npm / path-scurry / 2.0.2

path-scurry 2.0.2

Source

https://github.com/isaacs/path-scurry

Tag scanned

v2.0.2

Compared with

v2.0.1 (0 signals introduced since)

Files

16 scanned, 8 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

3.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 17:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution scripts/bench.sh:6:3

   command name is a variable (`$script`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

     echo ----- $script -----
     $script
   done

   likely benign LLM, confidence 0.80 A bash benchmark runner loop that echoes a banner and executes each script named by a loop variable.

   Reasoning

   The AST pass flags a bare `$script` used as a command name. The snippet is a benchmark runner: it echoes a separator banner with the script name, then executes the variable inside a loop. That is a common pattern for running a list of benchmark scripts. The variable is presumably populated by a loop header or the caller, which the snippet does not show. Nothing here indicates obfuscation, encoded payloads, or hidden behavior, and the file name and structure point to a developer tool rather than a dropper. The finding is a generic dynamic-execution flag on a legitimate pattern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/isaacs/path-scurry path-scurry && cd path-scurry
git checkout v2.0.2
disclude scan --severity info --diff v2.0.1 .