npm / path-scurry / 2.0.2

path-scurry 2.0.2

Source

https://github.com/isaacs/path-scurry

Tag scanned

v2.0.2

Compared with

v2.0.1 (0 signals introduced since)

Files

16 scanned, 8 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

2.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 19:47

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution scripts/bench.sh:6:3

   command name is a variable (`$script`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

     echo ----- $script -----
     $script
   done

   likely benign LLM, confidence 0.85 A bash benchmark script loops over script names, echoes each, and executes it.

   Reasoning

   The snippet shows a loop that prints a header with $script and then runs $script as a command. This is a benchmark runner iterating over a list of scripts, which is a common legitimate pattern. The flagged variable comes from a loop over scripts the developer chose, not from attacker-controlled data or an encoded payload. The AST signal is generic dynamic execution; the surrounding file context (bench.sh) strongly suggests a benign benchmark harness. Residual doubt exists because the source of the loop list is not shown.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/isaacs/path-scurry path-scurry && cd path-scurry
git checkout v2.0.2
disclude scan --severity info --diff v2.0.1 .