disclude.ionpm / playwright-core / 1.65.0-alpha-2026-10-23
playwright-core 1.65.0-alpha-2026-10-23
- Source
- https://github.com/microsoft/playwright
- Artifact scanned
playwright-core-1.65.0-alpha-2026-10-23.tgz- Compared with
playwright-core-1.65.0-alpha-2026-10-22.tgz(6 signals introduced since)- Files
- 77 scanned, 38 skipped (binary, oversized, or unrecognised)
- Signals
- 2 critical · 66 warn · 193 info
- Scan time
- 81.0 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): the 107 most severe of 172 warn and critical signals (107 with a verdict); 104 demoted to info. The rest are unreviewed.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 17:14
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
evalResult = await locator..likely benign eval of a caller-supplied expression inside a page-context evaluate callback, as in a browser evaluate tool.Reasoning
eval runs inside a page.evaluate callback on an expression supplied by the caller. This matches a browser-evaluate tool's purpose, where executing caller-provided JavaScript in the page is the feature. It is still arbitrary code execution, so the verdict is not certain.
-
evalResult = await tab..likely benign eval of a caller-supplied expression inside a tab page evaluate callback.Reasoning
Same pattern as the adjacent finding: eval of a caller-supplied expression within page.evaluate. It is the intended behavior of an evaluate feature, but the eval of an unvalidated string keeps it from being clearly benign.
-
likely benign Dynamic require of an init-page module that is then called with the page object.
Reasoning
A require with a non-literal specifier loads a user-supplied init page module and calls its default export with the page. This is a plugin-style loading pattern, and the snippet shows nothing fetched from the network or decoded. Some risk remains because the path is not a fixed literal.
-
`)&&(m=h=J(m.line,0)));var g={from:m,to:h,text:l?l[f%l.length]:c,origin:i||(s?`paste`:e.state.cutIncoming>o?`cut`:`+input`)};ro(e.doc,g),In(e,`inputRead`,e,g)}t&&!s&&Xs(e,t),mi(e),e.curOp.updateInput<2&&(e.curOp.updateInput=d),e.curOp.typing=!0,e.state.pasteIncoming=e.state.cutIncoming=-1}function Ys(e,t){var n=e.clipb -
`);var l=ee(F(i));ne(c),setTimeout(function(){r.display.lineSpace.removeChild(s),l.focus(),l==i&&n.showPrimarySelection()},50)}}U(i,`copy`,o),U(i,`cut`,o)},$.prototype.screenReaderLabelChanged=function(e){e?this.div.setAttribute(`aria-label`,e):this.div.removeAttribute(`aria-label`)},$.prototype.prepareSelection=functi -
`),ne(i))}else return;e.type==`cut`&&(r.state.cutIncoming=+new Date)}}U(i,`cut`,a),U(i,`copy`,a),U(e.scroller,`paste`,function(t){if(!(Zn(e,t)||G(r,t))){if(!i.dispatchEvent){r.state.pasteIncoming=+new Date,n.focus();return}var a=new Event(`paste`);a.clipboardData=t.clipboardData,i.dispatchEvent(a)}}),U(e.lineSpace,`sel -
outline: none; border-width: 0; outline: none; overflow: hidden; opacity: .05; filter: ;`;var m;c&&(m=i.ownerDocument.defaultView.scrollY),r.input.focus(),c&&i.ownerDocument.defaultView.scrollTo(null,m),r.input.reset(),n.somethingSelected()||(i.value=t.prevInput=` `),t.contextMenuPending=g,r.selFo -
`;t.replaceSelection(e+e,null),u(t,-1),a=t.listSelections();for(var n=0;n<a.length;n++){var r=a[n].head.line;t.indentLine(r,null,!0),t.indentLine(r+1,null,!0)}})}function u(e,t){for(var n=[],r=e.listSelections(),i=0,a=0;a<r.length;a++){var o=r[a];o.head==e.getCursor()&&(i=a);var s=o.head.ch||t>0?{line:o.head.line,ch:o. -
`),v=d+g.length,y=g[g.length-1].length;return{from:t(v,y),to:t(v+_.length-1,_.length==1?y+_[0].length:_[_.length-1].length),match:h}}}}var u,d;String.prototype.normalize?(u=function(e){return e.normalize(`NFD`).toLowerCase()},d=function(e){return e.normalize(`NFD`)}):(u=function(e){return e.toLowerCase()},d=function(e) -
`:t==`r`?`\r`:t==`t`?` `:t==`\\`?`\\`:e})}function u(e){var t=e.match(/^\/(.*)\/([a-z]*)$/);if(t)try{e=new RegExp(t[1],t[2].indexOf(`i`)==-1?``:`i`)}catch{}else e=l(e);return(typeof e==`string`?e==``:e.test(``))&&(e=/x^/),e}function d(e,n,r){n.queryText=r,n.query=u(r),e.removeOverlay(n.overlay,i(n.query)),n.overlay=t(n -
;var m=Object.,h=Object.,g=Object.,_=Object.,v=Object.,y=., -
`+e.stack}}var Oe=Object.prototype.hasOwnProperty,ke=t.unstable_scheduleCallback,Ae=t.unstable_cancelCallback,je=t.unstable_shouldYield,Me=t.unstable_requestPaint,j=t.unstable_now,Ne=t.unstable_getCurrentPriorityLevel,Pe=t.unstable_ImmediatePriority,Fe=t.unstable_UserBlockingPriority,Ie=t.unstable_NormalPriority,Le=t.u -
`).replace(jd,``)}function Nd(e,t){return t=Md(t),Md(e)===t}function Q(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Qt(e,r):(typeof r==`number`||typeof r==`bigint`)&&t!==`body`&&Qt(e,``+r);break;case`className`:It(e,` -
`:this.value}},vt=class extends Je{constructor(...e){super(...e),this.value=``}ASCIIMatch(e){return this.value.toLowerCase()===e.toLowerCase()}toJSON(){let e=this.constructor.prototype.constructor.prototype.toJSON.call(this);return e.value=this.value,e}},yt=class extends vt{constructor(e){super(),this.tokenType=`IDENT` -
`,`\\n`)}function tn(e,t,n){if(e)for(let r of t.split(`|`)){if(r===`url`)try{let t=new URL(e[r]);return t.protocol===`data:`?t.protocol:[`about:`,`chrome:`,`edge:`].includes(t.protocol)?e[r]:t.host+t.pathname+t.search}catch{if(e[r]!==void 0)return e[r]}if(r===`timeNumber`&&e[r]!==void 0)return new Date(e[r]).toString() -
-
`).length:0;return Math.min(Math.max(5,e),20)*20},[a]),h=(0,M.jsx)(`span`,{style:{marginLeft:5},ref:d,"aria-label":e.name,children:Dr(e.name)}),g=p&&(0,M.jsx)(`a`,{style:{marginLeft:5},href:Mr(n,e),children:`download`});return!f||!p?(0,M.jsxs)(`div`,{style:{marginLeft:20},children:[h,g]}):(0,M.jsxs)(`div`,{className:k( -
`+i.gitDiff+"\n```"),t},[a,i],void 0);return e.errors.size?(0,M.jsxs)(`div`,{className:`fill`,style:{overflow:`auto`},children:[(0,M.jsx)(`span`,{style:{position:`absolute`,right:`5px`,top:`5px`,zIndex:1},children:o&&(0,M.jsx)(Pr,{prompt:o})}),[...e.errors.entries()].map(([e,i])=>{let a=`error-${r}-${e}`;return(0,M.jsx -
text&&,e.&&,}}return},),i=T.,a=T. -
,Math.-t)} -
1}).} -
`:return`\\n`;case`\r`:return`\\r`;case` `:return`\\t`;default:return`\\x`+e.charCodeAt(0).toString(16).padStart(2,`0`)}})+`"`:e}function ra(e){return!!(e.length===0||/^\s|\s$/.test(e)||/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/.test(e)||/^-/.test(e)||/[\n:](\s|$)/.test(e)||/\s#/.test(e)||/[\n\r]/.test(e)||/^[&*\],?!>|@"' -
`)}function aa(e){return` `.repeat(e)}function oa(t){let n=[{regex:/\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b/,replacement:`+`},{regex:/\b[\d,.]+[bkmBKM]+\b/,replacement:`++`},{regex:/\b\d+[hmsp]+\b/,replacement:`\\d++`},{regex:/\b[\d,.]+[hmsp]+\b/ -
`).replace(/[\u200b\u00ad]/g,``).replace(/\s\s*/g,` `)).join(`\xA0`).trim()}function Eo(e,t){let n=[...e.querySelectorAll(t)];for(let r of wo(e,e.getAttribute(`aria-owns`)))r.matches(t)&&n.push(r),n.push(...r.querySelectorAll(t));return n}function Do(e,t){let n=t===`::before`?ws:t===`::after`?Ts:Cs;if(n?.has(e))return -
)).;return } -
})`))(this,t)}async viewportRatio(e){return await new Promise(t=>{let n=new IntersectionObserver(e=>{t(e[0].intersectionRatio),n.disconnect()});n.observe(e),this.utils.builtins.requestAnimationFrame(()=>{})})}getElementBorderWidth(e){if(e.nodeType!==Node.ELEMENT_NODE||!e.ownerDocument||!e.ownerDocument.defaultVie -
e] element`;let i=t.map(e=>{let t=Uint8Array.from(atob(e.buffer),e=>e.charCodeAt(0));return new File([t],e.name,{type:e.mimeType,lastModified:e.lastModifiedMs})}),a=new DataTransfer;for(let e of i)a.items.add(e);r.files=a.files,r.dispatchEvent(new Event(`input`,{bubbles:!0,composed:!0})),r.dispatchEvent(new Event(`chan -
...`),this.createStacklessError(`"${r.name}" selector is not supported: $ resolved to $ element$:$\n`)}createStacklessError(e){let t=this._shouldPrependErrorPrefix?Error(`Error: `+e):Error(e);return this._browserName===`firefox`?(t.stack=``,t): -
`),this.installListeners(),e.utils.cacheNormalizedWhitespaces(),e.isUnderTest&&console.error(`Recorder script ready test`),e.consoleApi.install()}installListeners(){hu(this._listeners),this._listeners=[q(this.document,`click`,e=>this._onClick(e),!0),q(this.document,`auxclick`,e=>this._onClick(e),!0),q(this.docu -
`],[`r`,`\r`],[`t`,` `],[`b`,`\b`],[`f`,`\f`]]),bu=/[A-Za-z_$][\w$]*/y,xu=/-?\d+(\.\d+)?/y,Su=/[a-z]*/y;function Cu(e,t){let n=[],r=0,i=t=>{t.lastIndex=r;let n=t.exec(e)?.[0];return n&&(r+=n.length),n},a=(n,a,o=!1)=>{let s=``,c=!1;for(++r;r<e.length&&(e[r]!==n||c);){if(n==="`"&&e.startsWith("$ -
`)}};Gd.defaultYaml={explicit:!1,version:`1.2`},Gd.defaultTags={"!!":`tag:yaml.,2002:`};function Kd(e){if(/[\x00-\x19\s,[\]{}]/.test(e)){let t=`Anchor must not contain whitespace or control characters: $`;throw Error(t)}return!0}function qd(e){let t=new Set;return Id(e,{Value(e,n){n.anchor&&t.add( -
`))return wf(e,t,n,r);if(vf(a)){if(c===``)return t.forceBlockIndent=!0,wf(e,t,n,r);if(s&&c===l)return Sf(a,t)}let d=a.replace(/\n+/g,`$&\n$`);if(o){let e=e=>e.default&&e.tag!==`tag:yaml.,2002:str`&&e.test?.test(d),{compat:n,tags:r}=t.doc.schema;if(r.some(e)||n?.some(e))return Sf(a,t)}return s?d:hf(d,c,ff,_f(t,!1) -
`)&&(S=``);return g+=S+x,n.inFlow?b&&r&&r():y&&!b?g+=df(g,n.indent,l(y)):h&&i&&i(),g}function Mf(e,t){(e===`debug`||e===`warn`)&&console.warn(t)}var Nf=`<<`,Pf={identify:e=>e===Nf||typeof e==`symbol`&&e.description===Nf,default:`key`,tag:`tag:yaml.,2002:merge`,test:/^<<$/,resolve:()=>Object.assign(new $(Symbol(Nf)), -
`;return`$\n$$`}else return`$$$$$`}function Kf({indent:e,options:{commentString:t}},n,r,i){if(r&&i&&(r=r.replace(/^\n+/,``)),r){let i=uf(t(r),e);n.push(i.trimStart())}}function qf(e,t){let n=Z(t)?t.value:t;for(let r of e)if(kd(r)&&(r.key===t||r.key===n||Z(r.key)&&r.key.value===n))retur -
y`,resolve(e,t){if(typeof atob==``){let t=atob(e.replace(/[\n\r]/g,``)),n=new Uint8Array(t.length);for(let e=0;e<t.length;++e)n[e]=t.charCodeAt(e);return n}else return t(`This environment does not support reading binary tags; either Buffer or atob is required`),e},stringify({comment:e,type:t,value:n},r,i,a){if( -
`:` `)}return Ef({comment:e,type:t,value:s},r,i,a)}};function vp(e,t){if(Ad(e))for(let n=0;n<e.items.length;++n){let r=e.items[n];if(!kd(r)){if(Od(r)){r.items.length>1&&t(`Each pair must have its own sequence indicator`);let e=r.items[0]||new Hf(new $(null));if(r.commentBefore&&(e.key.commentBefore=e.key.commentBefore? -
`}var Zp=class e{constructor(e,t,n){this.commentBefore=null,this.comment=null,this.errors=[],this.warnings=[],Object.defineProperty(this,Td,{value:xd});let r=null;typeof t==``||Array.isArray(t)?r=t:n===void 0&&t&&(n=t,t=void 0);let i=Object.assign({intAsBigInt:!1,keepSourceTokens:!1,logLevel:`warn`,prettyErrors -
`),o=n+o}if(/[^ ]/.test(o)){let e=1,t=n.linePos[1];t?.line===r&&t.col>i&&(e=Math.max(1,Math.min(t.col-i,80-a)));let s=` `.repeat(a)+`^`.repeat(e);n.message+=`:\n\n$\n$\n`}};function rm(e,{flow:t,indicator:n,next:r,offset:i,onError:a,parentIndent:o,startOnNewline:s}){let c=!1,l=s,u=s,d=``,f=``,p=!1,m=!1,h=null,g=n -
`+_.comment:g.comment=_.comment);let e=new Hf(g);n.options.keepSourceTokens&&(e.srcToken=a),o.items.push(e)}}return c&&c<s&&i(c,`IMPOSSIBLE`,`Map comment trailing content`),o.range=[r.offset,s,c??s],o}function lm({composeNode:e,composeEmptyNode:t},n,r,i,a){let o=new((a?.nodeClass)??Xf)(n.schema);n.atRoot&&=!1,n.at -
`}let m=r+i.length+t.source.length;return{value:d,type:a,comment:i.comment,range:[r,m,m]}}function _m({offset:e,props:t},n,r){if(t[0].type!==`block-scalar-header`)return r(t[0],`IMPOSSIBLE`,`Block scalar header not found`),null;let{source:i}=t[0],a=i[0],o=0,s=``,c=-1;for(let t=1;t<i.length;++t){let n=i[t];if(!s&&(n===` -
`,r:`\r`,t:` `,v:`\v`,N:`⟨U+0085⟩`,_:`\xA0`,L:`\u2028`,P:`\u2029`," ":` `,'"':`"`,"/":`/`,"\\":`\\`," ":` `};function Em(e,t,n,r){let i=e.substr(t,n),a=i.length===n&&/^[0-9a-fA-F]+$/.test(i)?parseInt(i,16):NaN;try{return String.fromCodePoint(a)}catch{let i=e.substr(t-2,n+2);return r(t-2,`BAD_DQ_ESCAPE`,`Invalid escape sequen -
`)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}var Rm=class{constructor(e={}){this.doc=null,this.atDirectives=!1,this.prelude=[],this.errors=[],this.warnings=[],this.onError=(e,t,n,r)=>{let i=Im(e);r?this.warnings.push(new -
`};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.keys(e))t!==`type`&&t!==`offset`&&delete e[t];Object.assign(e,{type:n,indent:r,sou -
`,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=e,null}peek(e){ -
`?yield*this.pushCount(2):0}*pushSpaces(e){let t=this.pos-1,n;do n=this.buffer[++t];while(n===` `||e&&n===` `);let r=t-this.pos;return r>0&&(yield this.buffer.substr(this.pos,r),this.pos=t),r}*pushUntil(e){let t=this.pos,n=this.buffer[t];for(;!e(n);)n=this.buffer[++t];return yield*this.pushToIndex(t,!1)}},dh=class{cons -
`,e)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case`newline`:if(this.onKeyLine=!1,t.value){let n=`end`in t.value?t.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type===`comment`?n?.push(this.sourceToken):e.items.push({ -
`,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case`alias`:case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:return this.flowScalar(this.type);case`block-scalar-header`:return{type:`block-scalar`,offset:this.offset,indent:this.indent, -
`).map((e,n)=>{let i=r.get(n);return{text:e,box:i?t.get(i):void 0}})}var Ph=/("(?:[^"\\]|\\.)*")|(\/(?:[^/\\]|\\.)*\/)|(\[[^\]]*\])/g;function Fh(e){let t=[],n=e.match(/^(\s*- )([\w-]+)/),r=0;n&&(t.push(n[1]),t.push((0,M.jsx)(`span`,{className:`aria-mode-role`,children:n[2]},`role`)),r=n[0].length);let i=e.substring(r) -
`).map(e=>Rh.get(e)):[];for(let t of n)t.listeners.add(e);return()=>{for(let t of n)t.listeners.delete(e)}},[r]),n}function Hh(e,t){let n=Rh.get(t);return n||(n={url:void 0,thumbnails:[],listeners:new Set,started:!1},Rh.set(t,n)),n.started||(n.started=!0,Uh(n,e,t).catch(()=>{})),n}async function Uh(e,t,n){let r=await(a -
-
;var t= -
`&&(this._liveRegionLineCount++,this._liveRegionLineCount===21&&(this._liveRegion.textContent+=a.tooMuchOutput)))}_clearLiveRegion(){this._liveRegion.textContent=``,this._liveRegionLineCount=0}_handleKey(e){this._clearLiveRegion(),/\p{Control}/u.test(e)||this._charsToConsume.push(e)}_refreshRows(e,t){this._liveRegionDe -
`)}clearSelection(){this._model.clearSelection(),this._removeMouseDownListeners(),this.refresh(),this._onSelectionChange.fire()}refresh(e){this._refreshAnimationFrame||=this._coreBrowserService.window.requestAnimationFrame((()=>this._refresh())),d.isLinux&&e&&this.selectionText.length&&this._onLinuxMouseSelection.fire( -
`,e.VT=`\v`,e.FF=`\f`,e.CR=`\r`,e.SO=`⟨U+000E⟩`,e.SI=`⟨U+000F⟩`,e.DLE=`⟨U+0010⟩`,e.DC1=`⟨U+0011⟩`,e.DC2=`⟨U+0012⟩`,e.DC3=`⟨U+0013⟩`,e.DC4=`⟨U+0014⟩`,e.NAK=`⟨U+0015⟩`,e.SYN=`⟨U+0016⟩`,e.ETB=`⟨U+0017⟩`,e.CAN=`⟨U+0018⟩`,e.EM=`⟨U+0019⟩`,e.SUB=`⟨U+001A⟩`,e.ESC=`\x1B`,e.FS=`⟨U+001C⟩`,e.GS=`⟨U+001D⟩`,e.RS=`⟨U+001E⟩`,e.US=`⟨U+001F⟩`,e.SP=` `,e.DEL=`⟨U+007F⟩`}(n||(t.C0=n={})),function(e){e.PAD=`⟨U+0080⟩`,e.HOP=`⟨U+0081⟩`,e.BPH=`⟨U+0082⟩`,e.NBH=`⟨U+0083⟩`,e.IND=`⟨U+0084⟩`,e.NEL=`⟨U+0085⟩ -
`,t)}paste(e){this._core.paste(e)}refresh(e,t){this._verifyIntegers(e,t),this._core.refresh(e,t)}reset(){this._core.reset()}clearTextureAtlas(){this._core.clearTextureAtlas()}loadAddon(e){this._addonManager.loadAddon(this,e)}static get strings(){return t}_verifyIntegers(...e){for(let t of e)if(t===1/0||isNaN(t)||t%1!=0 -
;;var f=,p=,m=, -
var e=Object.,; -
`))this._appendEvent(t)}appendStacks(e){let t=JSON.parse(e),n=t.stacks.map(([e,...t])=>{let n=typeof e==`number`?D(e):e;return[this._legacyCallIdToStepId.get(n)??n,...t]}),r=O({files:t.files,stacks:n});for(let e of this._actionMap.values())e.stack=e.stack||r.get(e.callId)}actions(){return[...this._actionMap.values()]}_ -
r}=this,i=,a=Math.*4,o=,s=e-Math.*3,c=0;i=o.,c++;return c<i.?i.:i}},Sr= -
If your trace is in a local or private network, please grant permission Local Network Access.`),Error(r)}return{traceLoader:n,snapshotServer:new i(n.storage(),e=>n.resourceEntry(e))}}async function Sa(e){let t=e.request;if(t.url.startsWith(`chrome-extension://`))return fetch(t);let n=new URL(t.url),r;if(t.url.start -
Only changed`:``),onClick:()=>d(!u),children:[(0,z.jsx)(`span`,{className:`filter-label`,children:`Status:`}),` `,p,(0,z.jsx)(`span`,{className:`filter-label`,children:`Projects:`}),` `,m,o&&(0,z.jsx)(z.Fragment,{children:(0,z.jsx)(`span`,{className:`filter-label`,children:`Only changed`})})]}),u&&(0,z.jsxs)(z.Fragment -
!B)return;let e=;return ,},),E. -
`),l(!0)},pathSeparator:G.pathSeparator});return U(t),v(void 0),O(!0),F({value:new Set}),(async()=>{try{await B.initialize({interceptStdio:!0,watchTestDirs:!0});let{status:e,report:n}=await B.runGlobalSetup({});if(t.processGlobalReport(n),e!==`passed`)return;let r=await B.listTests({projects:G.projects,locations:G.args -
base="$(basename "$binary")" IFS=: for dir in $search; do unset IFS -
desktop="$(basename "$1")" IFS=: for dir in $search; do unset IFS -
5) "kde-open${KDE_SESSION_VERSION}" "$1" ;; 6) -
old_ifs="$IFS" IFS=: for x in $search_dirs ; do IFS="$old_ifs" -
else $browser "$1" fi -
"Nexus 10":dismissed User-agent string for the Nexus 10 device emulation preset.Reasoning
This is a long, ordinary Android user-agent string in a device-emulation descriptor table. Raw-pass compression heuristics flag such literals, and the value is a plain identifier-like string.
-
"Nexus 10 landscape":dismissed User-agent string for the Nexus 10 landscape device emulation preset.Reasoning
Same benign user-agent literal for the Nexus 10 landscape preset, a duplicate entry in a device table.
-
"Nexus 7":dismissed User-agent string for the Nexus 7 device emulation preset.Reasoning
A normal Android Chrome user-agent literal in a device descriptor table; compression-ratio flags on such text are false positives.
-
"Nexus 7 landscape":dismissed User-agent string for the Nexus 7 landscape device emulation preset.Reasoning
Same benign Nexus 7 user-agent literal in the landscape preset of the device table.
-
info
warn→ info by reviewlong-linelib/vite/traceViewer/uiMode.DgHhu0ji.js:2:1new in this release;;var E=,D=,O=likely benign Bundled Playwright UI-mode module with a long import line.Reasoning
Long import line in a bundled Playwright UI mode file. Bundlers emit long single-line import and class code, and the snippet shows only ordinary module imports.
-
info
warn→ info by reviewdynamic-executionlib/vite/traceViewer/uiMode.DgHhu0ji.js:2:3561new in this releaselet a=i?globalThis.?Buffer.::r,o=t?this..:void 0,s=o&&n?o..:void 0;e===`stdout`?:}asynclikely benign Browser-side base64 decoding of test runner stdout/stderr chunks.Reasoning
The atob call decodes base64 test output (stdout/stderr) from the Playwright reporter when a Buffer is unavailable in the browser. It only pushes the decoded text into result arrays and reporter callbacks, with no eval or fetch, so it is ordinary data handling.
-
likely benign Invokes Google Chrome Beta's binary by its escaped app-bundle path to print its version.
Reasoning
The backslashes are shell escapes for spaces in the macOS app bundle path, so the command runs the real Chrome Beta binary with --version. The flag is a parsing artifact, not concealment.
-
likely benign Removes a temporary Edge Beta installer package and runs the escaped Edge Beta binary with --version.
Reasoning
The escaped spaces in the Edge Beta app path are ordinary shell quoting. The preceding rm -rf only removes a temporary package file in /tmp, which is routine in an install script.
-
likely benign Removes a temporary Edge Dev installer package and runs the escaped Edge Dev binary with --version.
Reasoning
Same pattern as the Edge Beta script: escaped spaces in the app path and a cleanup of a /tmp installer package. Nothing hides the true command.
-
var between, maximumallowedcodepoint, InvalidCharacterError, CSSParserToken, BadStringToken, BadURLToken, WhitespaceToken, CDOToken, CDCToken, ColonToken, SemicolonToken, CommaToken, GroupingToken, OpenCurlyToken, CloseCurlyToken, OpenSquareToken, CloseSquareToken, OpenParenToken, CloseParenToken, IncludeMatchToken, Da -
urlInCSSRegex = /url\(['"]?\/\//ig; blankSnapshotUrl = "data:text/html;base64," + ; } }); -
count = -
packageRoot = import_path8..; packageJSON = ; binPath = import_path8..; }likely benign Loads the package's own package.json via a computed path inside a bundled library.Reasoning
The specifier is a path.join of the package root and the literal filename package.json, a standard way for a bundled library to read its own metadata. No network or exec behaviour is involved.
-
const binary = Array...; return ; } -
likely benign Helper that decodes a base64 string into a typed byte array.
Reasoning
This is a standard base64-to-Uint8Array helper, typical of bundled browser automation code for handling binary payloads. Decoding alone does not run anything here.
-
likely benign Syntax check that builds a Function from a serialized expression to test whether it is well-formed.
Reasoning
The Function constructor wraps the expression only to check whether it parses; the result is discarded and the catch branch rethrows or handles the error. This is a syntax-validation idiom used in serializers, not code execution, though the critical severity reflects the pattern.
-
likely benign Second syntax-validation Function construction in the serializer, throwing a not-serializable error on failure.
Reasoning
Same parse-only validation as the nearby site: the Function is built to check syntax and the error is rethrown as a serialization error. No evaluated result is used.
-
likely benign Decodes base64 file payloads into File objects for a simulated drag-and-drop DataTransfer.
Reasoning
The base64 payloads are decoded into File objects and added to a DataTransfer for simulating file drops. This is a standard browser-automation mechanism for file upload or drop testing, not a remote fetch or eval.
-
linkTarget = .; const browsersJSON = ; const descriptors = ;likely benign Loads a browsers.json descriptor file through a path derived from an install link target.Reasoning
The specifier is joined from a link target read from the browser install directory and the literal browsers.json, a configuration file. It is a data load inside a browser registry, not code loading from the network.
-
}; registry = ; } });likely benign Constructs the browser registry from the package's browsers.json file.Reasoning
The registry is built from browsers.json under the package root, which is a bundled data file. The computed path is a normal way to load a JSON config in a bundled library.
-
var z33, elementTargetDescription2, numberArg, stringArrayArg, open3, attach, close2, detach, goto, goBack2, goForward2, reload2, pressKey, type2, keydown2, keyup2, mouseMove2, mouseDown2, mouseUp2, mouseWheel2, click2, doubleClick, drag2, drop2, fill, hover2, select, fileUpload, check2, uncheck2, snapshot2, find2, gen -
continue; const packageJSON2 = ; const version3 = packageJSON2.; dirToVersion.;likely benign Requires a package.json under a browser directory to read its version string.Reasoning
The require reads package.json from a browser reference directory to get its version. This is ordinary version detection with no execution or network activity.
-
const clientInfo = ; const help = ; const argv = process.argv.; const boolean = ;likely benign Loads the bundled CLI help.json to get boolean option names.Reasoning
The require loads a bundled help.json for CLI option parsing. It is a data file inside the package, so the dynamic path is harmless.
-
likely benign Requires a Playwright library chosen by descriptor and connects to a browser of that type.
Reasoning
The require loads a Playwright library path from a descriptor and selects a browser type from it to connect. This is version-compatibility plumbing for a client library, with no decoding or spawning in the snippet.
-
program4..... -
program4....... -
program4.... -
const packageRoot = import_path..; const packageJSON = ; const binPath = import_path..;likely benign Reads the package's own package.json for metadata.Reasoning
This requires the package's own package.json via path.join from __dirname. It is a standard metadata read.
-
var packageRoot = import_path..; var packageJSON = ; var binPath = import_path..;likely benign Reads the package's own package.json for metadata.Reasoning
This is the same package.json metadata read from __dirname, a standard bundled-package pattern.
-
const clientInfo = ; const help = ; const argv = process.argv.; const boolean = ;likely benign Loads the bundled CLI help.json for option parsing.Reasoning
This loads the bundled help.json via a libPath helper, the same benign data-file load as elsewhere in the bundle.
-
-
}likely benign Polyfill base64 decode using atob into a Uint8Array.Reasoning
This is a base64 decode in a browser-or-Node polyfill for decoding data URLs or binary inputs. The decoded bytes go into a Uint8Array and are not executed, so this is a standard utility.
-
s += String.; str = ; } -
module2.. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u06dismissed Generated Unicode identifier-start regex table on one long line.Reasoning
A very long line holding a generated Unicode ID_Start regex character class. This is typical of minified or generated Unicode tables; it is not an obfuscated payload.
-
module2.. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\udismissed Generated Unicode identifier-continue regex table on one long line.Reasoning
A very long line holding a generated Unicode ID_Continue regex table, the same generated-data pattern as its neighbour.
-
numbers: -
TUVWXYZ^_`abcdefghijklmnopqrstuvwxyz{|}~\u2302\xC7\xFC\xE9\xE2\xE4\xE0\xE5\xE7\xEA\xEB\xE8\xEF\xEE\xEC\xC4\xC5\xC9\xE6\xC6\xF4\xF6\xF2\xFB\xF9\xFF\xD6\xDC\xA2\xA3\xA5\u20A7\u0192\xE1\xED\xF3\xFA\xF1\xD1\xAA\xBA\xBF\u2310\xAC\xBD\xBC\xA1\xAB\xBB\u2591\u2592\u2593\u2502\u2524\u2561\u2562\u2556\u2555\u2563\u2551\u2557likely benign Escape-encoded character lookup table inside a bundled encoding library.Reasoning
A run of \xNN escapes in a bundled code-page table (CP437 box-drawing and accented characters) is a legitimate character-mapping table in an encoding library bundle.
-
TUVWXYZ^_`abcdefghijklmnopqrstuvwxyz{|}~\u2302\xC7\xFC\xE9\xE2\xE4\xE0\xE5\xE7\xEA\xEB\xE8\xEF\xEE\xEC\xC4\xC5\xC9\xE6\xC6\xF4\xF6\xF2\xFB\xF9\xFF\xD6\xDC\xA2\xA3\xA5\u20A7\u0192\xE1\xED\xF3\xFA\xF1\xD1\xAA\xBA\xBF\u2310\xAC\xBD\xBC\xA1\xAB\xBB\u2591\u2592\u2593\u2502\u2524\u2561\u2562\u2556\u2555\u2563\u2551\u2557likely benign Second escape-encoded code-page table in the bundled encoding library.Reasoning
Same CP437-style character mapping table repeated in another encoding table within the bundle; benign data, not obfuscated logic.
-
sourceCode = this...; const makeValidate = ; const validate2 = ; this..;likely benign ajv-style validator compilation using new Function on generated source.Reasoning
This is ajv's standard schema-compilation code generating a validator via new Function from schema-derived source. It is a known dynamic-execution pattern in a validator library, not malicious, but it is still a runtime code construction the scanner rightly flags; the body is generated from schemas rather than attacker-controlled input in the usual case.
-
"uri-reference": /^? -
ipv6: /^ -
var URI = /^ -
sourceCode = this...; const makeValidate = ; const validate2 = ; this..;likely benign Duplicate ajv validator compilation via new Function in the bundle.Reasoning
Identical ajv validator-compilation code duplicated in another copy of the bundle; same legitimate schema-compiler behavior.
-
const reversed = Object. -
var ambiguousRanges =likely benign Minified Unicode width range data array on one long line.Reasoning
A very long line holding a constant array of East Asian ambiguous-width code point ranges is typical of generated Unicode data tables in a bundled library.
-
var wideRanges = -
likely benign Standard base64-to-bytes helper using atob.
Reasoning
base64ToUint8Array is a routine helper decoding binary data for use in a bundle; atob alone with no eval or fetch chain is ordinary.
-
} return ; } -
likely benign atob used in try/catch to check whether a string is valid base64.
Reasoning
atob inside a try/catch used to validate base64 input is a normal validation pattern, typical of JWT or utility code.
-
return false; const parsedHeader = JSON.; return false;likely benign JWT header decoding via atob and JSON.parse.Reasoning
Decoding a JWT header with atob and JSON.parse is standard JWT parsing; the result is only inspected for typ, not executed.
-
var ipv6Regex = /^ -
var ipv6CidrRegex = /^ -
const base643 = header...; const decoded = JSON.; return false;likely benign JWT payload base64url decode and JSON parse.Reasoning
Base64url decoding of a JWT segment into JSON with validation; no execution of the decoded content.
-
likely benign atob used in try/catch for base64 validity checking.
Reasoning
atob in try/catch used only to validate base64, a common idiom in utility libraries.
-
ipv6Cidr: /^ -
, , this. = 0, this. = 1, this. = 2, , , , , , , __privateA -
_readyState = /* @__PURE__ */ , _url2 = /* @__PURE__ */ , _redirectUrl = /* @__PURE__ */ , _withCredentials = /* @__PURE__ */ , _fetch = /* @__PURE__ */ , _reconnectInterval = /* @__PURE__ */ , _reconnectTimer = /* @__PURE__ */ , -
const buffer = ..; return ...; } -
} const credentials = ; headers.; } -
;var n=likely benign Minified CodeMirror library bundle for the Vite dashboard.Reasoning
Minified CodeMirror editor bundle; long lines are a product of minification and the code is the well-known CodeMirror library.
-
tion var -
Height>2&&!)}var n=He?:;return n.,n}var We; -
n We;var t=,n=.,r=.;return ,!n||n.==n.?!1:We=r.-n.<3}var Ke=` -
`,t);i==-1&&(i=e.length);var a=e.slice(t,e.charAt(i-1)==`\r`?i-1:i),o=a.indexOf(`\r`);o==-1?(n.push(a),t=i+1):(n.push(a.slice(0,o)),t+=o+1)}return n},qe=window.getSelection?function(e){try{return e.selectionStart!=e.selectionEnd}catch{return!1}}:function(e){var t;try{t=e.ownerDocument.selection.createRange()}catch{}retlikely benign Minified CodeMirror code line with ordinary editor logic.Reasoning
Another long minified line within the same CodeMirror bundle; consistent with minified library output and no suspicious behavior shown.
-
`?(_=f.appendChild(k(`span`,m[0]==`\r`?`␍`:``,`cm-invalidchar`)),_.setAttribute(`cm-text`,m[0]),e.col+=1):(_=e.cm.options.specialCharPlaceholder(m[0]),_.setAttribute(`cm-text`,m[0]),o&&s<9?f.appendChild(k(`span`,[_])):f.appendChild(_),e.col+=1);e.map.push(e.pos,e.pos+1,_),e.pos++}}if(e.trailingSpace=l.charCodeAt(tlikely benign Minified CodeMirror editor code in a Vite dashboard bundle.Reasoning
The line is a 22k-character minified CodeMirror bundle chunk. Long lines are expected in minified output, and the snippet is ordinary editor rendering code for invalid characters and text spans. The raw long-line signal is a formatting artifact with no obfuscation intent.
-
height: `+(r-t)+`px`))}function d(t,n,r){var a=K(i,t),o=a.text.length,d,f;function p(n,r){return wr(e,J(t,n),`div`,a,r)}function m(t,n,r){var i=Ar(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==`after`?i.begin:i.end-(/\s/.test(a.text.charAt(i.end-1))?2:1),o)[o]}var h=H(a,i.likely benign Minified CodeMirror layout and cursor-position code.Reasoning
This is a 4k-character line from the same minified CodeMirror bundle. The snippet shows standard layout and cursor-positioning logic. The long-line flag reflects minification, not malicious content.
-
ht)&&,i!=null&&!h) -
left: `+t.left+`px; width: `+Math.max(2,t.right-t.left)+`px;`);e.display.lineSpace.appendChild(o),o.scrollIntoView(i),e.display.lineSpace.removeChild(o)}}}function ui(e,t,n,r){r??=0;var i;!e.options.lineWrapping&&t==n&&(n=t.sticky==`before`?J(t.line,t.ch+1,`before`):t,t=t.ch?J(t.line,t.sticky==likely benign Minified CodeMirror selection and scroll-into-view code.Reasoning
A 52k-character line in the minified CodeMirror bundle. The snippet is DOM selection and scrolling code, a normal part of the editor. No dynamic execution, encoding, or network activity appears.
-
`},setDirection:Vi(function(e){e!=`rtl`&&(e=`ltr`),e!=this.direction&&(this.direction=e,this.iter(function(e){return e.order=null}),this.cm&&Ea(this.cm))})}),ko.prototype.eachLine=ko.prototype.iter;var Ao=0;function jo(e){var t=this;if(Po(t),!(G(t,e)||Zn(t.display,e))){Fe(e),o&&(Ao=+new Date);var n=Hr(t,e,!0),r=e.dataTlikely benign Minified CodeMirror text-direction and editor-API code.Reasoning
The snippet is CodeMirror's minified direction and mode API setup, followed by ordinary line-iteration and editor-update code. Long length comes from minification in a library bundle.
-
`,`start`)},toggleOverwrite:function(e){return e.toggleOverwrite()}};function is(e,t){var n=K(e.doc,t),r=on(n);return r!=n&&(t=q(r)),ts(!0,e,r,t,1)}function as(e,t){var n=K(e.doc,t),r=sn(n);return r!=n&&(t=q(r)),ts(!0,e,n,t,-1)}function os(e,t){var n=is(e,t.line),r=K(e.doc,n.line),i=H(r,e.doc.direction);if(!i||i[0].levlikely benign Minified CodeMirror cursor-motion and command helpers.Reasoning
The snippet shows minified CodeMirror cursor-motion helpers and key-map entries. These are standard editor functions with no signs of obfuscation intent beyond the minification every bundle has.
-
`)&&(m=h=J(m.line,0)));var g={from:m,to:h,text:l?l[f%l.length]:c,origin:i||(s?`paste`:e.state.cutIncoming>o?`cut`:`+input`)};ro(e.doc,g),In(e,`inputRead`,e,g)}t&&!s&&Xs(e,t),mi(e),e.curOp.updateInput<2&&(e.curOp.updateInput=d),e.curOp.typing=!0,e.state.pasteIncoming=e.state.cutIncoming=-1}function Ys(e,t){var n=e.clipblikely benign Minified CodeMirror paste and input-handling code.Reasoning
The snippet is CodeMirror's paste and input-read handling, which is ordinary clipboard and change-event logic in a minified library bundle. The long line is a minification artifact.
-
`);var l=ee(F(i));ne(c),setTimeout(function(){r.display.lineSpace.removeChild(s),l.focus(),l==i&&n.showPrimarySelection()},50)}}U(i,`copy`,o),U(i,`cut`,o)},$.prototype.screenReaderLabelChanged=function(e){e?this.div.setAttribute(`aria-label`,e):this.div.removeAttribute(`aria-label`)},$.prototype.prepareSelection=functilikely benign Minified CodeMirror copy and cut handling.Reasoning
This is minified CodeMirror clipboard and copy/cut handling with a focus-restoring timeout. The behaviour is standard for an editor, and the raw long-line signal is not evidence of malice.
-
`),ne(i))}else return;e.type==`cut`&&(r.state.cutIncoming=+new Date)}}U(i,`cut`,a),U(i,`copy`,a),U(e.scroller,`paste`,function(t){if(!(Zn(e,t)||G(r,t))){if(!i.dispatchEvent){r.state.pasteIncoming=+new Date,n.focus();return}var a=new Event(`paste`);a.clipboardData=t.clipboardData,i.dispatchEvent(a)}}),U(e.lineSpace,`sellikely benign Minified CodeMirror clipboard event listeners.Reasoning
The snippet contains CodeMirror paste, cut and copy event wiring in a minified bundle. These are ordinary event listeners for an editor component, with no decoding, execution or network use.
-
r a=i.;return this.,this..}++c;return -
outline: none; border-width: 0; outline: none; overflow: hidden; opacity: .05; filter: ;`;var m;c&&(m=i.ownerDocument.defaultView.scrollY),r.input.focus(),c&&i.ownerDocument.defaultView.scrollTo(null,m),r.input.reset(),n.somethingSelected()||(i.value=t.prevInput=` `),t.contextMenuPending=g,r.selFolikely benign Minified CodeMirror hidden-textarea input handling.Reasoning
A 121k-character line in the CodeMirror bundle. The snippet shows the hidden textarea used for context menu and input handling, a known editor technique for clipboard support. It is not an attack pattern, and the length is due to minification.
-
t!=null)} -
value=`⇚`,i.=a,t.=e?``:`⟨U+200B⟩`,i.=1,i.=a.,r.=n..}} -
art==0&&i.>0&&t.==`⟨U+200B⟩`?:e++<10?r.=:};r.=}}},lc. -
`;t.replaceSelection(e+e,null),u(t,-1),a=t.listSelections();for(var n=0;n<a.length;n++){var r=a[n].head.line;t.indentLine(r,null,!0),t.indentLine(r+1,null,!0)}})}function u(e,t){for(var n=[],r=e.listSelections(),i=0,a=0;a<r.length;a++){var o=r[a];o.head==e.getCursor()&&(i=a);var s=o.head.ch||t>0?{line:o.head.line,ch:o.likely benign Minified CodeMirror indentation and selection helpers.Reasoning
The snippet is CodeMirror indentation and selection logic for multi-line edits, consistent with a standard editor add-on. The long-line flag reflects minification only.
-
`),v=d+g.length,y=g[g.length-1].length;return{from:t(v,y),to:t(v+_.length-1,_.length==1?y+_[0].length:_[_.length-1].length),match:h}}}}var u,d;String.prototype.normalize?(u=function(e){return e.normalize(`NFD`).toLowerCase()},d=function(e){return e.normalize(`NFD`)}):(u=function(e){return e.toLowerCase()},d=function(e)likely benign Minified CodeMirror search-addon code with a long line.Reasoning
Long line in a minified CodeMirror search/regex module. Minifiers routinely produce long lines, and the snippet shows ordinary search and normalization code with no encoded payloads or execution.
-
`:t==`r`?`\r`:t==`t`?` `:t==`\\`?`\\`:e})}function u(e){var t=e.match(/^\/(.*)\/([a-z]*)$/);if(t)try{e=new RegExp(t[1],t[2].indexOf(`i`)==-1?``:`i`)}catch{}else e=l(e);return(typeof e==`string`?e==``:e.test(``))&&(e=/x^/),e}function d(e,n,r){n.queryText=r,n.query=u(r),e.removeOverlay(n.overlay,i(n.query)),n.overlay=t(nlikely benign Minified CodeMirror search and replace logic.Reasoning
Long line from the same minified CodeMirror bundle. The snippet is regex-query and replacement logic typical of the editor's search feature.
-
var e=Object.,t=Object.,n=Object.,r=Object.,i=Object.,a=.,,likely benign Minified bundler runtime helpers in a Vite dashboard bundle.Reasoning
A 20 KB line of minified bundled JavaScript that begins with module-interop helpers (Object.defineProperty, __esModule-style exports). This is standard bundler output and not a sign of obfuscation with malicious intent.
-
`+e.stack}}var _e=Object.prototype.hasOwnProperty,ve=t.unstable_scheduleCallback,ye=t.unstable_cancelCallback,be=t.unstable_shouldYield,xe=t.unstable_requestPaint,Se=t.unstable_now,Ce=t.unstable_getCurrentPriorityLevel,we=t.unstable_ImmediatePriority,Te=t.unstable_UserBlockingPriority,Ee=t.unstable_NormalPriority,De=t.likely benign Minified React scheduler and reconciler code.Reasoning
A 132 KB minified line containing the React scheduler and reconciler, a well-known library. Length alone is expected for a production React build.
-
`).replace(kd,``)}function jd(e,t){return t=Ad(t),Ad(e)===t}function Md(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Ht(e,r):(typeof r==`number`||typeof r==`bigint`)&&t!==`body`&&Ht(e,``+r);break;case`className`:Et(e,`likely benign Minified React DOM attribute-handling code.Reasoning
A 165 KB minified line of React DOM property-handling code (attribute setting for children, className and tabIndex). This is a standard library build, not obfuscation.
-
n`){e.setAttribute(n,`javascript:throw -
r}=this,i=,a=Math.*4,o=,s=e-Math.*3,c=0;i=o.,c++;return c<i.?i.:i}},$i=likely benign A base64 decoder class that converts data URIs into byte arrays.Reasoning
The atob call sits inside a Blob-like class that builds a data: URI and slices base64 content into a Uint8Array. This is a routine base64 decoding helper for a bundled library, not a dropper. No eval or network fetch is visible in the snippet.
-
.;r.&&}},ea= -
=:t.+=r)}},ea=,ta -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),Mo=jo.length==256;function No(e){if(Mo){let t=``;for(let n=0;n<e.length;n++)t+=jo[e[n]];return t}else return new TextDecoder().decode(e)}function Po(e,t){return t&&t.trim().toLowerCase()==`cp… -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),Mo=jo.length==256;function No(e){if(Mo){let t=``;for(let n=0;n<e.length;n++)t+=jo[e[n]];return t}else return new TextDecoder().decode(e)}function Po(e,t){return t&&t.trim().toLowerCase()==`cp… -
var e=Object.,t=Object.,n=Object.,r=Object.,i=Object.,a=.,,likely benign Minified bundler helper code in an HTML report script.Reasoning
A minified bundle head that matches the vendored runtime helpers, consistent with a bundled HTML report. Long lines are expected from minified output.
-
r}=this,i=,a=Math.*4,o=,s=e-Math.*3,c=0;i=o.,c++;return c<i.?i.:i}},lr=likely benign A base64 decoder that builds data URIs for embedded content.Reasoning
The same base64-to-byte-array decoder as in the dashboard bundle, building data URIs and decoding base64 for embedded content. The snippet shows no eval, Function construction, or network access.
-
.;r.&&}},ur= -
=:t.+=r)}},ur=,dr -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),Vr=Br.length==256;function Hr(e){if(Vr){let t=``;for(let n=0;n<e.length;n++)t+=Br[e[n]];return t}else return new TextDecoder().decode(e)}function Ur(e,t){return t&&t.trim().toLowerCase()==`cp… -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),Vr=Br.length==256;function Hr(e){if(Vr){let t=``;for(let n=0;n<e.length;n++)t+=Br[e[n]];return t}else return new TextDecoder().decode(e)}function Ur(e,t){return t&&t.trim().toLowerCase()==`cp… -
`+e.stack}}var xe=Object.prototype.hasOwnProperty,Se=t.unstable_scheduleCallback,Ce=t.unstable_cancelCallback,we=t.unstable_shouldYield,Te=t.unstable_requestPaint,Ee=t.unstable_now,De=t.unstable_getCurrentPriorityLevel,Oe=t.unstable_ImmediatePriority,ke=t.unstable_UserBlockingPriority,Ae=t.unstable_NormalPriority,je=t.likely benign Minified React scheduler code in the HTML report.Reasoning
A 132 KB minified React scheduler/reconciler line, the same library code seen in the dashboard bundle.
-
`).replace(Ad,``)}function Md(e,t){return t=jd(t),jd(e)===t}function $(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Kt(e,r):(typeof r==`number`||typeof r==`bigint`)&&t!==`body`&&Kt(e,``+r);break;case`className`:At(e,`likely benign Minified React DOM attribute-handling code in the HTML report.Reasoning
A 67 KB minified line of React DOM property handling, consistent with a standard production library build.
-
)};return e=r,r}var ua=//g; -
dismissed Minified JavaScript bundle code for the Playwright-style HTML report viewer.
Reasoning
A 12.5K-character line is the signature of a minified React bundle (hooks, state setters, template literals), which is normal for a built HTML report. The raw long-line signal is noise here, not obfuscation.
-
className:`screenshot`,src:`data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAYgAAADqCAYAAAC4CNLDAAAMa2lDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnluSkJDQAqFICb0J0quUEFoEAamCjZAEEkqMCUHFhqio4NpFFCu6KqLoWgBZVMReFsXeFwsqK+tiQVFU3oQEdN1Xvne+b+7898yZ/5Q7c+8dADR7uRJJLqoFQJ44XxofEcIcm5rGJHUAMjABVOAMSFyeTMKKi4sGUAb7v8v7mwBR9NecFFz/HP+voslikely benign A base64-encoded PNG screenshot embedded as a data URI in the HTML report.Reasoning
The data URI is a PNG (the iVBORw0KGgo header) embedded as an img src for a screenshot in a test report. Embedded image assets are a normal way to ship report content. The snippet shows no decoding into code or execution, so the base64 signal is a false positive in this context.
-
`)[0];if(!(!n.includes(`toHaveScreenshot`)&&!n.includes(`toMatchSnapshot`)))return t.find(t=>e.includes(t.name))}function rs(e,t){return(e.subtitle?`$ $`:e.title).toLowerCase().includes(t.toLowerCase())}function is(e,t){return e.steps.some(e=>rs(e,t)||is(e,t))}function as(e,t){let n=e.toLowerCase()dismissed Minified helper functions for filtering and searching test steps in the report.Reasoning
A 24K-character line in a minified bundle. The code is ordinary string and function manipulation for searching report steps. The long line is a formatting artifact, not evidence of malice.
-
;var n=dismissed Minified CodeMirror editor library module wrapper.Reasoning
This is the UMD-wrapped, minified CodeMirror editor library, which is a well-known public dependency. Long lines are standard for this kind of build output.
-
tion var -
Height>2&&!)}var n=He?:;return n.,n}var We; -
n We;var t=,n=.,r=.;return ,!n||n.==n.?!1:We=r.-n.<3}var Ke=` -
`,t);i==-1&&(i=e.length);var a=e.slice(t,e.charAt(i-1)==`\r`?i-1:i),o=a.indexOf(`\r`);o==-1?(n.push(a),t=i+1):(n.push(a.slice(0,o)),t+=o+1)}return n},qe=window.getSelection?function(e){try{return e.selectionStart!=e.selectionEnd}catch{return!1}}:function(e){var t;try{t=e.ownerDocument.selection.createRange()}catch{}retdismissed Minified CodeMirror text-line handling and selection helpers.Reasoning
The snippet is CodeMirror's text-splitting and selection logic. It is ordinary editor code with no decoding, dynamic execution or network activity, and the long line comes from minification.
-
`?(_=f.appendChild(k(`span`,m[0]==`\r`?`␍`:``,`cm-invalidchar`)),_.setAttribute(`cm-text`,m[0]),e.col+=1):(_=e.cm.options.specialCharPlaceholder(m[0]),_.setAttribute(`cm-text`,m[0]),o&&s<9?f.appendChild(k(`span`,[_])):f.appendChild(_),e.col+=1);e.map.push(e.pos,e.pos+1,_),e.pos++}}if(e.trailingSpace=l.charCodeAt(tdismissed Minified CodeMirror rendering code for special characters.Reasoning
The snippet is CodeMirror's DOM rendering code for special and invalid characters. It is legitimate editor logic inside a minified vendored bundle.
-
height: `+(r-t)+`px`))}function d(t,n,r){var a=K(i,t),o=a.text.length,d,f;function p(n,r){return wr(e,J(t,n),`div`,a,r)}function m(t,n,r){var i=Ar(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==`after`?i.begin:i.end-(/\s/.test(a.text.charAt(i.end-1))?2:1),o)[o]}var h=H(a,i.dismissed Minified CodeMirror layout and cursor-coordinate code.Reasoning
The snippet is CodeMirror's measurement and cursor-positioning code, consistent with a vendored editor library. The long line is a minification artifact.
-
ht)&&,i!=null&&!h) -
left: `+t.left+`px; width: `+Math.max(2,t.right-t.left)+`px;`);e.display.lineSpace.appendChild(o),o.scrollIntoView(i),e.display.lineSpace.removeChild(o)}}}function ui(e,t,n,r){r??=0;var i;!e.options.lineWrapping&&t==n&&(n=t.sticky==`before`?J(t.line,t.ch+1,`before`):t,t=t.ch?J(t.line,t.sticky==dismissed Large minified CodeMirror selection and cursor-coordinate routine.Reasoning
The 52K-character line is a large minified CodeMirror function covering cursor and selection handling. This is expected for a minified vendored library and shows no sign of obfuscated malicious intent.
-
`},setDirection:Vi(function(e){e!=`rtl`&&(e=`ltr`),e!=this.direction&&(this.direction=e,this.iter(function(e){return e.order=null}),this.cm&&Ea(this.cm))})}),ko.prototype.eachLine=ko.prototype.iter;var Ao=0;function jo(e){var t=this;if(Po(t),!(G(t,e)||Zn(t.display,e))){Fe(e),o&&(Ao=+new Date);var n=Hr(t,e,!0),r=e.dataTdismissed Minified CodeMirror text-direction and line-iteration API code.Reasoning
The snippet shows CodeMirror's text-direction and line-iteration API, which is ordinary editor code. The long line is due to minification.
-
`,`start`)},toggleOverwrite:function(e){return e.toggleOverwrite()}};function is(e,t){var n=K(e.doc,t),r=on(n);return r!=n&&(t=q(r)),ts(!0,e,r,t,1)}function as(e,t){var n=K(e.doc,t),r=sn(n);return r!=n&&(t=q(r)),ts(!0,e,n,t,-1)}function os(e,t){var n=is(e,t.line),r=K(e.doc,n.line),i=H(r,e.doc.direction);if(!i||i[0].levdismissed Minified CodeMirror bidi and cursor-movement helpers.Reasoning
The snippet is CodeMirror's bidirectional-text and cursor-movement logic, consistent with a standard vendored editor library. The long line is a minification artifact.
-
`)&&(m=h=J(m.line,0)));var g={from:m,to:h,text:l?l[f%l.length]:c,origin:i||(s?`paste`:e.state.cutIncoming>o?`cut`:`+input`)};ro(e.doc,g),In(e,`inputRead`,e,g)}t&&!s&&Xs(e,t),mi(e),e.curOp.updateInput<2&&(e.curOp.updateInput=d),e.curOp.typing=!0,e.state.pasteIncoming=e.state.cutIncoming=-1}function Ys(e,t){var n=e.clipblikely benign Minified CodeMirror editor code with an 11k-character line.Reasoning
Raw-pass long-line signal on a minified CodeMirror build. The snippet is ordinary editor clipboard and input handling with no encoded payloads or execution primitives. Minified bundles routinely have long lines.
-
`);var l=ee(F(i));ne(c),setTimeout(function(){r.display.lineSpace.removeChild(s),l.focus(),l==i&&n.showPrimarySelection()},50)}}U(i,`copy`,o),U(i,`cut`,o)},$.prototype.screenReaderLabelChanged=function(e){e?this.div.setAttribute(`aria-label`,e):this.div.removeAttribute(`aria-label`)},$.prototype.prepareSelection=functilikely benign Minified CodeMirror clipboard and selection code.Reasoning
Long line in a minified CodeMirror bundle. The snippet shows copy/cut handling and screen-reader label logic, which is legitimate editor behaviour.
-
`),ne(i))}else return;e.type==`cut`&&(r.state.cutIncoming=+new Date)}}U(i,`cut`,a),U(i,`copy`,a),U(e.scroller,`paste`,function(t){if(!(Zn(e,t)||G(r,t))){if(!i.dispatchEvent){r.state.pasteIncoming=+new Date,n.focus();return}var a=new Event(`paste`);a.clipboardData=t.clipboardData,i.dispatchEvent(a)}}),U(e.lineSpace,`sellikely benign Minified CodeMirror paste and cut event handlers.Reasoning
Long line from the same minified CodeMirror bundle. The snippet is paste and cut event wiring with no suspicious decoding or network activity.
-
r a=i.;return this.,this..}++c;return -
outline: none; border-width: 0; outline: none; overflow: hidden; opacity: .05; filter: ;`;var m;c&&(m=i.ownerDocument.defaultView.scrollY),r.input.focus(),c&&i.ownerDocument.defaultView.scrollTo(null,m),r.input.reset(),n.somethingSelected()||(i.value=t.prevInput=` `),t.contextMenuPending=g,r.selFolikely benign Minified CodeMirror input and context-menu handling code.Reasoning
A 121k-character line is typical of a minified editor bundle. The snippet shows textarea and context-menu focus handling, consistent with CodeMirror's input layer.
-
t!=null)} -
value=`⇚`,i.=a,t.=e?``:`⟨U+200B⟩`,i.=1,i.=a.,r.=n..}} -
art==0&&i.>0&&t.==`⟨U+200B⟩`?:e++<10?r.=:};r.=}}},lc. -
`;t.replaceSelection(e+e,null),u(t,-1),a=t.listSelections();for(var n=0;n<a.length;n++){var r=a[n].head.line;t.indentLine(r,null,!0),t.indentLine(r+1,null,!0)}})}function u(e,t){for(var n=[],r=e.listSelections(),i=0,a=0;a<r.length;a++){var o=r[a];o.head==e.getCursor()&&(i=a);var s=o.head.ch||t>0?{line:o.head.line,ch:o.likely benign Minified CodeMirror indentation and selection logic.Reasoning
Long minified line. The snippet is indentation and selection logic for an editor, with no dynamic execution or encoded blobs.
-
`),v=d+g.length,y=g[g.length-1].length;return{from:t(v,y),to:t(v+_.length-1,_.length==1?y+_[0].length:_[_.length-1].length),match:h}}}}var u,d;String.prototype.normalize?(u=function(e){return e.normalize(`NFD`).toLowerCase()},d=function(e){return e.normalize(`NFD`)}):(u=function(e){return e.toLowerCase()},d=function(e)likely benign Minified CodeMirror search and string-normalization code.Reasoning
Long minified line. The snippet is Unicode normalization and search matching, a standard CodeMirror search addon pattern.
-
`:t==`r`?`\r`:t==`t`?` `:t==`\\`?`\\`:e})}function u(e){var t=e.match(/^\/(.*)\/([a-z]*)$/);if(t)try{e=new RegExp(t[1],t[2].indexOf(`i`)==-1?``:`i`)}catch{}else e=l(e);return(typeof e==`string`?e==``:e.test(``))&&(e=/x^/),e}function d(e,n,r){n.queryText=r,n.query=u(r),e.removeOverlay(n.overlay,i(n.query)),n.overlay=t(nlikely benign Minified CodeMirror regex search and replace helpers.Reasoning
Long minified line. The snippet builds regex search and replace helpers for the editor's search addon, which is ordinary behaviour.
-
var e=Object.,t=Object.,n=Object.,r=Object.,i=Object.,a=.,,likely benign Minified bundler module-interop runtime helpers.Reasoning
Minified bundler runtime preamble (esbuild-style __defProp/__getOwnPropDesc helpers and lazy CommonJS wrappers). This is standard module-interop code, and the long-line signal is only a result of minification.
-
`+e.stack}}var Ae=Object.prototype.hasOwnProperty,je=t.unstable_scheduleCallback,Me=t.unstable_cancelCallback,Ne=t.unstable_shouldYield,Pe=t.unstable_requestPaint,Fe=t.unstable_now,Ie=t.unstable_getCurrentPriorityLevel,Le=t.unstable_ImmediatePriority,k=t.unstable_UserBlockingPriority,Re=t.unstable_NormalPriority,ze=t.ulikely benign Minified React scheduler and runtime code.Reasoning
A 131k-character line in a minified React bundle. The snippet is React scheduler and reconciler bindings, which is expected production build output.
-
`).replace(Ad,``)}function Md(e,t){return t=jd(t),jd(e)===t}function $(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Qt(e,r):(typeof r==`number`||typeof r==`bigint`)&&t!==`body`&&Qt(e,``+r);break;case`className`:It(e,`likely benign Minified React DOM property-update code.Reasoning
Long minified line. The snippet is React DOM property-setting logic (attribute and children handling), which is standard framework code.
-
`:this.value}},St=class extends j{constructor(...e){super(...e),this.value=``}ASCIIMatch(e){return this.value.toLowerCase()===e.toLowerCase()}toJSON(){let e=this.constructor.prototype.constructor.prototype.toJSON.call(this);return e.value=this.value,e}},Ct=class extends St{constructor(e){super(),this.tokenType=`IDENT`,dismissed A 32k-character minified line in a bundled yaml-library asset.Reasoning
The raw long-line signal only measures line length. The snippet is minified JavaScript from the yaml library (class definitions, toJSON, ASCIIMatch) inside a bundled Vite asset. Minified bundles routinely have very long lines, and nothing here suggests obfuscated payloads or malicious behaviour.
-
`)}};kn.defaultYaml={explicit:!1,version:`1.2`},kn.defaultTags={"!!":`tag:yaml.,2002:`};function An(e){if(/[\x00-\x19\s,[\]{}]/.test(e)){let t=`Anchor must not contain whitespace or control characters: $`;throw Error(t)}return!0}function jn(e){let t=new Set;return bn(e,{Value(e,n){n.anchor&&t.add(dismissed A 7k-character minified line from the bundled yaml library.Reasoning
This is a raw long-line hit on minified yaml-library code (anchor validation, error messages). Line length alone is not evidence of obfuscation in a bundled asset.
-
`))return sr(e,t,n,r);if(tr(a)){if(c===``)return t.forceBlockIndent=!0,sr(e,t,n,r);if(s&&c===l)return ar(a,t)}let d=a.replace(/\n+/g,`$&\n$`);if(o){let e=e=>e.default&&e.tag!==`tag:yaml.,2002:str`&&e.test?.test(d),{compat:n,tags:r}=t.doc.schema;if(r.some(e)||n?.some(e))return ar(a,t)}return s?d:Qn(d,c,Yn,er(t,!1)dismissed A 4k-character minified line implementing yaml string serialization.Reasoning
The snippet is yaml string-stringifying logic with regex replacements and folding. It is ordinary minified library code, and the long line is the only signal.
-
`)&&(S=``);return g+=S+x,n.inFlow?b&&r&&r():y&&!b?g+=Jn(g,n.indent,l(y)):h&&i&&i(),g}function hr(e,t){(e===`debug`||e===`warn`)&&console.warn(t)}var gr=`<<`,_r={identify:e=>e===gr||typeof e==`symbol`&&e.description===gr,default:`key`,tag:`tag:yaml.,2002:merge`,test:/^<<$/,resolve:()=>Object.assign(new I(Symbol(gr)),dismissed A 3k-character minified line from the bundled yaml library.Reasoning
The snippet is yaml merge-key and stringify code in a minified bundle. The raw long-line signal reflects bundling, not malicious intent.
-
`;return`$\n$$`}else return`$$$$$`}function kr({indent:e,options:{commentString:t}},n,r,i){if(r&&i&&(r=r.replace(/^\n+/,``)),r){let i=qn(t(r),e);n.push(i.trimStart())}}function Ar(e,t){let n=N(t)?t.value:t;for(let r of e)if(M(r)&&(r.key===t||r.key===n||N(r.key)&&r.key.value===n))returndismissed A 7.8k-character minified line from the bundled yaml library.Reasoning
This is minified yaml document-printing code with comment handling and map lookups. It is a raw long-line hit with no suspicious behaviour.
-
y`,resolve(e,t){if(typeof atob==``){let t=atob(e.replace(/[\n\r]/g,``)),n=new Uint8Array(t.length);for(let e=0;e<t.length;++e)n[e]=t.charCodeAt(e);return n}else return t(`This environment does not support reading binary tags; either Buffer or atob is required`),e},stringify({comment:e,type:t,value:n},r,i,a){if(likely benign atob used in the yaml library's binary-tag resolver to decode base64 values into bytes.Reasoning
The atob call is the yaml library's !!binary tag resolver. It decodes base64 YAML binary values into a Uint8Array and falls back to an error when atob is unavailable. It is a data-decoding step inside a parser, not a fetch or eval, so it is a legitimate pattern.
-
t=0;t<o.;++t)e+=String.;s=}throw ; -
`:` `)}return lr({comment:e,type:t,value:s},r,i,a)}};function ti(e,t){if(hn(e))for(let n=0;n<e.items.length;++n){let r=e.items[n];if(!M(r)){if(mn(r)){r.items.length>1&&t(`Each pair must have its own sequence indicator`);let e=r.items[0]||new Tr(new I(null));if(r.commentBefore&&(e.key.commentBefore=e.key.commentBefore?`dismissed A 9.7k-character minified line from the bundled yaml library.Reasoning
This is minified yaml AST-walking code (pair and sequence handling, warnings). The raw long-line signal reflects bundling only.
-
`}var Pi=class e{constructor(e,t,n){this.commentBefore=null,this.comment=null,this.errors=[],this.warnings=[],Object.defineProperty(this,dn,{value:on});let r=null;typeof t==``||Array.isArray(t)?r=t:n===void 0&&t&&(n=t,t=void 0);let i=Object.assign({intAsBigInt:!1,keepSourceTokens:!1,logLevel:`warn`,prettyErrorsdismissed A 4.9k-character minified line from the bundled yaml library constructor.Reasoning
This is the minified yaml Document constructor and options setup. A long line here is expected for a bundle and carries no malicious indication.
-
`),o=n+o}if(/[^ ]/.test(o)){let e=1,t=n.linePos[1];t?.line===r&&t.col>i&&(e=Math.max(1,Math.min(t.col-i,80-a)));let s=` `.repeat(a)+`^`.repeat(e);n.message+=`:\n\n$\n$\n`}};function Li(e,{flow:t,indicator:n,next:r,offset:i,onError:a,parentIndent:o,startOnNewline:s}){let c=!1,l=s,u=s,d=``,f=``,p=!1,m=!1,h=null,g=ndismissed A 2.4k-character minified line from the bundled yaml parser.Reasoning
The snippet is yaml error-pointer formatting and flow-collection parsing in a minified bundle. Only line length is flagged.
-
`+_.comment:g.comment=_.comment);let e=new Tr(g);n.options.keepSourceTokens&&(e.srcToken=a),o.items.push(e)}}return c&&c<s&&i(c,`IMPOSSIBLE`,`Map comment trailing content`),o.range=[r.offset,s,c??s],o}function Ui({composeNode:e,composeEmptyNode:t},n,r,i,a){let o=new((a?.nodeClass)??Nr)(n.schema);n.atRoot&&=!1,n.atdismissed A 2.1k-character minified line from the bundled yaml library.Reasoning
The snippet is yaml collection-composition code (map comments, node ranges) in a minified bundle. Long lines are normal here and nothing suggests malice.
-
`}let m=r+i.length+t.source.length;return{value:d,type:a,comment:i.comment,range:[r,m,m]}}function Zi({offset:e,props:t},n,r){if(t[0].type!==`block-scalar-header`)return r(t[0],`IMPOSSIBLE`,`Block scalar header not found`),null;let{source:i}=t[0],a=i[0],o=0,s=``,c=-1;for(let t=1;t<i.length;++t){let n=i[t];if(!s&&(n===`likely benign Minified YAML parser code in a Vite-built recorder bundle flagged for line length.Reasoning
Long-line signal on a minified bundled YAML parser (Vite build output). Raw pass long-line findings on minified JS are expected and carry no malicious indication.
-
`,r:`\r`,t:` `,v:`\v`,N:`⟨U+0085⟩`,_:`\xA0`,L:`\u2028`,P:`\u2029`," ":` `,'"':`"`,"/":`/`,"\\":`\\`," ":` `};function oa(e,t,n,r){let i=e.substr(t,n),a=i.length===n&&/^[0-9a-fA-F]+$/.test(i)?parseInt(i,16):NaN;try{return String.fromCodePoint(a)}catch{let i=e.substr(t-2,n+2);return r(t-2,`BAD_DQ_ESCAPE`,`Invalid escape sequenlikely benign Minified YAML escape-sequence handling in a bundled recorder asset.Reasoning
Long line from minified YAML parser escape-handling code in a bundled asset; no dynamic execution or obfuscated payload is shown.
-
`)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}var _a=class{constructor(e={}){this.doc=null,this.atDirectives=!1,this.prelude=[],this.errors=[],this.warnings=[],this.onError=(e,t,n,r)=>{let i=ha(e);r?this.warnings.push(newlikely benign Minified YAML parser class code in a Vite bundle.Reasoning
Minified YAML parser class definitions; long-line signal is typical of production bundles.
-
`};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.keys(e))t!==`type`&&t!==`offset`&&delete e[t];Object.assign(e,{type:n,indent:r,soulikely benign Minified YAML node transformation code in a Vite bundle.Reasoning
Minified YAML CST node handling code; benign bundler output with long lines.
-
=`function`?:r}var Ma=,, -
-scalar`);function Fa(e){switch(e){case`⟨U+FEFF⟩`:return`<BOM>`;case`⟨U+0002⟩`:return`<DOC>`;case`⟨U+0018⟩`:return`<FLOW_END>`;case`⟨U+001F⟩`:return`<SCALAR>`;default:return JSON.stringify(e)}}function Ia(e){switch(e){case`⟨U+FEFF⟩`:return`byte-order-mark`;case`⟨U+0002⟩`:return`doc-mode`;case`⟨U+0018⟩`:return`flow-error-end`;case`⟨U+001F⟩`:return`scalar`;case`---`:retur -
}} -
`,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=e,null}peek(e){likely benign Minified YAML lexer buffer code in a Vite bundle.Reasoning
Minified line-buffer logic from a YAML parser; no malicious constructs visible.
-
eturn this.; -
`?yield*this.pushCount(2):0}*pushSpaces(e){let t=this.pos-1,n;do n=this.buffer[++t];while(n===` `||e&&n===` `);let r=t-this.pos;return r>0&&(yield this.buffer.substr(this.pos,r),this.pos=t),r}*pushUntil(e){let t=this.pos,n=this.buffer[t];for(;!e(n);)n=this.buffer[++t];return yield*this.pushToIndex(t,!1)}},Wa=class{conslikely benign Minified YAML lexer generator methods in a Vite bundle.Reasoning
Minified generator-based YAML lexer code; long line is a bundling artifact.
-
`,e)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case`newline`:if(this.onKeyLine=!1,t.value){let n=`end`in t.value?t.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type===`comment`?n?.push(this.sourceToken):e.items.push({likely benign Minified YAML block mapping parser code in a Vite bundle.Reasoning
Minified YAML block-map parsing logic; benign bundled library code.
-
`,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case`alias`:case`scalar`:case`single-quoted-scalar`:case`double-quoted-scalar`:return this.flowScalar(this.type);case`block-scalar-header`:return{type:`block-scalar`,offset:this.offset,indent:this.indent,likely benign Minified YAML block value handling in a Vite bundle.Reasoning
Minified YAML parser block-value handling; long line from production minification.
-
`;return r.push({message:i,range:[n.lineCounter.linePos(t.range[0]),n.lineCounter.linePos(t.range[0]+e.pos)]}),null}throw e}}constructor(e){this._input=e,this._pos=0,this._length=e.length}_peek(){return this._input[this._pos]||``}_next(){return this._pos<this._length?this._input[this._pos++]:null}_eof(){return this._polikely benign Minified parser class in a Vite bundle.Reasoning
Minified parser code with a constructor and input-reading helpers; no execution, encoding, or network activity shown, consistent with a bundled grammar parser.
-
;var n=likely benign Minified CodeMirror editor library bundle in the trace viewer assets.Reasoning
CodeMirror's standard UMD wrapper and browser feature detection, minified as typical for a bundled editor library. Long single-line minified output is expected.
-
tion var -
Height>2&&!)}var n=He?:;return n.,n}var We; -
n We;var t=,n=.,r=.;return ,!n||n.==n.?!1:We=r.-n.<3}var Ke=` -
`,t);i==-1&&(i=e.length);var a=e.slice(t,e.charAt(i-1)==`\r`?i-1:i),o=a.indexOf(`\r`);o==-1?(n.push(a),t=i+1):(n.push(a.slice(0,o)),t+=o+1)}return n},qe=window.getSelection?function(e){try{return e.selectionStart!=e.selectionEnd}catch{return!1}}:function(e){var t;try{t=e.ownerDocument.selection.createRange()}catch{}retlikely benign Minified CodeMirror editor library code with a very long line.Reasoning
Long line in a minified CodeMirror bundle. Minification produces long lines, and the snippet is ordinary CodeMirror editor code with no decoding or execution of hidden payloads.
-
`?(_=f.appendChild(k(`span`,m[0]==`\r`?`␍`:``,`cm-invalidchar`)),_.setAttribute(`cm-text`,m[0]),e.col+=1):(_=e.cm.options.specialCharPlaceholder(m[0]),_.setAttribute(`cm-text`,m[0]),o&&s<9?f.appendChild(k(`span`,[_])):f.appendChild(_),e.col+=1);e.map.push(e.pos,e.pos+1,_),e.pos++}}if(e.trailingSpace=l.charCodeAt(tlikely benign Minified CodeMirror rendering code with a very long line.Reasoning
Long line from the minified CodeMirror bundle. The snippet is standard rendering code for invalid-character placeholders, consistent with a legitimate editor library.
-
height: `+(r-t)+`px`))}function d(t,n,r){var a=K(i,t),o=a.text.length,d,f;function p(n,r){return wr(e,J(t,n),`div`,a,r)}function m(t,n,r){var i=Ar(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==`after`?i.begin:i.end-(/\s/.test(a.text.charAt(i.end-1))?2:1),o)[o]}var h=H(a,i.likely benign Minified CodeMirror layout code with a very long line.Reasoning
Long line from the minified CodeMirror bundle; the snippet is DOM measurement and cursor-positioning logic typical of the library.
-
ht)&&,i!=null&&!h) -
left: `+t.left+`px; width: `+Math.max(2,t.right-t.left)+`px;`);e.display.lineSpace.appendChild(o),o.scrollIntoView(i),e.display.lineSpace.removeChild(o)}}}function ui(e,t,n,r){r??=0;var i;!e.options.lineWrapping&&t==n&&(n=t.sticky==`before`?J(t.line,t.ch+1,`before`):t,t=t.ch?J(t.line,t.sticky==likely benign Minified CodeMirror scrolling and coordinate code with a very long line.Reasoning
Very long line from the minified CodeMirror bundle. The snippet is ordinary editor coordinate and scrolling logic, with no suspicious decoding or network activity.
-
`},setDirection:Vi(function(e){e!=`rtl`&&(e=`ltr`),e!=this.direction&&(this.direction=e,this.iter(function(e){return e.order=null}),this.cm&&Ea(this.cm))})}),ko.prototype.eachLine=ko.prototype.iter;var Ao=0;function jo(e){var t=this;if(Po(t),!(G(t,e)||Zn(t.display,e))){Fe(e),o&&(Ao=+new Date);var n=Hr(t,e,!0),r=e.dataTlikely benign Minified CodeMirror API and text-direction code with a very long line.Reasoning
Long line from the minified CodeMirror bundle. The snippet is standard editor API and bidi-text handling code.
-
`,`start`)},toggleOverwrite:function(e){return e.toggleOverwrite()}};function is(e,t){var n=K(e.doc,t),r=on(n);return r!=n&&(t=q(r)),ts(!0,e,r,t,1)}function as(e,t){var n=K(e.doc,t),r=sn(n);return r!=n&&(t=q(r)),ts(!0,e,n,t,-1)}function os(e,t){var n=is(e,t.line),r=K(e.doc,n.line),i=H(r,e.doc.direction);if(!i||i[0].levlikely benign Minified CodeMirror cursor-movement code with a very long line.Reasoning
Long line from the minified CodeMirror bundle. The snippet is cursor-movement and bidi logic, typical of the library.
-
r a=i.;return this.,this..}++c;return -
t!=null)} -
value=`⇚`,i.=a,t.=e?``:`⟨U+200B⟩`,i.=1,i.=a.,r.=n..}} -
art==0&&i.>0&&t.==`⟨U+200B⟩`?:e++<10?r.=:};r.=}}},lc. -
`:` `)}async function Xr(e,t,n=0){let r=new Set([`method`,`path`,`scheme`,`version`,`accept-charset`,`accept-encoding`,`access-control-request-headers`,`access-control-request-method`,`connection`,`content-length`,`cookie`,`cookie2`,`date`,`dnt`,`expect`,`host`,`keep-alive`,`origin`,`referer`,`te`,`trailer`,`transfer -
.`)}\n`),`request.();`}};var ri= -
`).filter(Boolean).map(e=>JSON.parse(e)).map((e,t)=>({...e,index:t,byteLength:_i(e)})):[]}catch{return[]}return[]},[e,t],void 0),[r,i]=T.useState(void 0),a=r===void 0?void 0:n?.[r],o=T.useMemo(()=>{if(n){for(let e of n)if(e.time>0)return e.time}},[n]);if(n===void 0)return(0,M.jsx)(Un,{text:`Loading...`});if(n.length=== -
))..;return } -
}var vu=`data:text/html;base64,`+,yu= -
e..+`'`;return t.?r:}var Cf; -
t=0;t<o.;++t)e+=String.;s=}throw ; -
=`function`?:r}var $m=,, -
-scalar`);function nh(e){switch(e){case`⟨U+FEFF⟩`:return`<BOM>`;case`⟨U+0002⟩`:return`<DOC>`;case`⟨U+0018⟩`:return`<FLOW_END>`;case`⟨U+001F⟩`:return`<SCALAR>`;default:return JSON.stringify(e)}}function rh(e){switch(e){case`⟨U+FEFF⟩`:return`byte-order-mark`;case`⟨U+0002⟩`:return`doc-mode`;case`⟨U+0018⟩`:return`flow-error-end`;case`⟨U+001F⟩`:return`scalar`;case`---`:retur -
}} -
eturn this.; -
; -
.}--`))}var C=`data:text/html;base64,`+btoa(`<body></body><style>body { color-scheme: light dark; background: light-dark }</style>`),w=class{constructor(e){this._maxSize=e,this._map=new Map,this._size=0}getOrCompute(e,t){if(this._map.has(e)){let t=this._map.get(e);return this._map.delete(e),this -
.;r.&&}},Cr= -
=:t.+=r)}},Cr=,wr= -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),$r=Qr.length==256;function ei(e){if($r){let t=``;for(let n=0;n<e.length;n++)t+=Qr[e[n]];return t}else return new TextDecoder().decode(e)}function ti(e,t){return t&&t.trim().toLowerCase()==`cp… -
�╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ `.split(``),$r=Qr.length==256;function ei(e){if($r){let t=``;for(let n=0;n<e.length;n++)t+=Qr[e[n]];return t}else return new TextDecoder().decode(e)}function ti(e,t){return t&&t.trim().toLowerCase()==`cp… -
fi file=$($printf "$(echo "$file" | sed -e 's@%\([a-f0-9A-F]\{2\}\)@\\x\1@g')") fi echo "$file" -
# All the scary things here are intentional has_single_argument $1 && $(printf "$browser" "$1") else $browser "$1"likely benign Upstream xdg-open shell script that runs the configured browser command, using printf to build the command for single-argument cases.Reasoning
This is the standard xdg-utils xdg-open script. The comment 'All the scary things here are intentional' marks the printf-based browser invocation as deliberate. The browser value comes from the user's BROWSER setting or the desktop configuration, not from remote input, so it is legitimate runtime command selection rather than a dropper.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&