magic-string 1.4.3

Source: https://github.com/Rich-Harris/magic-string
Tag scanned: v1.4.3
Compared with: v1.4.2 (0 signals introduced since)
Files: 71 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 2.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:22

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution src/SourceMap.ts:134:58

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  toUrl(): string {
    return `data:application/json;charset=utf-8;base64,${btoa(this.toString())}`
  }
}
```
info ~~warn~~ → info by review encoding-base64 tests/MagicString/generate-map.test.ts:31:53

base64-like blob (192 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsQ0FBQyxDQUFDLENBQU8sQ0FBQyxDQUFDIn0=',
      )
```
likely benign LLM, confidence 0.95 Base64-encoded inline source map data URL in a MagicString test file.
Reasoning
The blob is a base64-encoded source map data URL (eyJ2ZXJzaW9uIjozLC... decodes to a JSON object with version 3, file, sources, sourcesContent, names, mappings). The file is a test for MagicString's generateMap/toUrl, so the encoding is the standard inline sourcemap format, not obfuscation. The raw pass is known for false positives on such blobs.
info ~~warn~~ → info by review encoding-base64 tests/MagicString/generate-map.test.ts:117:53

base64-like blob (180 bytes, compression ratio 0.91) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsR0FBRyxHQUFNLENBQUMifQ==',
      )
```
likely benign LLM, confidence 0.95 Base64-encoded inline source map data URL in a second MagicString test case.
Reasoning
Same pattern: a base64 data URL encoding a JSON source map (version 3, mappings, sources) produced by map.toUrl() and compared in a test. This is expected library test content with no execution or hidden payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/Rich-Harris/magic-string magic-string && cd magic-string
git checkout v1.4.3
disclude scan --severity info --diff v1.4.2 .