_obj'] = max => new MnemonistLRUCache(max)
       exports[impl + '_map'] = max => new MnemonistLRUMap(max)

   likely benign LLM, confidence 0.92 Second computed require of Mnemonist submodules in the benchmark loader.

   Reasoning

   Same pattern as the adjacent finding: a computed submodule path under a prefix-gated branch, used to construct benchmark cache instances. Nothing dropper-like or sensitive is involved.

4. info warn → info by review dynamic-import benchmark/impls.js:16:21

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     } else if (impl.startsWith('hashlru_')) {
       exports[impl] = require(impl)
     } else if (impl.startsWith('lru-fast_')) {
       const { LRUCache } = require(impl)

   likely benign LLM, confidence 0.92 Benchmark loader that requires the hashlru implementation by name.

   Reasoning

   `impl` is drawn from the benchmark's own implementation list and only reached inside a prefix check. This is the expected form for a benchmark that loads several competing libraries.

5. info warn → info by review dynamic-import benchmark/impls.js:18:26

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     } else if (impl.startsWith('lru-fast_')) {
       const { LRUCache } = require(impl)
       exports[impl] = max => new LRUCache(max)
     } else {

   likely benign LLM, confidence 0.92 Benchmark loader that requires the lru-fast implementation and destructures LRUCache.

   Reasoning

   `impl` is again a benchmark implementation identifier selected by prefix, and the destructured LRUCache is used to build a cache for timing. This matches a benign benchmark harness.

6. info warn → info by review dynamic-import benchmark/worker.js:6:16

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

   const dir = process.env.__LRU_BENCH_DIR || __dirname
   const caches = require(dir + '/impls.js')
   const num = +process.env.N || 10_000
   const evict = num * 2

   likely benign LLM, confidence 0.80 Benchmark worker that loads the implementations module from a directory that can be set through an environment variable.

   Reasoning

   The module directory can be overridden by the __LRU_BENCH_DIR environment variable, so the require path is partly env-controlled. In a benchmark worker this is a test-harness convenience with no evident exfiltration or execution chain. The doubt is that an env-controlled require is a generic code-loading vector, which keeps this from being near-certain.

7. info identifier-low-length test/delete-while-iterating.ts:1:1

   83 of 195 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/isaacs/node-lru-cache node-lru-cache && cd node-lru-cache
git checkout v11.5.3
disclude scan --severity info --diff v11.5.2 .