magic-string 1.4.3

Source: https://github.com/Rich-Harris/magic-string
Tag scanned: v1.4.3
Compared with: v1.4.2 (0 signals introduced since)
Files: 72 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 3.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 14:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution src/SourceMap.ts:134:58

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  toUrl(): string {
    return `data:application/json;charset=utf-8;base64,${btoa(this.toString())}`
  }
}
```
info ~~warn~~ → info by review encoding-base64 tests/MagicString/generate-map.test.ts:31:53

base64-like blob (192 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsQ0FBQyxDQUFDLENBQU8sQ0FBQyxDQUFDIn0=',
      )
```
likely benign LLM, confidence 0.97 Base64-encoded inline source map data URL used as an expected value in a MagicString test.
Reasoning
The blob is a base64-encoded source map data URL (decodes to a JSON object with version, file, sources, mappings) in a test file for a MagicString source map generator. This is the expected format for inline source maps and is a legitimate test fixture, not obfuscation. The raw pass has a higher false-positive rate, and the context clearly explains the encoding.
info ~~warn~~ → info by review encoding-base64 tests/MagicString/generate-map.test.ts:117:53

base64-like blob (180 bytes, compression ratio 0.91) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsR0FBRyxHQUFNLENBQUMifQ==',
      )
```
likely benign LLM, confidence 0.97 Base64-encoded source map data URL in a MagicString test expectation.
Reasoning
Same pattern: a base64 data URL encoding a JSON source map (version 3, sources, mappings) asserted in a MagicString map-generation test. It is a standard test fixture for source map output, with no execution or hidden payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/Rich-Harris/magic-string magic-string && cd magic-string
git checkout v1.4.3
disclude scan --severity info --diff v1.4.2 .