disclude.ionpm / playwright-core / 1.65.0-alpha-2026-10-22
playwright-core 1.65.0-alpha-2026-10-22
- Source
- https://github.com/microsoft/playwright
- Artifact scanned
playwright-core-1.65.0-alpha-2026-10-22.tgz- Compared with
playwright-core-1.65.0-alpha-2026-10-21.tgz(0 signals introduced since)- Files
- 77 scanned, 38 skipped (binary, oversized, or unrecognised)
- Signals
- 2 critical · 63 warn · 194 info
- Scan time
- 83.6 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): the 107 most severe of 170 warn and critical signals (107 with a verdict); 105 demoted to info. The rest are unreviewed.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 23:52
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
evalResult = await locator..likely benign Evaluates a caller-supplied expression in the browser page context through eval for locator evaluation.Reasoning
This evaluates a caller-provided expression inside the page context, which is the purpose of an evaluate API in browser automation. It is dangerous by design, but it is the documented function rather than a hidden dropper, and the eval runs only on expressions the caller supplies.
-
# All the scary things here are intentional has_single_argument $1 && $(printf "$browser" "$1") else $browser "$1"likely benign Shell script runs a browser command built via printf from a configured browser variable.Reasoning
This is the upstream xdg-open script, where the browser command is intentionally built from a user-supplied browser variable via printf and the comment acknowledges it. It is a known design pattern in xdg-utils, though the eval-like command substitution is a real code-execution point; the executed command comes from the configured browser, not untrusted input in normal use.
-
`;t.replaceSelection(e+e,null),u(t,-1),a=t.listSelections();for(var n=0;n<a.length;n++){var r=a[n].head.line;t.indentLine(r,null,!0),t.indentLine(r+1,null,!0)}})}function u(e,t){for(var n=[],r=e.listSelections(),i=0,a=0;a<r.length;a++){var o=r[a];o.head==e.getCursor()&&(i=a);var s=o.head.ch||t>0?{line:o.head.line,ch:o. -
`),v=d+g.length,y=g[g.length-1].length;return{from:t(v,y),to:t(v+_.length-1,_.length==1?y+_[0].length:_[_.length-1].length),match:h}}}}var u,d;String.prototype.normalize?(u=function(e){return e.normalize(`NFD`).toLowerCase()},d=function(e){return e.normalize(`NFD`)}):(u=function(e){return e.toLowerCase()},d=function(e) -
`:t==`r`?`\r`:t==`t`?` `:t==`\\`?`\\`:e})}function u(e){var t=e.match(/^\/(.*)\/([a-z]*)$/);if(t)try{e=new RegExp(t[1],t[2].indexOf(`i`)==-1?``:`i`)}catch{}else e=l(e);return(typeof e==`string`?e==``:e.test(``))&&(e=/x^/),e}function d(e,n,r){n.queryText=r,n.query=u(r),e.removeOverlay(n.overlay,i(n.query)),n.overlay=t(n -
;var m=Object.,h=Object.,g=Object.,_=Object.,v=Object.,y=., -
`+e.stack}}var Oe=Object.prototype.hasOwnProperty,ke=t.unstable_scheduleCallback,Ae=t.unstable_cancelCallback,je=t.unstable_shouldYield,Me=t.unstable_requestPaint,j=t.unstable_now,Ne=t.unstable_getCurrentPriorityLevel,Pe=t.unstable_ImmediatePriority,Fe=t.unstable_UserBlockingPriority,Ie=t.unstable_NormalPriority,Le=t.u -
`).replace(jd,``)}function Nd(e,t){return t=Md(t),Md(e)===t}function Q(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Qt(e,r):(typeof r==`number`||typeof r==`bigint`)&&t!==`body`&&Qt(e,``+r);break;case`className`:It(e,` -
`:this.value}},vt=class extends Je{constructor(...e){super(...e),this.value=``}ASCIIMatch(e){return this.value.toLowerCase()===e.toLowerCase()}toJSON(){let e=this.constructor.prototype.constructor.prototype.toJSON.call(this);return e.value=this.value,e}},yt=class extends vt{constructor(e){super(),this.tokenType=`IDENT` -
`,`\\n`)}function tn(e,t,n){if(e)for(let r of t.split(`|`)){if(r===`url`)try{let t=new URL(e[r]);return t.protocol===`data:`?t.protocol:[`about:`,`chrome:`,`edge:`].includes(t.protocol)?e[r]:t.host+t.pathname+t.search}catch{if(e[r]!==void 0)return e[r]}if(r===`timeNumber`&&e[r]!==void 0)return new Date(e[r]).toString() -
-
`).length:0;return Math.min(Math.max(5,e),20)*20},[a]),h=(0,M.jsx)(`span`,{style:{marginLeft:5},ref:d,"aria-label":e.name,children:Dr(e.name)}),g=p&&(0,M.jsx)(`a`,{style:{marginLeft:5},href:Mr(n,e),children:`download`});return!f||!p?(0,M.jsxs)(`div`,{style:{marginLeft:20},children:[h,g]}):(0,M.jsxs)(`div`,{className:k( -
`+i.gitDiff+"\n```"),t},[a,i],void 0);return e.errors.size?(0,M.jsxs)(`div`,{className:`fill`,style:{overflow:`auto`},children:[(0,M.jsx)(`span`,{style:{position:`absolute`,right:`5px`,top:`5px`,zIndex:1},children:o&&(0,M.jsx)(Pr,{prompt:o})}),[...e.errors.entries()].map(([e,i])=>{let a=`error-${r}-${e}`;return(0,M.jsx -
text&&,e.&&,}}return},),i=T.,a=T. -
,Math.-t)} -
1}).} -
`:return`\\n`;case`\r`:return`\\r`;case` `:return`\\t`;default:return`\\x`+e.charCodeAt(0).toString(16).padStart(2,`0`)}})+`"`:e}function ra(e){return!!(e.length===0||/^\s|\s$/.test(e)||/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/.test(e)||/^-/.test(e)||/[\n:](\s|$)/.test(e)||/\s#/.test(e)||/[\n\r]/.test(e)||/^[&*\],?!>|@"' -
`)}function aa(e){return` `.repeat(e)}function oa(t){let n=[{regex:/\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b/,replacement:`+`},{regex:/\b[\d,.]+[bkmBKM]+\b/,replacement:`++`},{regex:/\b\d+[hmsp]+\b/,replacement:`\\d++`},{regex:/\b[\d,.]+[hmsp]+\b/ -
`).replace(/[\u200b\u00ad]/g,``).replace(/\s\s*/g,` `)).join(`\xA0`).trim()}function Eo(e,t){let n=[...e.querySelectorAll(t)];for(let r of wo(e,e.getAttribute(`aria-owns`)))r.matches(t)&&n.push(r),n.push(...r.querySelectorAll(t));return n}function Do(e,t){let n=t===`::before`?ws:t===`::after`?Ts:Cs;if(n?.has(e))return -
)).;return } -
})`))(this,t)}async viewportRatio(e){return await new Promise(t=>{let n=new IntersectionObserver(e=>{t(e[0].intersectionRatio),n.disconnect()});n.observe(e),this.utils.builtins.requestAnimationFrame(()=>{})})}getElementBorderWidth(e){if(e.nodeType!==Node.ELEMENT_NODE||!e.ownerDocument||!e.ownerDocument.defaultVie -
e] element`;let i=t.map(e=>{let t=Uint8Array.from(atob(e.buffer),e=>e.charCodeAt(0));return new File([t],e.name,{type:e.mimeType,lastModified:e.lastModifiedMs})}),a=new DataTransfer;for(let e of i)a.items.add(e);r.files=a.files,r.dispatchEvent(new Event(`input`,{bubbles:!0,composed:!0})),r.dispatchEvent(new Event(`chan -
...`),this.createStacklessError(`"${r.name}" selector is not supported: $ resolved to $ element$:$\n`)}createStacklessError(e){let t=this._shouldPrependErrorPrefix?Error(`Error: `+e):Error(e);return this._browserName===`firefox`?(t.stack=``,t): -
`),this.installListeners(),e.utils.cacheNormalizedWhitespaces(),e.isUnderTest&&console.error(`Recorder script ready test`),e.consoleApi.install()}installListeners(){hu(this._listeners),this._listeners=[q(this.document,`click`,e=>this._onClick(e),!0),q(this.document,`auxclick`,e=>this._onClick(e),!0),q(this.docu -
`],[`r`,`\r`],[`t`,` `],[`b`,`\b`],[`f`,`\f`]]),bu=/[A-Za-z_$][\w$]*/y,xu=/-?\d+(\.\d+)?/y,Su=/[a-z]*/y;function Cu(e,t){let n=[],r=0,i=t=>{t.lastIndex=r;let n=t.exec(e)?.[0];return n&&(r+=n.length),n},a=(n,a,o=!1)=>{let s=``,c=!1;for(++r;r<e.length&&(e[r]!==n||c);){if(n==="`"&&e.startsWith("$ -
`)}};Gd.defaultYaml={explicit:!1,version:`1.2`},Gd.defaultTags={"!!":`tag:yaml.,2002:`};function Kd(e){if(/[\x00-\x19\s,[\]{}]/.test(e)){let t=`Anchor must not contain whitespace or control characters: $`;throw Error(t)}return!0}function qd(e){let t=new Set;return Id(e,{Value(e,n){n.anchor&&t.add( -
`))return wf(e,t,n,r);if(vf(a)){if(c===``)return t.forceBlockIndent=!0,wf(e,t,n,r);if(s&&c===l)return Sf(a,t)}let d=a.replace(/\n+/g,`$&\n$`);if(o){let e=e=>e.default&&e.tag!==`tag:yaml.,2002:str`&&e.test?.test(d),{compat:n,tags:r}=t.doc.schema;if(r.some(e)||n?.some(e))return Sf(a,t)}return s?d:hf(d,c,ff,_f(t,!1) -
`)&&(S=``);return g+=S+x,n.inFlow?b&&r&&r():y&&!b?g+=df(g,n.indent,l(y)):h&&i&&i(),g}function Mf(e,t){(e===`debug`||e===`warn`)&&console.warn(t)}var Nf=`<<`,Pf={identify:e=>e===Nf||typeof e==`symbol`&&e.description===Nf,default:`key`,tag:`tag:yaml.,2002:merge`,test:/^<<$/,resolve:()=>Object.assign(new $(Symbol(Nf)), -
`;return`$\n$$`}else return`$$$$$`}function Kf({indent:e,options:{commentString:t}},n,r,i){if(r&&i&&(r=r.replace(/^\n+/,``)),r){let i=uf(t(r),e);n.push(i.trimStart())}}function qf(e,t){let n=Z(t)?t.value:t;for(let r of e)if(kd(r)&&(r.key===t||r.key===n||Z(r.key)&&r.key.value===n))retur -
y`,resolve(e,t){if(typeof atob==``){let t=atob(e.replace(/[\n\r]/g,``)),n=new Uint8Array(t.length);for(let e=0;e<t.length;++e)n[e]=t.charCodeAt(e);return n}else return t(`This environment does not support reading binary tags; either Buffer or atob is required`),e},stringify({comment:e,type:t,value:n},r,i,a){if( -
`:` `)}return Ef({comment:e,type:t,value:s},r,i,a)}};function vp(e,t){if(Ad(e))for(let n=0;n<e.items.length;++n){let r=e.items[n];if(!kd(r)){if(Od(r)){r.items.length>1&&t(`Each pair must have its own sequence indicator`);let e=r.items[0]||new Hf(new $(null));if(r.commentBefore&&(e.key.commentBefore=e.key.commentBefore? -
`}var Zp=class e{constructor(e,t,n){this.commentBefore=null,this.comment=null,this.errors=[],this.warnings=[],Object.defineProperty(this,Td,{value:xd});let r=null;typeof t==``||Array.isArray(t)?r=t:n===void 0&&t&&(n=t,t=void 0);let i=Object.assign({intAsBigInt:!1,keepSourceTokens:!1,logLevel:`warn`,prettyErrors -
`),o=n+o}if(/[^ ]/.test(o)){let e=1,t=n.linePos[1];t?.line===r&&t.col>i&&(e=Math.max(1,Math.min(t.col-i,80-a)));let s=` `.repeat(a)+`^`.repeat(e);n.message+=`:\n\n$\n$\n`}};function rm(e,{flow:t,indicator:n,next:r,offset:i,onError:a,parentIndent:o,startOnNewline:s}){let c=!1,l=s,u=s,d=``,f=``,p=!1,m=!1,h=null,g=n -
`+_.comment:g.comment=_.comment);let e=new Hf(g);n.options.keepSourceTokens&&(e.srcToken=a),o.items.push(e)}}return c&&c<s&&i(c,`IMPOSSIBLE`,`Map comment trailing content`),o.range=[r.offset,s,c??s],o}function lm({composeNode:e,composeEmptyNode:t},n,r,i,a){let o=new((a?.nodeClass)??Xf)(n.schema);n.atRoot&&=!1,n.at -
`}let m=r+i.length+t.source.length;return{value:d,type:a,comment:i.comment,range:[r,m,m]}}function _m({offset:e,props:t},n,r){if(t[0].type!==`block-scalar-header`)return r(t[0],`IMPOSSIBLE`,`Block scalar header not found`),null;let{source:i}=t[0],a=i[0],o=0,s=``,c=-1;for(let t=1;t<i.length;++t){let n=i[t];if(!s&&(n===` -
`,r:`\r`,t:` `,v:`\v`,N:`⟨U+0085⟩`,_:`\xA0`,L:`\u2028`,P:`\u2029`," ":` `,'"':`"`,"/":`/`,"\\":`\\`," ":` `};function Em(e,t,n,r){let i=e.substr(t,n),a=i.length===n&&/^[0-9a-fA-F]+$/.test(i)?parseInt(i,16):NaN;try{return String.fromCodePoint(a)}catch{let i=e.substr(t-2,n+2);return r(t-2,`BAD_DQ_ESCAPE`,`Invalid escape sequen -
`)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}var Rm=class{constructor(e={}){this.doc=null,this.atDirectives=!1,this.prelude=[],this.errors=[],this.warnings=[],this.onError=(e,t,n,r)=>{let i=Im(e);r?this.warnings.push(new -
`};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.keys(e))t!==`type`&&t!==`offset`&&delete e[t];Object.assign(e,{type:n,indent:r,sou -
`,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=e,null}peek(e){ -
`?yield*this.pushCount(2):0}*pushSpaces(e){let t=this.pos-1,n;do n=this.buffer[++t];while(n===` `||e&&n===` `);let r=t-this.pos;return r>0&&(yield this.buffer.substr(this.pos,r),this.pos=t),r}*pushUntil(e){let t=this.pos,n=this.buffer[t];for(;!e(n);)n=this.buffer[++t];return yield*this.pushToIndex(t,!1)}},dh=class{cons -
`,e)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case`newline`:if(this.onKeyLine=!1,t.value){let n=`end`in t.value?t.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type===`comment`?n?.push(this.sourceToken):e.items.push({ -
`,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case`alias`:case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:return this.flowScalar(this.type);case`block-scalar-header`:return{type:`block-scalar`,offset:this.offset,indent:this.indent, -
`).map((e,n)=>{let i=r.get(n);return{text:e,box:i?t.get(i):void 0}})}var Ph=/("(?:[^"\\]|\\.)*")|(\/(?:[^/\\]|\\.)*\/)|(\[[^\]]*\])/g;function Fh(e){let t=[],n=e.match(/^(\s*- )([\w-]+)/),r=0;n&&(t.push(n[1]),t.push((0,M.jsx)(`span`,{className:`aria-mode-role`,children:n[2]},`role`)),r=n[0].length);let i=e.substring(r) -
`).map(e=>Rh.get(e)):[];for(let t of n)t.listeners.add(e);return()=>{for(let t of n)t.listeners.delete(e)}},[r]),n}function Hh(e,t){let n=Rh.get(t);return n||(n={url:void 0,thumbnails:[],listeners:new Set,started:!1},Rh.set(t,n)),n.started||(n.started=!0,Uh(n,e,t).catch(()=>{})),n}async function Uh(e,t,n){let r=await(a -
-
;var t= -
`&&(this._liveRegionLineCount++,this._liveRegionLineCount===21&&(this._liveRegion.textContent+=a.tooMuchOutput)))}_clearLiveRegion(){this._liveRegion.textContent=``,this._liveRegionLineCount=0}_handleKey(e){this._clearLiveRegion(),/\p{Control}/u.test(e)||this._charsToConsume.push(e)}_refreshRows(e,t){this._liveRegionDe -
`)}clearSelection(){this._model.clearSelection(),this._removeMouseDownListeners(),this.refresh(),this._onSelectionChange.fire()}refresh(e){this._refreshAnimationFrame||=this._coreBrowserService.window.requestAnimationFrame((()=>this._refresh())),d.isLinux&&e&&this.selectionText.length&&this._onLinuxMouseSelection.fire( -
`,e.VT=`\v`,e.FF=`\f`,e.CR=`\r`,e.SO=`⟨U+000E⟩`,e.SI=`⟨U+000F⟩`,e.DLE=`⟨U+0010⟩`,e.DC1=`⟨U+0011⟩`,e.DC2=`⟨U+0012⟩`,e.DC3=`⟨U+0013⟩`,e.DC4=`⟨U+0014⟩`,e.NAK=`⟨U+0015⟩`,e.SYN=`⟨U+0016⟩`,e.ETB=`⟨U+0017⟩`,e.CAN=`⟨U+0018⟩`,e.EM=`⟨U+0019⟩`,e.SUB=`⟨U+001A⟩`,e.ESC=`\x1B`,e.FS=`⟨U+001C⟩`,e.GS=`⟨U+001D⟩`,e.RS=`⟨U+001E⟩`,e.US=`⟨U+001F⟩`,e.SP=` `,e.DEL=`⟨U+007F⟩`}(n||(t.C0=n={})),function(e){e.PAD=`⟨U+0080⟩`,e.HOP=`⟨U+0081⟩`,e.BPH=`⟨U+0082⟩`,e.NBH=`⟨U+0083⟩`,e.IND=`⟨U+0084⟩`,e.NEL=`⟨U+0085⟩ -
`,t)}paste(e){this._core.paste(e)}refresh(e,t){this._verifyIntegers(e,t),this._core.refresh(e,t)}reset(){this._core.reset()}clearTextureAtlas(){this._core.clearTextureAtlas()}loadAddon(e){this._addonManager.loadAddon(this,e)}static get strings(){return t}_verifyIntegers(...e){for(let t of e)if(t===1/0||isNaN(t)||t%1!=0 -
;;var f=,p=,m=, -
var e=Object.,; -
`))this._appendEvent(t)}appendStacks(e){let t=JSON.parse(e),n=t.stacks.map(([e,...t])=>{let n=typeof e==`number`?D(e):e;return[this._legacyCallIdToStepId.get(n)??n,...t]}),r=O({files:t.files,stacks:n});for(let e of this._actionMap.values())e.stack=e.stack||r.get(e.callId)}actions(){return[...this._actionMap.values()]}_ -
r}=this,i=,a=Math.*4,o=,s=e-Math.*3,c=0;i=o.,c++;return c<i.?i.:i}},Sr= -
If your trace is in a local or private network, please grant permission Local Network Access.`),Error(r)}return{traceLoader:n,snapshotServer:new i(n.storage(),e=>n.resourceEntry(e))}}async function Sa(e){let t=e.request;if(t.url.startsWith(`chrome-extension://`))return fetch(t);let n=new URL(t.url),r;if(t.url.start -
;;var E=,D=,O= -
let a=i?globalThis.?Buffer.::r,o=t?this..:void 0,s=o&&n?o..:void 0;e===`stdout`?:}async -
Only changed`:``),onClick:()=>d(!u),children:[(0,z.jsx)(`span`,{className:`filter-label`,children:`Status:`}),` `,p,(0,z.jsx)(`span`,{className:`filter-label`,children:`Projects:`}),` `,m,o&&(0,z.jsx)(z.Fragment,{children:(0,z.jsx)(`span`,{className:`filter-label`,children:`Only changed`})})]}),u&&(0,z.jsxs)(z.Fragment -
!B)return;let e=;return ,},),E. -
`),l(!0)},pathSeparator:G.pathSeparator});return U(t),v(void 0),O(!0),F({value:new Set}),(async()=>{try{await B.initialize({interceptStdio:!0,watchTestDirs:!0});let{status:e,report:n}=await B.runGlobalSetup({});if(t.processGlobalReport(n),e!==`passed`)return;let r=await B.listTests({projects:G.projects,locations:G.args -
base="$(basename "$binary")" IFS=: for dir in $search; do unset IFS -
desktop="$(basename "$1")" IFS=: for dir in $search; do unset IFS -
5) "kde-open${KDE_SESSION_VERSION}" "$1" ;; 6) -
old_ifs="$IFS" IFS=: for x in $search_dirs ; do IFS="$old_ifs" -
else $browser "$1" fi -
likely benign Invokes Google Chrome Beta's binary with --version using backslash-escaped spaces in the path.
Reasoning
The backslashes escape the spaces in the macOS app bundle path, which is standard bash quoting. The command is a plain version check on Chrome Beta and hides nothing.
-
likely benign Removes a temporary Edge Beta package and runs Edge Beta with --version via an escaped path.
Reasoning
The escaped spaces in the Microsoft Edge Beta path are ordinary shell quoting. The script removes a temporary package and runs a version check, which is consistent with a reinstall helper.
-
likely benign Removes a temporary Edge Dev package and runs Edge Dev with --version via an escaped path.
Reasoning
Same pattern as the Edge Beta script: escaped spaces in an app bundle path for a version check, with a cleanup of a temporary package file. No hidden command.
-
var between, maximumallowedcodepoint, InvalidCharacterError, CSSParserToken, BadStringToken, BadURLToken, WhitespaceToken, CDOToken, CDCToken, ColonToken, SemicolonToken, CommaToken, GroupingToken, OpenCurlyToken, CloseCurlyToken, OpenSquareToken, CloseSquareToken, OpenParenToken, CloseParenToken, IncludeMatchToken, Da -
urlInCSSRegex = /url\(['"]?\/\//ig; blankSnapshotUrl = "data:text/html;base64," + ; } }); -
count = -
packageRoot = import_path8..; packageJSON = ; binPath = import_path8..; }likely benign Bundled code requires the package's own package.json via a path joined from the package root.Reasoning
The require target is built with path.join from __dirname and a fixed filename, so it is a bundler artifact reading the package's own package.json. The non-literal specifier is an artifact of bundling, not a payload.
-
const binary = Array...; return ; } -
likely benign Helper that decodes a base64 string into a Uint8Array.
Reasoning
This is a standard helper converting base64 to a typed array, the kind used for embedded assets or serialized data in browser automation libraries. The snippet shows no fetch or eval following the decode.
-
likely benign Compiles a serialized expression with new Function to check whether it is well-formed before accepting it.
Reasoning
The code wraps an expression in parentheses and compiles it with new Function only to test serializability, then throws on failure. This is a syntax-validation probe in a browser automation utility, not execution of attacker content, though the dynamic Function call merits review.
-
likely benign Second serializability check that compiles an expression with new Function and throws if it is not serializable.
Reasoning
This is the same serializability check as the earlier site, with a different catch branch that throws a clear error. It validates input shape and does not run untrusted code on its own.
-
likely benign Decodes base64 file payloads into File objects and adds them to a DataTransfer to simulate a drop.
Reasoning
The code decodes base64 file payloads into a File and adds them to a DataTransfer, which is how automation simulates file drops or uploads. It is a normal feature of browser test tooling, and the decoded data is only used to build a File object.
-
"Nexus 7":dismissed Device descriptor entry for Nexus 7 with a standard Chrome Android user-agent string.Reasoning
This is a device emulation descriptor with a long, realistic user-agent string. The raw-pass compression ratio flag is a known false positive for long, repetitive, legitimate strings.
-
"Nexus 7 landscape":dismissed Device descriptor for Nexus 7 landscape, reusing the same user-agent string.Reasoning
Same device descriptor data as the Nexus 7 entry, a legitimate Chrome Android user-agent string. The raw compression heuristic fires on ordinary literal text.
-
linkTarget = .; const browsersJSON = ; const descriptors = ;likely benign Loads a browsers.json descriptor file from a path resolved through a filesystem link target.Reasoning
The require path is joined from a link target read from disk, which the bundler uses to locate a browsers.json registry. It loads local configuration data, a normal pattern for browser install management.
-
}; registry = ; } });likely benign Constructs a browser registry from the package's own browsers.json file.Reasoning
The module requires browsers.json from the package root to build a registry. The non-literal path is a fixed filename joined to a package directory, which is standard bundled configuration loading.
-
likely benign Requires a user-specified init-page module and calls its default export with the page object.
Reasoning
This loads a user-supplied init script path and calls its default export with the page. That is a documented-style extension hook in automation tooling. The risk depends on who controls initPage, which the snippet does not show, so it stays mildly open.
-
evalResult = await tab..likely benign An evaluate helper that evaluates a user-supplied expression in the browser page context.Reasoning
The eval wraps a caller-supplied expression in parentheses and runs it inside page.evaluate. That is the intended behaviour of a browser-automation evaluate tool, which runs in the page context the operator controls. It is still non-literal eval, so it warrants a note, but nothing here is hidden or fetched from a remote source.
-
var z33, elementTargetDescription2, numberArg, stringArrayArg, open3, attach, close2, detach, goto, goBack2, goForward2, reload2, pressKey, type2, keydown2, keyup2, mouseMove2, mouseDown2, mouseUp2, mouseWheel2, click2, doubleClick, drag2, drop2, fill, hover2, select, fileUpload, check2, uncheck2, snapshot2, find2, gen -
continue; const packageJSON2 = ; const version3 = packageJSON2.; dirToVersion.;likely benign Reads the version from a browser's package.json via a computed path.Reasoning
The require resolves package.json relative to a browser reference directory to read its version field. This is a routine version lookup with no decoding, network access or execution of fetched content.
-
const clientInfo = ; const help = ; const argv = process.argv.; const boolean = ;likely benign Loads the CLI help JSON file from the package's tools directory.Reasoning
The require loads a bundled help.json file under the package's own tools directory. This is a static data file and a common bundler pattern.
-
likely benign Dynamically loads a Playwright library module to connect to a browser of a given version.
Reasoning
The require loads a Playwright library module named by a descriptor so that the matching browser version can connect. This is a dynamic module load driven by configuration, not obfuscation, though the non-literal path is worth a note.
-
program4..... -
program4....... -
program4.... -
const packageRoot = import_path..; const packageJSON = ; const binPath = import_path..;likely benign Loads the package's own package.json for metadata.Reasoning
The require loads the package's own package.json from a path built from __dirname. This is standard package metadata access.
-
var packageRoot = import_path..; var packageJSON = ; var binPath = import_path..;likely benign Loads the package's own package.json for metadata.Reasoning
The require loads the package's own package.json from a path built from the package root. This is standard metadata access, the same pattern as the other package.json reads.
-
const clientInfo = ; const help = ; const argv = process.argv.; const boolean = ;likely benign Loads the CLI help JSON file via a libPath helper.Reasoning
This is the same static help.json load as the bundled copy, resolved through libPath. It only reads CLI option data.
-
-
}likely benign Base64-decodes a string into a byte array inside a bundled utility.Reasoning
The atob call is a fallback branch in a base64-to-bytes helper that copies the decoded data into a Uint8Array. Base64 decoding of data is a common, legitimate pattern in bundled libraries. No fetch or eval of the decoded result is visible in the snippet.
-
s += String.; str = ; } -
module2.. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u06likely benign A generated Unicode ID_Start regex table on a very long line.Reasoning
The long line is a generated Unicode ID_Start character-class regex from a standard identifier-table library. Long generated tables are expected in bundles and are not obfuscation.
-
module2.. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\ulikely benign A generated Unicode ID_Continue regex table on a very long line.Reasoning
The long line is a generated Unicode ID_Continue regex table, the companion of the ID_Start table. It is a standard data table in a bundled library.
-
numbers: -
TUVWXYZ^_`abcdefghijklmnopqrstuvwxyz{|}~\u2302\xC7\xFC\xE9\xE2\xE4\xE0\xE5\xE7\xEA\xEB\xE8\xEF\xEE\xEC\xC4\xC5\xC9\xE6\xC6\xF4\xF6\xF2\xFB\xF9\xFF\xD6\xDC\xA2\xA3\xA5\u20A7\u0192\xE1\xED\xF3\xFA\xF1\xD1\xAA\xBA\xBF\u2310\xAC\xBD\xBC\xA1\xAB\xBB\u2591\u2592\u2593\u2502\u2524\u2561\u2562\u2556\u2555\u2563\u2551\u2557likely benign A CP437 character-to-code-point lookup table written as hex escapes.Reasoning
The sequence is a code-page 437 character map written as \x escapes. Lookup tables like this are common in terminal and encoding libraries. The escapes are a literal table, not a hidden payload.
-
TUVWXYZ^_`abcdefghijklmnopqrstuvwxyz{|}~\u2302\xC7\xFC\xE9\xE2\xE4\xE0\xE5\xE7\xEA\xEB\xE8\xEF\xEE\xEC\xC4\xC5\xC9\xE6\xC6\xF4\xF6\xF2\xFB\xF9\xFF\xD6\xDC\xA2\xA3\xA5\u20A7\u0192\xE1\xED\xF3\xFA\xF1\xD1\xAA\xBA\xBF\u2310\xAC\xBD\xBC\xA1\xAB\xBB\u2591\u2592\u2593\u2502\u2524\u2561\u2562\u2556\u2555\u2563\u2551\u2557likely benign A duplicate CP437 character lookup table written as hex escapes.Reasoning
This is the same CP437 character table as the other finding, duplicated in another section of the bundle. It is a static encoding table with no execution.
-
sourceCode = this...; const makeValidate = ; const validate2 = ; this..;likely benign Ajv-style JSON schema compiler creating a validator via new Function from generated source.Reasoning
This is the ajv schema compiler's standard code generation: it builds a validator function from generated source. It is a known library pattern rather than malicious, but Function() with generated code is still dynamic execution, so it is not fully benign for a supply-chain scan.
-
"uri-reference": /^? -
ipv6: /^ -
var URI = /^ -
sourceCode = this...; const makeValidate = ; const validate2 = ; this..;likely benign Duplicate ajv validator compilation via new Function in a second bundled copy.Reasoning
Same ajv code generation pattern duplicated in another bundled copy; the snippet is identical and consistent with a validator compiler.
-
const reversed = Object. -
var ambiguousRanges =likely benign Long data-table line of Unicode ambiguous-width ranges in a bundled utility.Reasoning
A long line holding a constant array of East Asian ambiguous-width code point ranges is typical of a bundled Unicode width table (e.g. wcwidth/string-width data). Minified or data-heavy lines are expected here.
-
var wideRanges = -
likely benign Helper converting base64 to a byte array via atob.
Reasoning
A standard base64-to-Uint8Array helper using atob for ordinary binary decoding. The finding is a generic atob flag with no execution sink in the snippet.
-
} return ; } -
likely benign Base64 validity check using atob within try/catch.
Reasoning
atob used inside a try/catch purely to validate base64 input; no decoded content is executed.
-
return false; const parsedHeader = JSON.; return false;likely benign JWT header decoding with atob and JSON.parse.Reasoning
Decodes a JWT header with atob and JSON.parse to check the typ claim, a standard JWT parsing step; the decoded data is parsed as data, not executed.
-
var ipv6Regex = /^ -
var ipv6CidrRegex = /^ -
const base643 = header...; const decoded = JSON.; return false;likely benign base64url JWT payload decoding and JSON parsing.Reasoning
Standard base64url JWT segment decoding followed by JSON.parse; data only, no execution.
-
likely benign Base64 validation check via atob in try/catch.
Reasoning
atob inside try/catch used only to test whether a string is valid base64.
-
ipv6Cidr: /^ -
, , this. = 0, this. = 1, this. = 2, , , , , , , __privateA -
_readyState = /* @__PURE__ */ , _url2 = /* @__PURE__ */ , _redirectUrl = /* @__PURE__ */ , _withCredentials = /* @__PURE__ */ , _fetch = /* @__PURE__ */ , _reconnectInterval = /* @__PURE__ */ , _reconnectTimer = /* @__PURE__ */ , -
const buffer = ..; return ...; } -
} const credentials = ; headers.; } -
;var n=likely benign Minified CodeMirror library bundle line.Reasoning
Minified CodeMirror editor bundle from Vite; long lines are normal for minified production JavaScript.
-
tion var -
Height>2&&!)}var n=He?:;return n.,n}var We; -
n We;var t=,n=.,r=.;return ,!n||n.==n.?!1:We=r.-n.<3}var Ke=` -
`,t);i==-1&&(i=e.length);var a=e.slice(t,e.charAt(i-1)==`\r`?i-1:i),o=a.indexOf(`\r`);o==-1?(n.push(a),t=i+1):(n.push(a.slice(0,o)),t+=o+1)}return n},qe=window.getSelection?function(e){try{return e.selectionStart!=e.selectionEnd}catch{return!1}}:function(e){var t;try{t=e.ownerDocument.selection.createRange()}catch{}retlikely benign Minified CodeMirror editor code line.Reasoning
Minified CodeMirror source with DOM and selection logic; the long line is a product of minification in a legitimate build asset.
-
`?(_=f.appendChild(k(`span`,m[0]==`\r`?`␍`:``,`cm-invalidchar`)),_.setAttribute(`cm-text`,m[0]),e.col+=1):(_=e.cm.options.specialCharPlaceholder(m[0]),_.setAttribute(`cm-text`,m[0]),o&&s<9?f.appendChild(k(`span`,[_])):f.appendChild(_),e.col+=1);e.map.push(e.pos,e.pos+1,_),e.pos++}}if(e.trailingSpace=l.charCodeAt(tlikely benign Minified CodeMirror rendering code line.Reasoning
Minified CodeMirror rendering code; long lines are typical of Vite-built assets with no suspicious payload.
-
height: `+(r-t)+`px`))}function d(t,n,r){var a=K(i,t),o=a.text.length,d,f;function p(n,r){return wr(e,J(t,n),`div`,a,r)}function m(t,n,r){var i=Ar(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==`after`?i.begin:i.end-(/\s/.test(a.text.charAt(i.end-1))?2:1),o)[o]}var h=H(a,i.likely benign Minified CodeMirror layout code line.Reasoning
Minified CodeMirror measurement code; the long-line flag reflects minification only.
-
ht)&&,i!=null&&!h) -
left: `+t.left+`px; width: `+Math.max(2,t.right-t.left)+`px;`);e.display.lineSpace.appendChild(o),o.scrollIntoView(i),e.display.lineSpace.removeChild(o)}}}function ui(e,t,n,r){r??=0;var i;!e.options.lineWrapping&&t==n&&(n=t.sticky==`before`?J(t.line,t.ch+1,`before`):t,t=t.ch?J(t.line,t.sticky==likely benign Minified CodeMirror library code with a very long line.Reasoning
Long-line signal in a minified CodeMirror editor bundle. The snippet is ordinary editor logic (cursor, selection and DOM handling) written with minifier-style backtick strings. Raw long-line hits in minified vendor JavaScript are expected and carry no malicious signal.
-
`},setDirection:Vi(function(e){e!=`rtl`&&(e=`ltr`),e!=this.direction&&(this.direction=e,this.iter(function(e){return e.order=null}),this.cm&&Ea(this.cm))})}),ko.prototype.eachLine=ko.prototype.iter;var Ao=0;function jo(e){var t=this;if(Po(t),!(G(t,e)||Zn(t.display,e))){Fe(e),o&&(Ao=+new Date);var n=Hr(t,e,!0),r=e.dataTlikely benign Minified CodeMirror text-direction and iteration logic.Reasoning
The snippet is CodeMirror's bidi-direction and line-iteration code, minified onto one line. No encoded payloads, dynamic execution or network activity appear. The finding is a formatting artifact of minification.
-
`,`start`)},toggleOverwrite:function(e){return e.toggleOverwrite()}};function is(e,t){var n=K(e.doc,t),r=on(n);return r!=n&&(t=q(r)),ts(!0,e,r,t,1)}function as(e,t){var n=K(e.doc,t),r=sn(n);return r!=n&&(t=q(r)),ts(!0,e,n,t,-1)}function os(e,t){var n=is(e,t.line),r=K(e.doc,n.line),i=H(r,e.doc.direction);if(!i||i[0].levlikely benign Minified CodeMirror cursor-movement helpers.Reasoning
The snippet shows CodeMirror cursor movement and bidi helpers in minified form. It contains no decoding, eval or process spawning. The long line is only a product of minification.
-
`)&&(m=h=J(m.line,0)));var g={from:m,to:h,text:l?l[f%l.length]:c,origin:i||(s?`paste`:e.state.cutIncoming>o?`cut`:`+input`)};ro(e.doc,g),In(e,`inputRead`,e,g)}t&&!s&&Xs(e,t),mi(e),e.curOp.updateInput<2&&(e.curOp.updateInput=d),e.curOp.typing=!0,e.state.pasteIncoming=e.state.cutIncoming=-1}function Ys(e,t){var n=e.clipblikely benign Minified CodeMirror input and paste handling.Reasoning
The snippet is CodeMirror paste and input handling, compressed onto one line. It only manipulates editor state and does not reach outside the editor. The signal reflects minification.
-
`);var l=ee(F(i));ne(c),setTimeout(function(){r.display.lineSpace.removeChild(s),l.focus(),l==i&&n.showPrimarySelection()},50)}}U(i,`copy`,o),U(i,`cut`,o)},$.prototype.screenReaderLabelChanged=function(e){e?this.div.setAttribute(`aria-label`,e):this.div.removeAttribute(`aria-label`)},$.prototype.prepareSelection=functilikely benign Minified CodeMirror clipboard and selection code.Reasoning
The snippet is CodeMirror clipboard and selection code in minified form, using standard DOM event hooks. Nothing in it is hidden, encoded or executed dynamically. The long line is expected for a minified bundle.
-
`),ne(i))}else return;e.type==`cut`&&(r.state.cutIncoming=+new Date)}}U(i,`cut`,a),U(i,`copy`,a),U(e.scroller,`paste`,function(t){if(!(Zn(e,t)||G(r,t))){if(!i.dispatchEvent){r.state.pasteIncoming=+new Date,n.focus();return}var a=new Event(`paste`);a.clipboardData=t.clipboardData,i.dispatchEvent(a)}}),U(e.lineSpace,`sellikely benign Minified CodeMirror copy, cut and paste event wiring.Reasoning
The snippet is CodeMirror copy, cut and paste event wiring. The event handlers only forward to editor-internal elements and make no outbound requests. The finding comes from minification.
-
r a=i.;return this.,this..}++c;return -
outline: none; border-width: 0; outline: none; overflow: hidden; opacity: .05; filter: ;`;var m;c&&(m=i.ownerDocument.defaultView.scrollY),r.input.focus(),c&&i.ownerDocument.defaultView.scrollTo(null,m),r.input.reset(),n.somethingSelected()||(i.value=t.prevInput=` `),t.contextMenuPending=g,r.selFolikely benign Minified CodeMirror hidden-input and context-menu handling.Reasoning
The snippet is CodeMirror's hidden textarea and context-menu handling, with CSS for an offscreen input. This is a standard technique for capturing editor input. It is minified vendor code, and the length alone is not suspicious.
-
t!=null)} -
value=`⇚`,i.=a,t.=e?``:`⟨U+200B⟩`,i.=1,i.=a.,r.=n..}} -
art==0&&i.>0&&t.==`⟨U+200B⟩`?:e++<10?r.=:};r.=}}},lc. -
`;t.replaceSelection(e+e,null),u(t,-1),a=t.listSelections();for(var n=0;n<a.length;n++){var r=a[n].head.line;t.indentLine(r,null,!0),t.indentLine(r+1,null,!0)}})}function u(e,t){for(var n=[],r=e.listSelections(),i=0,a=0;a<r.length;a++){var o=r[a];o.head==e.getCursor()&&(i=a);var s=o.head.ch||t>0?{line:o.head.line,ch:o.likely benign Minified CodeMirror indentation and selection logic.Reasoning
The snippet is CodeMirror's indentation and selection-replacement code. It uses only editor APIs and performs no dynamic execution or network activity. The long line comes from minification.
-
`),v=d+g.length,y=g[g.length-1].length;return{from:t(v,y),to:t(v+_.length-1,_.length==1?y+_[0].length:_[_.length-1].length),match:h}}}}var u,d;String.prototype.normalize?(u=function(e){return e.normalize(`NFD`).toLowerCase()},d=function(e){return e.normalize(`NFD`)}):(u=function(e){return e.toLowerCase()},d=function(e)likely benign Minified CodeMirror search and Unicode normalization logic.Reasoning
The snippet is CodeMirror search-match code using Unicode normalization and lowercasing. It is legitimate text processing and carries no malicious indicators. The long line is the product of minification.
-
`:t==`r`?`\r`:t==`t`?` `:t==`\\`?`\\`:e})}function u(e){var t=e.match(/^\/(.*)\/([a-z]*)$/);if(t)try{e=new RegExp(t[1],t[2].indexOf(`i`)==-1?``:`i`)}catch{}else e=l(e);return(typeof e==`string`?e==``:e.test(``))&&(e=/x^/),e}function d(e,n,r){n.queryText=r,n.query=u(r),e.removeOverlay(n.overlay,i(n.query)),n.overlay=t(nlikely benign Minified CodeMirror search and replace query handling.Reasoning
The snippet is CodeMirror search and replace code that builds regular expressions from query text. This is ordinary editor functionality. The long line is expected from a minified bundle.
-
var e=Object.,t=Object.,n=Object.,r=Object.,i=Object.,a=.,,likely benign Minified Vite/Rollup bundle preamble with module interop helpers.Reasoning
The snippet is a minified module-loader preamble (Object.create/defineProperty/getOwnPropertyDescriptor helpers and a lazy-init wrapper), typical of a bundler output. Long lines alone are expected for minified bundles, and nothing here is obfuscated for hiding purpose.
-
`+e.stack}}var _e=Object.prototype.hasOwnProperty,ve=t.unstable_scheduleCallback,ye=t.unstable_cancelCallback,be=t.unstable_shouldYield,xe=t.unstable_requestPaint,Se=t.unstable_now,Ce=t.unstable_getCurrentPriorityLevel,we=t.unstable_ImmediatePriority,Te=t.unstable_UserBlockingPriority,Ee=t.unstable_NormalPriority,De=t.likely benign Minified React scheduler and DOM renderer code in a dashboard bundle.Reasoning
The snippet is minified React DOM scheduler and renderer code (unstable_scheduleCallback, hasOwnProperty, priority constants). Its length comes from bundling and minification of a standard UI library.
-
`).replace(kd,``)}function jd(e,t){return t=Ad(t),Ad(e)===t}function Md(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Ht(e,r):(typeof r==`number`||typeof r==`bigint`)&&t!==`body`&&Ht(e,``+r);break;case`className`:Et(e,`likely benign Minified React DOM attribute-handling code in a dashboard bundle.Reasoning
The snippet is minified React DOM property-handling logic (children, className, tabIndex switch cases). This is ordinary framework code, and the long line is a bundling artifact.
-
n`){e.setAttribute(n,`javascript:throw -
r}=this,i=,a=Math.*4,o=,s=e-Math.*3,c=0;i=o.,c++;return c<i.?i.:i}},$i=likely benign Base64 decoding helper that converts embedded data into a byte array.Reasoning
The atob call sits inside a Uint8Array-based blob/zip-style reader that slices base64 data into bytes. This is a standard data-decoding routine for embedded report data, not a dropper or eval of fetched code.
-
.;r.&&}},ea= -
=:t.+=r)}},ea=,ta -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),Mo=jo.length==256;function No(e){if(Mo){let t=``;for(let n=0;n<e.length;n++)t+=jo[e[n]];return t}else return new TextDecoder().decode(e)}function Po(e,t){return t&&t.trim().toLowerCase()==`cp… -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),Mo=jo.length==256;function No(e){if(Mo){let t=``;for(let n=0;n<e.length;n++)t+=jo[e[n]];return t}else return new TextDecoder().decode(e)}function Po(e,t){return t&&t.trim().toLowerCase()==`cp… -
var e=Object.,t=Object.,n=Object.,r=Object.,i=Object.,a=.,,likely benign Minified bundle preamble in an HTML report script.Reasoning
The snippet is the same minified bundle preamble of module helpers seen in the dashboard bundle, and a long line is expected from minification.
-
r}=this,i=,a=Math.*4,o=,s=e-Math.*3,c=0;i=o.,c++;return c<i.?i.:i}},lr=likely benign Base64 decoding helper for embedded report data.Reasoning
This atob call is in the same byte-array blob reader as the dashboard bundle. It decodes embedded report data into a Uint8Array and does not execute the result.
-
.;r.&&}},ur= -
=:t.+=r)}},ur=,dr -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),Vr=Br.length==256;function Hr(e){if(Vr){let t=``;for(let n=0;n<e.length;n++)t+=Br[e[n]];return t}else return new TextDecoder().decode(e)}function Ur(e,t){return t&&t.trim().toLowerCase()==`cp… -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),Vr=Br.length==256;function Hr(e){if(Vr){let t=``;for(let n=0;n<e.length;n++)t+=Br[e[n]];return t}else return new TextDecoder().decode(e)}function Ur(e,t){return t&&t.trim().toLowerCase()==`cp… -
`+e.stack}}var xe=Object.prototype.hasOwnProperty,Se=t.unstable_scheduleCallback,Ce=t.unstable_cancelCallback,we=t.unstable_shouldYield,Te=t.unstable_requestPaint,Ee=t.unstable_now,De=t.unstable_getCurrentPriorityLevel,Oe=t.unstable_ImmediatePriority,ke=t.unstable_UserBlockingPriority,Ae=t.unstable_NormalPriority,je=t.likely benign Minified React scheduler and renderer code in an HTML report.Reasoning
The snippet is minified React DOM scheduler and renderer setup, the same framework code as in the dashboard bundle.
-
`).replace(Ad,``)}function Md(e,t){return t=jd(t),jd(e)===t}function $(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Kt(e,r):(typeof r==`number`||typeof r==`bigint`)&&t!==`body`&&Kt(e,``+r);break;case`className`:At(e,`likely benign Minified React DOM property-handling code in an HTML report.Reasoning
The snippet is minified React DOM attribute and property handling. Long lines are a normal result of bundling.
-
)};return e=r,r}var ua=//g; -
likely benign Minified React diff-viewer component with hooks and inline styles.
Reasoning
The snippet is a React component with useState/useEffect hooks and CSS-in-JS style strings, a normal UI diff-viewer component. Its length is due to minification.
-
className:`screenshot`,src:`data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAYgAAADqCAYAAAC4CNLDAAAMa2lDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnluSkJDQAqFICb0J0quUEFoEAamCjZAEEkqMCUHFhqio4NpFFCu6KqLoWgBZVMReFsXeFwsqK+tiQVFU3oQEdN1Xvne+b+7898yZ/5Q7c+8dADR7uRJJLqoFQJ44XxofEcIcm5rGJHUAMjABVOAMSFyeTMKKi4sGUAb7v8v7mwBR9NecFFz/HP+voslikely benign Embedded base64 PNG screenshot used as an image source in the HTML report.Reasoning
The base64 blob is a PNG data URI (iVBORw0KGgo header) used as an img src for a screenshot in a test report. This is ordinary embedded image data, not a payload.
-
`)[0];if(!(!n.includes(`toHaveScreenshot`)&&!n.includes(`toMatchSnapshot`)))return t.find(t=>e.includes(t.name))}function rs(e,t){return(e.subtitle?`$ $`:e.title).toLowerCase().includes(t.toLowerCase())}function is(e,t){return e.steps.some(e=>rs(e,t)||is(e,t))}function as(e,t){let n=e.toLowerCase()likely benign Minified report-rendering JavaScript with a very long line.Reasoning
Raw-pass long-line signal on a minified bundle fragment (a Playwright-style HTML report helper). Long lines in minified JS are normal, and the visible code is ordinary string and function logic with no encoded payload, dynamic execution or process spawning.
-
;var n=likely benign Minified, vendored CodeMirror editor module.Reasoning
Raw long-line finding in a build-generated bundle that wraps the CodeMirror editor library. The code is the familiar UMD wrapper and editor internals, with no sign of obfuscated payloads or malicious behaviour in the snippet.
-
tion var -
Height>2&&!)}var n=He?:;return n.,n}var We; -
n We;var t=,n=.,r=.;return ,!n||n.==n.?!1:We=r.-n.<3}var Ke=` -
`,t);i==-1&&(i=e.length);var a=e.slice(t,e.charAt(i-1)==`\r`?i-1:i),o=a.indexOf(`\r`);o==-1?(n.push(a),t=i+1):(n.push(a.slice(0,o)),t+=o+1)}return n},qe=window.getSelection?function(e){try{return e.selectionStart!=e.selectionEnd}catch{return!1}}:function(e){var t;try{t=e.ownerDocument.selection.createRange()}catch{}retlikely benign Minified CodeMirror text-handling code.Reasoning
Same vendored CodeMirror bundle. The snippet is DOM and text-splitting utility code typical of the editor, and the long line is a minification artifact.
-
`?(_=f.appendChild(k(`span`,m[0]==`\r`?`␍`:``,`cm-invalidchar`)),_.setAttribute(`cm-text`,m[0]),e.col+=1):(_=e.cm.options.specialCharPlaceholder(m[0]),_.setAttribute(`cm-text`,m[0]),o&&s<9?f.appendChild(k(`span`,[_])):f.appendChild(_),e.col+=1);e.map.push(e.pos,e.pos+1,_),e.pos++}}if(e.trailingSpace=l.charCodeAt(tlikely benign Minified CodeMirror rendering code for invalid characters.Reasoning
Rendering code from the vendored CodeMirror bundle that creates spans for special characters. It is normal editor logic, and the length comes from minification.
-
height: `+(r-t)+`px`))}function d(t,n,r){var a=K(i,t),o=a.text.length,d,f;function p(n,r){return wr(e,J(t,n),`div`,a,r)}function m(t,n,r){var i=Ar(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==`after`?i.begin:i.end-(/\s/.test(a.text.charAt(i.end-1))?2:1),o)[o]}var h=H(a,i.likely benign Minified CodeMirror layout and measurement code.Reasoning
Snippet shows layout and cursor-measurement code inside the vendored CodeMirror bundle. Nothing suggests obfuscation beyond minification.
-
ht)&&,i!=null&&!h) -
left: `+t.left+`px; width: `+Math.max(2,t.right-t.left)+`px;`);e.display.lineSpace.appendChild(o),o.scrollIntoView(i),e.display.lineSpace.removeChild(o)}}}function ui(e,t,n,r){r??=0;var i;!e.options.lineWrapping&&t==n&&(n=t.sticky==`before`?J(t.line,t.ch+1,`before`):t,t=t.ch?J(t.line,t.sticky==likely benign Minified CodeMirror cursor and scrolling logic.Reasoning
A very long line in the vendored CodeMirror bundle, containing scroll and coordinate logic for the editor. This is standard minified output with no malicious indicators.
-
`},setDirection:Vi(function(e){e!=`rtl`&&(e=`ltr`),e!=this.direction&&(this.direction=e,this.iter(function(e){return e.order=null}),this.cm&&Ea(this.cm))})}),ko.prototype.eachLine=ko.prototype.iter;var Ao=0;function jo(e){var t=this;if(Po(t),!(G(t,e)||Zn(t.display,e))){Fe(e),o&&(Ao=+new Date);var n=Hr(t,e,!0),r=e.dataTlikely benign Minified CodeMirror document and text-direction API.Reasoning
Snippet is CodeMirror document and direction API code. It is a plain minified library fragment with nothing suspicious.
-
`,`start`)},toggleOverwrite:function(e){return e.toggleOverwrite()}};function is(e,t){var n=K(e.doc,t),r=on(n);return r!=n&&(t=q(r)),ts(!0,e,r,t,1)}function as(e,t){var n=K(e.doc,t),r=sn(n);return r!=n&&(t=q(r)),ts(!0,e,n,t,-1)}function os(e,t){var n=is(e,t.line),r=K(e.doc,n.line),i=H(r,e.doc.direction);if(!i||i[0].levlikely benign Minified CodeMirror cursor-movement commands.Reasoning
Vendored CodeMirror bundle code for cursor movement and keymap commands. The long line is a minification artifact and there is no encoding or dynamic execution.
-
`)&&(m=h=J(m.line,0)));var g={from:m,to:h,text:l?l[f%l.length]:c,origin:i||(s?`paste`:e.state.cutIncoming>o?`cut`:`+input`)};ro(e.doc,g),In(e,`inputRead`,e,g)}t&&!s&&Xs(e,t),mi(e),e.curOp.updateInput<2&&(e.curOp.updateInput=d),e.curOp.typing=!0,e.state.pasteIncoming=e.state.cutIncoming=-1}function Ys(e,t){var n=e.clipblikely benign Minified CodeMirror input and paste handling.Reasoning
Snippet is clipboard and input handling from the vendored CodeMirror library. It is ordinary editor code, and the length is due to minification.
-
`);var l=ee(F(i));ne(c),setTimeout(function(){r.display.lineSpace.removeChild(s),l.focus(),l==i&&n.showPrimarySelection()},50)}}U(i,`copy`,o),U(i,`cut`,o)},$.prototype.screenReaderLabelChanged=function(e){e?this.div.setAttribute(`aria-label`,e):this.div.removeAttribute(`aria-label`)},$.prototype.prepareSelection=functilikely benign Minified CodeMirror copy and cut handling.Reasoning
Clipboard and selection code from the CodeMirror bundle. It uses standard DOM APIs for copy and cut, with no exfiltration or hidden behaviour visible.
-
`),ne(i))}else return;e.type==`cut`&&(r.state.cutIncoming=+new Date)}}U(i,`cut`,a),U(i,`copy`,a),U(e.scroller,`paste`,function(t){if(!(Zn(e,t)||G(r,t))){if(!i.dispatchEvent){r.state.pasteIncoming=+new Date,n.focus();return}var a=new Event(`paste`);a.clipboardData=t.clipboardData,i.dispatchEvent(a)}}),U(e.lineSpace,`sellikely benign Minified CodeMirror clipboard event-handling code with a long line.Reasoning
Raw-pass long-line flag on a minified CodeMirror clipboard handler. Minified bundles routinely have long lines, and the snippet is ordinary editor event wiring (cut, copy, paste) with no decoding or dynamic execution.
-
r a=i.;return this.,this..}++c;return -
outline: none; border-width: 0; outline: none; overflow: hidden; opacity: .05; filter: ;`;var m;c&&(m=i.ownerDocument.defaultView.scrollY),r.input.focus(),c&&i.ownerDocument.defaultView.scrollTo(null,m),r.input.reset(),n.somethingSelected()||(i.value=t.prevInput=` `),t.contextMenuPending=g,r.selFolikely benign Minified CodeMirror input and context-menu handling code on a very long line.Reasoning
A 121k-character line is typical of a minified bundle. The snippet is CodeMirror's hidden textarea and focus/selection handling for input, which is standard editor logic.
-
t!=null)} -
value=`⇚`,i.=a,t.=e?``:`⟨U+200B⟩`,i.=1,i.=a.,r.=n..}} -
art==0&&i.>0&&t.==`⟨U+200B⟩`?:e++<10?r.=:};r.=}}},lc. -
`;t.replaceSelection(e+e,null),u(t,-1),a=t.listSelections();for(var n=0;n<a.length;n++){var r=a[n].head.line;t.indentLine(r,null,!0),t.indentLine(r+1,null,!0)}})}function u(e,t){for(var n=[],r=e.listSelections(),i=0,a=0;a<r.length;a++){var o=r[a];o.head==e.getCursor()&&(i=a);var s=o.head.ch||t>0?{line:o.head.line,ch:o.likely benign Minified CodeMirror indentation and selection helper code.Reasoning
Long minified line from a bundled CodeMirror addon. The visible content is indentation and selection logic with no obfuscation or malicious behaviour.
-
`),v=d+g.length,y=g[g.length-1].length;return{from:t(v,y),to:t(v+_.length-1,_.length==1?y+_[0].length:_[_.length-1].length),match:h}}}}var u,d;String.prototype.normalize?(u=function(e){return e.normalize(`NFD`).toLowerCase()},d=function(e){return e.normalize(`NFD`)}):(u=function(e){return e.toLowerCase()},d=function(e)likely benign Minified CodeMirror search and string-normalisation code.Reasoning
Minified CodeMirror search code that normalises strings with String.prototype.normalize and toLowerCase for matching. This is a legitimate text-search pattern.
-
`:t==`r`?`\r`:t==`t`?` `:t==`\\`?`\\`:e})}function u(e){var t=e.match(/^\/(.*)\/([a-z]*)$/);if(t)try{e=new RegExp(t[1],t[2].indexOf(`i`)==-1?``:`i`)}catch{}else e=l(e);return(typeof e==`string`?e==``:e.test(``))&&(e=/x^/),e}function d(e,n,r){n.queryText=r,n.query=u(r),e.removeOverlay(n.overlay,i(n.query)),n.overlay=t(nlikely benign Minified CodeMirror search/replace helper that builds regular expressions from user input.Reasoning
Minified CodeMirror search/replace code that builds a RegExp from a user query, which is expected for an editor's find feature. It is not an encoded payload or a dropper.
-
var e=Object.,t=Object.,n=Object.,r=Object.,i=Object.,a=.,,likely benign Minified bundler runtime helpers at the top of a Vite bundle.Reasoning
Bundler module-wrapper boilerplate (Object.create, defineProperty, getOwnPropertyDescriptor) in a minified build. This is standard esbuild/Vite output and is not suspicious.
-
`+e.stack}}var Ae=Object.prototype.hasOwnProperty,je=t.unstable_scheduleCallback,Me=t.unstable_cancelCallback,Ne=t.unstable_shouldYield,Pe=t.unstable_requestPaint,Fe=t.unstable_now,Ie=t.unstable_getCurrentPriorityLevel,Le=t.unstable_ImmediatePriority,k=t.unstable_UserBlockingPriority,Re=t.unstable_NormalPriority,ze=t.ulikely benign Minified React scheduler and runtime bindings.Reasoning
A very long line of React scheduler aliases (unstable_scheduleCallback and similar) from a minified React bundle. This is expected framework code.
-
`).replace(Ad,``)}function Md(e,t){return t=jd(t),jd(e)===t}function $(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Qt(e,r):(typeof r==`number`||typeof r==`bigint`)&&t!==`body`&&Qt(e,``+r);break;case`className`:It(e,`likely benign Minified React DOM property and attribute handling code.Reasoning
Minified React DOM property-setting code (attribute handling for children, className, tabIndex). This is ordinary framework logic.
-
`:this.value}},St=class extends j{constructor(...e){super(...e),this.value=``}ASCIIMatch(e){return this.value.toLowerCase()===e.toLowerCase()}toJSON(){let e=this.constructor.prototype.constructor.prototype.toJSON.call(this);return e.value=this.value,e}},Ct=class extends St{constructor(e){super(),this.tokenType=`IDENT`,likely benign Minified parser class definitions from a bundled library.Reasoning
Minified CSS tokenizer and parser classes, consistent with a bundled CSS/YAML parsing library. No execution or network behaviour is shown.
-
`)}};kn.defaultYaml={explicit:!1,version:`1.2`},kn.defaultTags={"!!":`tag:yaml.,2002:`};function An(e){if(/[\x00-\x19\s,[\]{}]/.test(e)){let t=`Anchor must not contain whitespace or control characters: $`;throw Error(t)}return!0}function jn(e){let t=new Set;return bn(e,{Value(e,n){n.anchor&&t.add(likely benign Minified YAML parser helpers for anchor validation.Reasoning
Minified YAML library code that validates anchors with a regex and builds anchor sets. This is ordinary parser logic.
-
`))return sr(e,t,n,r);if(tr(a)){if(c===``)return t.forceBlockIndent=!0,sr(e,t,n,r);if(s&&c===l)return ar(a,t)}let d=a.replace(/\n+/g,`$&\n$`);if(o){let e=e=>e.default&&e.tag!==`tag:yaml.,2002:str`&&e.test?.test(d),{compat:n,tags:r}=t.doc.schema;if(r.some(e)||n?.some(e))return ar(a,t)}return s?d:Qn(d,c,Yn,er(t,!1)likely benign Minified YAML serialization code in a bundled Vite asset.Reasoning
Minified bundled YAML library code; long lines are typical of minification and the snippet shows ordinary YAML stringify logic with no suspicious behavior.
-
`)&&(S=``);return g+=S+x,n.inFlow?b&&r&&r():y&&!b?g+=Jn(g,n.indent,l(y)):h&&i&&i(),g}function hr(e,t){(e===`debug`||e===`warn`)&&console.warn(t)}var gr=`<<`,_r={identify:e=>e===gr||typeof e==`symbol`&&e.description===gr,default:`key`,tag:`tag:yaml.,2002:merge`,test:/^<<$/,resolve:()=>Object.assign(new I(Symbol(gr)),likely benign Minified YAML merge tag definition in a bundled library.Reasoning
Long line in minified bundle containing standard YAML merge-key type definitions; no execution or network behavior.
-
`;return`$\n$$`}else return`$$$$$`}function kr({indent:e,options:{commentString:t}},n,r,i){if(r&&i&&(r=r.replace(/^\n+/,``)),r){let i=qn(t(r),e);n.push(i.trimStart())}}function Ar(e,t){let n=N(t)?t.value:t;for(let r of e)if(M(r)&&(r.key===t||r.key===n||N(r.key)&&r.key.value===n))returnlikely benign Minified YAML comment and pair-handling code.Reasoning
Minified bundle line with YAML comment and pair handling; length alone is a minification artifact and the content is ordinary parser logic.
-
y`,resolve(e,t){if(typeof atob==``){let t=atob(e.replace(/[\n\r]/g,``)),n=new Uint8Array(t.length);for(let e=0;e<t.length;++e)n[e]=t.charCodeAt(e);return n}else return t(`This environment does not support reading binary tags; either Buffer or atob is required`),e},stringify({comment:e,type:t,value:n},r,i,a){if(likely benign atob call inside the YAML !!binary tag resolver.Reasoning
atob is used in the YAML binary tag resolver to decode !!binary values with a fallback error if unsupported. This is standard data decoding of a declared YAML type, not dynamic fetch or eval of the decoded content.
-
t=0;t<o.;++t)e+=String.;s=}throw ; -
`:` `)}return lr({comment:e,type:t,value:s},r,i,a)}};function ti(e,t){if(hn(e))for(let n=0;n<e.items.length;++n){let r=e.items[n];if(!M(r)){if(mn(r)){r.items.length>1&&t(`Each pair must have its own sequence indicator`);let e=r.items[0]||new Tr(new I(null));if(r.commentBefore&&(e.key.commentBefore=e.key.commentBefore?`likely benign Minified YAML sequence parsing code.Reasoning
Minified YAML sequence/pair parsing logic in a bundle; long line is consistent with minification and no malicious behavior is shown.
-
`}var Pi=class e{constructor(e,t,n){this.commentBefore=null,this.comment=null,this.errors=[],this.warnings=[],Object.defineProperty(this,dn,{value:on});let r=null;typeof t==``||Array.isArray(t)?r=t:n===void 0&&t&&(n=t,t=void 0);let i=Object.assign({intAsBigInt:!1,keepSourceTokens:!1,logLevel:`warn`,prettyErrorslikely benign Minified YAML Document class constructor.Reasoning
Minified YAML Document constructor with default options; ordinary library code.
-
`),o=n+o}if(/[^ ]/.test(o)){let e=1,t=n.linePos[1];t?.line===r&&t.col>i&&(e=Math.max(1,Math.min(t.col-i,80-a)));let s=` `.repeat(a)+`^`.repeat(e);n.message+=`:\n\n$\n$\n`}};function Li(e,{flow:t,indicator:n,next:r,offset:i,onError:a,parentIndent:o,startOnNewline:s}){let c=!1,l=s,u=s,d=``,f=``,p=!1,m=!1,h=null,g=nlikely benign Minified YAML error formatting and flow parsing.Reasoning
Minified YAML error-pretty-printing and flow-collection parsing code; benign library logic.
-
`+_.comment:g.comment=_.comment);let e=new Tr(g);n.options.keepSourceTokens&&(e.srcToken=a),o.items.push(e)}}return c&&c<s&&i(c,`IMPOSSIBLE`,`Map comment trailing content`),o.range=[r.offset,s,c??s],o}function Ui({composeNode:e,composeEmptyNode:t},n,r,i,a){let o=new((a?.nodeClass)??Nr)(n.schema);n.atRoot&&=!1,n.atlikely benign Minified YAML map composition logic.Reasoning
Minified YAML map composition code; long line is a minification artifact with ordinary parser behavior.
-
`}let m=r+i.length+t.source.length;return{value:d,type:a,comment:i.comment,range:[r,m,m]}}function Zi({offset:e,props:t},n,r){if(t[0].type!==`block-scalar-header`)return r(t[0],`IMPOSSIBLE`,`Block scalar header not found`),null;let{source:i}=t[0],a=i[0],o=0,s=``,c=-1;for(let t=1;t<i.length;++t){let n=i[t];if(!s&&(n===`likely benign Minified YAML block scalar header parser.Reasoning
Minified YAML block scalar header parsing; standard library code with no execution or network activity.
-
`,r:`\r`,t:` `,v:`\v`,N:`⟨U+0085⟩`,_:`\xA0`,L:`\u2028`,P:`\u2029`," ":` `,'"':`"`,"/":`/`,"\\":`\\`," ":` `};function oa(e,t,n,r){let i=e.substr(t,n),a=i.length===n&&/^[0-9a-fA-F]+$/.test(i)?parseInt(i,16):NaN;try{return String.fromCodePoint(a)}catch{let i=e.substr(t-2,n+2);return r(t-2,`BAD_DQ_ESCAPE`,`Invalid escape sequenlikely benign Minified YAML double-quoted string escape handling.Reasoning
Minified YAML double-quoted escape handling table and parser; benign string-escape logic.
-
`)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}var _a=class{constructor(e={}){this.doc=null,this.atDirectives=!1,this.prelude=[],this.errors=[],this.warnings=[],this.onError=(e,t,n,r)=>{let i=ha(e);r?this.warnings.push(newlikely benign Minified yaml parser code inside a bundled Vite asset.Reasoning
Long-line signal on a minified bundle; the visible code is ordinary yaml parser logic with no decoding, execution, or network activity. Raw-pass long-line hits are a known false-positive pattern for minified output.
-
`};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.keys(e))t!==`type`&&t!==`offset`&&delete e[t];Object.assign(e,{type:n,indent:r,soulikely benign Minified yaml document/CST handling code in a bundled asset.Reasoning
Long line from minified bundle; snippet shows yaml CST/parser class logic with no suspicious dynamic execution or encoded payloads.
-
=`function`?:r}var Ma=,, -
-scalar`);function Fa(e){switch(e){case`⟨U+FEFF⟩`:return`<BOM>`;case`⟨U+0002⟩`:return`<DOC>`;case`⟨U+0018⟩`:return`<FLOW_END>`;case`⟨U+001F⟩`:return`<SCALAR>`;default:return JSON.stringify(e)}}function Ia(e){switch(e){case`⟨U+FEFF⟩`:return`byte-order-mark`;case`⟨U+0002⟩`:return`doc-mode`;case`⟨U+0018⟩`:return`flow-error-end`;case`⟨U+001F⟩`:return`scalar`;case`---`:retur -
}} -
`,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=e,null}peek(e){likely benign Minified lexer buffer helpers from the bundled yaml library.Reasoning
Only the line length is flagged; the snippet is string and buffer handling from a yaml lexer, typical of minified libraries.
-
eturn this.; -
`?yield*this.pushCount(2):0}*pushSpaces(e){let t=this.pos-1,n;do n=this.buffer[++t];while(n===` `||e&&n===` `);let r=t-this.pos;return r>0&&(yield this.buffer.substr(this.pos,r),this.pos=t),r}*pushUntil(e){let t=this.pos,n=this.buffer[t];for(;!e(n);)n=this.buffer[++t];return yield*this.pushToIndex(t,!1)}},Wa=class{conslikely benign Minified generator-based yaml tokenizer methods.Reasoning
Generator-based tokenizer code with no obfuscation beyond minification; long-line is the only signal and the raw pass has a high false-positive rate.
-
`,e)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case`newline`:if(this.onKeyLine=!1,t.value){let n=`end`in t.value?t.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type===`comment`?n?.push(this.sourceToken):e.items.push({likely benign Minified yaml block-map parsing code.Reasoning
Snippet shows yaml block-map parsing logic in a minified bundle; nothing indicates hidden or malicious behavior.
-
`,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case`alias`:case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:return this.flowScalar(this.type);case`block-scalar-header`:return{type:`block-scalar`,offset:this.offset,indent:this.indent,likely benign Minified yaml block value dispatch code.Reasoning
Snippet is yaml start-block-value handling in a minified library; the long line alone is not evidence of obfuscation.
-
`;return r.push({message:i,range:[n.lineCounter.linePos(t.range[0]),n.lineCounter.linePos(t.range[0]+e.pos)]}),null}throw e}}constructor(e){this._input=e,this._pos=0,this._length=e.length}_peek(){return this._input[this._pos]||``}_next(){return this._pos<this._length?this._input[this._pos++]:null}_eof(){return this._polikely benign Minified parser class with input buffer helpers.Reasoning
Snippet shows a parser class with string-indexed input reading and error reporting, consistent with a bundled parser library and not with malicious code.
-
;var n=likely benign Bundled CodeMirror editor module wrapper.Reasoning
CodeMirror UMD wrapper with browser feature detection, a standard bundled editor library; long-line is expected for minified output.
-
tion var -
Height>2&&!)}var n=He?:;return n.,n}var We; -
n We;var t=,n=.,r=.;return ,!n||n.==n.?!1:We=r.-n.<3}var Ke=` -
`,t);i==-1&&(i=e.length);var a=e.slice(t,e.charAt(i-1)==`\r`?i-1:i),o=a.indexOf(`\r`);o==-1?(n.push(a),t=i+1):(n.push(a.slice(0,o)),t+=o+1)}return n},qe=window.getSelection?function(e){try{return e.selectionStart!=e.selectionEnd}catch{return!1}}:function(e){var t;try{t=e.ownerDocument.selection.createRange()}catch{}retlikely benign Minified CodeMirror text and selection utilities.Reasoning
Snippet is CodeMirror text-splitting and selection helpers, standard editor code; the long line is the only signal.
-
`?(_=f.appendChild(k(`span`,m[0]==`\r`?`␍`:``,`cm-invalidchar`)),_.setAttribute(`cm-text`,m[0]),e.col+=1):(_=e.cm.options.specialCharPlaceholder(m[0]),_.setAttribute(`cm-text`,m[0]),o&&s<9?f.appendChild(k(`span`,[_])):f.appendChild(_),e.col+=1);e.map.push(e.pos,e.pos+1,_),e.pos++}}if(e.trailingSpace=l.charCodeAt(tlikely benign Minified CodeMirror rendering code for invalid and special characters.Reasoning
Snippet is CodeMirror DOM rendering of special characters, a normal editor feature; no execution, encoding, or network behavior is visible.
-
height: `+(r-t)+`px`))}function d(t,n,r){var a=K(i,t),o=a.text.length,d,f;function p(n,r){return wr(e,J(t,n),`div`,a,r)}function m(t,n,r){var i=Ar(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==`after`?i.begin:i.end-(/\s/.test(a.text.charAt(i.end-1))?2:1),o)[o]}var h=H(a,i.likely benign Minified CodeMirror editor bundle line in the Vite trace viewer.Reasoning
Long lines in a minified/bundled CodeMirror library are a normal artifact of minification; the raw long-line signal is a known high false-positive pattern and the snippet is ordinary CodeMirror code.
-
ht)&&,i!=null&&!h) -
left: `+t.left+`px; width: `+Math.max(2,t.right-t.left)+`px;`);e.display.lineSpace.appendChild(o),o.scrollIntoView(i),e.display.lineSpace.removeChild(o)}}}function ui(e,t,n,r){r??=0;var i;!e.options.lineWrapping&&t==n&&(n=t.sticky==`before`?J(t.line,t.ch+1,`before`):t,t=t.ch?J(t.line,t.sticky==likely benign Very long minified line in the bundled CodeMirror module.Reasoning
A 52k-character line is typical of a minified bundled library; the snippet shows standard CodeMirror editor logic with no encoded payload or suspicious execution.
-
`},setDirection:Vi(function(e){e!=`rtl`&&(e=`ltr`),e!=this.direction&&(this.direction=e,this.iter(function(e){return e.order=null}),this.cm&&Ea(this.cm))})}),ko.prototype.eachLine=ko.prototype.iter;var Ao=0;function jo(e){var t=this;if(Po(t),!(G(t,e)||Zn(t.display,e))){Fe(e),o&&(Ao=+new Date);var n=Hr(t,e,!0),r=e.dataTlikely benign Minified CodeMirror bundle line with editor logic.Reasoning
Minified CodeMirror source with long lines is expected; the content is ordinary editor code and the finding is a raw-pass length heuristic.
-
`,`start`)},toggleOverwrite:function(e){return e.toggleOverwrite()}};function is(e,t){var n=K(e.doc,t),r=on(n);return r!=n&&(t=q(r)),ts(!0,e,r,t,1)}function as(e,t){var n=K(e.doc,t),r=sn(n);return r!=n&&(t=q(r)),ts(!0,e,n,t,-1)}function os(e,t){var n=is(e,t.line),r=K(e.doc,n.line),i=H(r,e.doc.direction);if(!i||i[0].levlikely benign Minified CodeMirror bundle line with editor functions.Reasoning
Long minified line containing standard CodeMirror functions; no obfuscation beyond minification is evident.
-
`)&&(m=h=J(m.line,0)));var g={from:m,to:h,text:l?l[f%l.length]:c,origin:i||(s?`paste`:e.state.cutIncoming>o?`cut`:`+input`)};ro(e.doc,g),In(e,`inputRead`,e,g)}t&&!s&&Xs(e,t),mi(e),e.curOp.updateInput<2&&(e.curOp.updateInput=d),e.curOp.typing=!0,e.state.pasteIncoming=e.state.cutIncoming=-1}function Ys(e,t){var n=e.clipblikely benign Minified CodeMirror clipboard/input handling line.Reasoning
Standard minified clipboard and input handling code from CodeMirror; long-line flag is a length heuristic only.
-
`);var l=ee(F(i));ne(c),setTimeout(function(){r.display.lineSpace.removeChild(s),l.focus(),l==i&&n.showPrimarySelection()},50)}}U(i,`copy`,o),U(i,`cut`,o)},$.prototype.screenReaderLabelChanged=function(e){e?this.div.setAttribute(`aria-label`,e):this.div.removeAttribute(`aria-label`)},$.prototype.prepareSelection=functilikely benign Minified CodeMirror copy/cut handling line.Reasoning
Minified CodeMirror copy/cut and selection code; consistent with an editor library bundle.
-
`),ne(i))}else return;e.type==`cut`&&(r.state.cutIncoming=+new Date)}}U(i,`cut`,a),U(i,`copy`,a),U(e.scroller,`paste`,function(t){if(!(Zn(e,t)||G(r,t))){if(!i.dispatchEvent){r.state.pasteIncoming=+new Date,n.focus();return}var a=new Event(`paste`);a.clipboardData=t.clipboardData,i.dispatchEvent(a)}}),U(e.lineSpace,`sellikely benign Minified CodeMirror paste event handling line.Reasoning
Standard CodeMirror paste and cut event wiring in minified form; no malicious indicators.
-
r a=i.;return this.,this..}++c;return -
outline: none; border-width: 0; outline: none; overflow: hidden; opacity: .05; filter: ;`;var m;c&&(m=i.ownerDocument.defaultView.scrollY),r.input.focus(),c&&i.ownerDocument.defaultView.scrollTo(null,m),r.input.reset(),n.somethingSelected()||(i.value=t.prevInput=` `),t.contextMenuPending=g,r.selFolikely benign Very long minified CodeMirror line handling hidden textarea input.Reasoning
The 121k-character line is a minified CodeMirror bundle containing textarea/input handling for the editor; the long-line signal alone is a weak raw-pass indicator.
-
t!=null)} -
value=`⇚`,i.=a,t.=e?``:`⟨U+200B⟩`,i.=1,i.=a.,r.=n..}} -
art==0&&i.>0&&t.==`⟨U+200B⟩`?:e++<10?r.=:};r.=}}},lc. -
`:` `)}async function Xr(e,t,n=0){let r=new Set([`method`,`path`,`scheme`,`version`,`accept-charset`,`accept-encoding`,`access-control-request-headers`,`access-control-request-method`,`connection`,`content-length`,`cookie`,`cookie2`,`date`,`dnt`,`expect`,`host`,`keep-alive`,`origin`,`referer`,`te`,`trailer`,`transfer -
.`)}\n`),`request.();`}};var ri= -
`).filter(Boolean).map(e=>JSON.parse(e)).map((e,t)=>({...e,index:t,byteLength:_i(e)})):[]}catch{return[]}return[]},[e,t],void 0),[r,i]=T.useState(void 0),a=r===void 0?void 0:n?.[r],o=T.useMemo(()=>{if(n){for(let e of n)if(e.time>0)return e.time}},[n]);if(n===void 0)return(0,M.jsx)(Un,{text:`Loading...`});if(n.length=== -
))..;return } -
}var vu=`data:text/html;base64,`+,yu= -
e..+`'`;return t.?r:}var Cf; -
t=0;t<o.;++t)e+=String.;s=}throw ; -
=`function`?:r}var $m=,, -
-scalar`);function nh(e){switch(e){case`⟨U+FEFF⟩`:return`<BOM>`;case`⟨U+0002⟩`:return`<DOC>`;case`⟨U+0018⟩`:return`<FLOW_END>`;case`⟨U+001F⟩`:return`<SCALAR>`;default:return JSON.stringify(e)}}function rh(e){switch(e){case`⟨U+FEFF⟩`:return`byte-order-mark`;case`⟨U+0002⟩`:return`doc-mode`;case`⟨U+0018⟩`:return`flow-error-end`;case`⟨U+001F⟩`:return`scalar`;case`---`:retur -
}} -
eturn this.; -
; -
.}--`))}var C=`data:text/html;base64,`+btoa(`<body></body><style>body { color-scheme: light dark; background: light-dark }</style>`),w=class{constructor(e){this._maxSize=e,this._map=new Map,this._size=0}getOrCompute(e,t){if(this._map.has(e)){let t=this._map.get(e);return this._map.delete(e),this -
.;r.&&}},Cr= -
=:t.+=r)}},Cr=,wr= -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),$r=Qr.length==256;function ei(e){if($r){let t=``;for(let n=0;n<e.length;n++)t+=Qr[e[n]];return t}else return new TextDecoder().decode(e)}function ti(e,t){return t&&t.trim().toLowerCase()==`cp… -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),$r=Qr.length==256;function ei(e){if($r){let t=``;for(let n=0;n<e.length;n++)t+=Qr[e[n]];return t}else return new TextDecoder().decode(e)}function ti(e,t){return t&&t.trim().toLowerCase()==`cp… -
fi file=$($printf "$(echo "$file" | sed -e 's@%\([a-f0-9A-F]\{2\}\)@\\x\1@g')") fi echo "$file"
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&