pako 3.0.3

Source: https://github.com/nodeca/pako
Artifact scanned: pako-3.0.3.tgz (npm tarball · 589.9 KB · SHA-256 50623ace3ae0…)
Compared with: pako-3.0.2.tgz (8 signals introduced since)
Files: 8 scanned, 9 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 10 info
Scan time: 4.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-27 23:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info identifier-low-length dist/browser/pako.esm.min.mjs:1:1 new in this release

1919 of 3667 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
info ~~warn~~ → info by review long-line dist/browser/pako.esm.min.mjs:1:1 new in this release

line length 45546 characters (raw pass, confidence 0.65)
```
var e=4,t=0,n=1;function r(e){let t=e.length;for(;--t>=0;)e[t]=0}var i=1,a=29,o=256,s=286,c=30,l=19,u=573,d=15,f=16,p=256,m=16,h=17,g=18,_=new Uint8Array([0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0]),v=new Uint8Array([0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13]),y=new Uint8Array(
```
likely benign LLM, confidence 0.93 Minified browser build of the pako zlib/deflate/inflate JavaScript library.
Reasoning
The raw pass flags a 45k-character line, but the snippet is ordinary minified zlib code (typed-array tables, deflate constants, reused short variable names). Minifiers emit long single lines by design, and this file is a distributed build of the pako library, so the length alone is not evidence of obfuscation or malice.
info identifier-low-length dist/browser/pako_deflate.esm.min.mjs:1:1 new in this release

2023 of 3645 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
info ~~warn~~ → info by review long-line dist/browser/pako_deflate.esm.min.mjs:1:1 new in this release

line length 26579 characters (raw pass, confidence 0.65)
```
var e=4,t=0,n=1;function r(e){let t=e.length;for(;--t>=0;)e[t]=0}var i=1,a=29,o=256,s=286,c=30,l=19,ee=573,u=15,d=16,f=256,p=16,m=17,h=18,g=new Uint8Array([0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0]),_=new Uint8Array([0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13]),te=new Uint8Arra
```
likely benign LLM, confidence 0.93 Minified pako deflate-only browser bundle with standard compression lookup tables.
Reasoning
The long line is a minified pako deflate bundle: single-letter identifiers and standard Huffman/deflate constant tables. This is the normal output of a minifier for a compression library, and the raw long-line signal has a high false-positive rate for minified code.
info identifier-low-length dist/browser/pako_inflate.esm.min.mjs:1:1 new in this release

3037 of 5546 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
info ~~warn~~ → info by review long-line dist/browser/pako_inflate.esm.min.mjs:1:1 new in this release

line length 32191 characters (raw pass, confidence 0.65)
```
var e=4,t=0,n=1;function r(e){let t=e.length;for(;--t>=0;)e[t]=0}var i=29,a=256,o=30,s=19,c=573,l=15,u=16,d=256,f=16,p=17,m=18,h=new Uint8Array([0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0]),g=new Uint8Array([0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13]);new Uint8Array([0,0,0,0,0,0
```
likely benign LLM, confidence 0.93 Minified pako inflate-only browser bundle with standard decompression tables.
Reasoning
The snippet shows minified pako inflate code with standard length and distance tables, and no execution, network, or decoding-of-payload behaviour. A single long line is typical of a minified distributed bundle, so this is a benign legitimate pattern.

info long-line dist/pako.d.ts:507:1 new in this release

line length 684 characters (raw pass, confidence 0.50)

export { Deflate, GZheader, Inflate, ZStream, Z_BLOCK, Z_BUF_ERROR, Z_DATA_ERROR, Z_DEFAULT_STRATEGY, Z_ERRNO, Z_FILTERED, Z_FINISH, Z_FIXED, Z_FULL_FLUSH, Z_HUFFMAN_ONLY, Z_MEM_ERROR, Z_NEED_DICT, Z_NO_FLUSH, Z_OK, Z_PARTIAL_FLUSH, Z_RLE, Z_STREAM_END, Z_STREAM_ERROR, Z_SYNC_FLUSH, Z_TREES, deflate, deflateRaw, gzip,

info long-line dist/pako.mjs:3630:1 new in this release

line length 977 characters (raw pass, confidence 0.50)

export { Deflate, GZheader, Inflate, ZStream, Z_BLOCK, Z_BUF_ERROR, Z_DATA_ERROR, Z_DEFAULT_STRATEGY, Z_ERRNO, Z_FILTERED, Z_FINISH, Z_FIXED, Z_FULL_FLUSH, Z_HUFFMAN_ONLY, Z_MEM_ERROR, Z_NEED_DICT, Z_NO_FLUSH, Z_OK, Z_PARTIAL_FLUSH, Z_RLE, Z_STREAM_END, Z_STREAM_ERROR, Z_SYNC_FLUSH, Z_TREES, deflate, deflateRaw, gzip,

info whitespace-anomaly dist/pako.cjs.js:8:1

file mixes tab and space indentation (3132 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
function zero$1(buf) {
	let len = buf.length;
	while (--len >= 0) buf[len] = 0;
}
```
info whitespace-anomaly dist/pako.mjs:7:1

file mixes tab and space indentation (3060 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
function zero$1(buf) {
	let len = buf.length;
	while (--len >= 0) buf[len] = 0;
}
```

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pako-3.0.3.tgz https://registry.npmjs.org/pako/-/pako-3.0.3.tgz
printf '%s  %s\n' 50623ace3ae006597034b699a643bd5295fb064eab6fcd12b6587e7292f977aa pako-3.0.3.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf pako-3.0.3.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg