npm / playwright / 1.65.0-alpha-1792021904000

playwright 1.65.0-alpha-1792021904000

Source: https://github.com/microsoft/playwright
Commit scanned: d96199f58b23 (recorded by npm)
Directory: packages/playwright (only this part of the repository was scanned)
Compared with: cfe490d941f9 (0 signals introduced since)
Files: 133 scanned, 13 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 12 info
Scan time: 6.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-15 14:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution packages/playwright/src/isomorphic/teleReceiver.ts:462:90

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
  private _onStdIO(type: JsonStdIOType, testId: string | undefined, resultId: string | undefined, data: string, isBase64: boolean) {
    const chunk = isBase64 ? ((globalThis as any).Buffer ? Buffer.from(data, 'base64') : atob(data)) : data;
    const test = testId ? this._tests.get(testId) : undefined;
```
likely benign LLM, confidence 0.90 Base64 decoding of test stdout chunks in a Playwright-style test receiver.
Reasoning
atob is used as a fallback to decode base64 stdio chunks from a test-runner protocol message; the result is just data passed into a chunk buffer, not fetched or evaluated.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/package.ts:22:28

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
export const packageRoot = path.join(__dirname, '..');
export const packageJSON = require(path.join(packageRoot, 'package.json'));

export function libPath(...parts: string[]): string {
```
likely benign LLM, confidence 0.93 Loads the package's own package.json via a computed path.
Reasoning
require of a path.join result pointing at the package's own package.json is a fixed, local, legitimate pattern for reading version metadata.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/reporters/coverage.ts:120:27

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const resolveFrom = (name: string) => require.resolve(name, { paths: [this._options.configDir] });
      const libCoverage = require(resolveFrom('istanbul-lib-coverage'));
      const libReport = require(resolveFrom('istanbul-lib-report'));
      const reports = require(resolveFrom('istanbul-reports'));
```
likely benign LLM, confidence 0.90 Requires istanbul libraries resolved from the config directory.
Reasoning
Resolves istanbul modules relative to a configured directory and requires them; this is standard plugin/dependency resolution for a coverage reporter.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/reporters/coverage.ts:121:25

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const libCoverage = require(resolveFrom('istanbul-lib-coverage'));
      const libReport = require(resolveFrom('istanbul-lib-report'));
      const reports = require(resolveFrom('istanbul-reports'));
      const context = libReport.createContext({
```
likely benign LLM, confidence 0.90 Requires istanbul-lib-report resolved from config directory.
Reasoning
Same resolveFrom-based require of a known coverage dependency; legitimate dependency loading.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/reporters/coverage.ts:122:23

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const libReport = require(resolveFrom('istanbul-lib-report'));
      const reports = require(resolveFrom('istanbul-reports'));
      const context = libReport.createContext({
        dir: outputDir,
```
likely benign LLM, confidence 0.90 Requires istanbul-reports resolved from config directory.
Reasoning
Same resolved require of istanbul-reports, a well-known reporting dependency; no sign of malicious intent.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/transform/babelBundle.ts:169:52

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      ...plugins,
      ...pluginsEpilogue.map(([name, options]) => [require(name), options]),
    ],
    compact: false,
```
likely benign LLM, confidence 0.85 Requires Babel plugins by name from a plugin list.
Reasoning
Requires Babel plugin names from a configured list to build the transform pipeline; a normal plugin-loading pattern, with names coming from internal code.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/transform/transform.ts:268:74

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  const { babelTransform }: { babelTransform: BabelTransformFunction } = require(libPath('transform', 'babelBundle'));
  const babelResult = babelTransform(originalCode, filename, !!moduleUrl, pluginsEpilogue, useDefineForClassFields, jsx);
  if (!babelResult?.code)
```
likely benign LLM, confidence 0.88 Requires the internal babelBundle module for transforms.
Reasoning
Loads the bundled babelBundle module via libPath with fixed segments; an internal module load, not attacker-controlled input.
info ~~critical~~ → info by review dynamic-execution packages/playwright/src/transform/transform.ts:296:29

`eval` called with a non-literal expression (ast pass, confidence 0.90)
```
    const fileName = url.pathToFileURL(file);
    const esmImport = () => eval(`import(${JSON.stringify(fileName)})`);

    // For ESM imports handled by the asynchronous loader, issue a preflight to populate
```
likely benign LLM, confidence 0.80 Uses eval to issue a dynamic ESM import of a test file.
Reasoning
eval is used to build a dynamic import of a file URL, a known workaround to keep ESM import() from being transpiled to require in CJS. The argument is JSON.stringify of a path produced by the runner, so it is not injected external input, though eval is an unusual choice.
info ~~critical~~ → info by review dynamic-execution packages/playwright/src/transform/transform.ts:303:13

`eval` called with a non-literal expression (ast pass, confidence 0.90)
```
    if (loaderChannel) {
      await eval(`import(${JSON.stringify(fileName + '.esm.preflight')})`)
          .catch((error: any) => debugTest('Failed to load preflight for ' + file + ', source maps may be missing for errors thrown during loading.', error))
          .finally(nextTask);
```
likely benign LLM, confidence 0.80 Uses eval to dynamically import an ESM preflight file.
Reasoning
Same eval-based dynamic import trick for a preflight module, with the path JSON-stringified from internal file names; a deliberate loader workaround rather than malicious evaluation.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/transform/transform.ts:315:18

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  }
  const result = require(file);
  const depsCollector = cc.currentFileDepsCollector();
  if (depsCollector) {
```
likely benign LLM, confidence 0.90 Requires the test file being loaded for transformation.
Reasoning
require of the test file being loaded by the runner is the normal way to load test modules in this transform path.
info whitespace-anomaly packages/playwright/src/transform/tsconfig-loader.ts:34:1

file mixes tab and space indentation (9 tab-indented and 112 space-indented lines) (raw pass, confidence 0.40)
```
interface TsConfig {
  extends?: string;
  compilerOptions?: {
    baseUrl?: string;
```

info long-line packages/playwright/types/test.d.ts:7628:1

line length 560 characters (raw pass, confidence 0.50)

  video: VideoMode | /** deprecated */ 'retry-with-video' | { mode: VideoMode, size?: ViewportSize, fps?: number, show?: { actions?: { duration?: number, position?: 'top-left' | 'top' | 'top-right' | 'bottom-left' | 'bottom' | 'bottom-right', /** @deprecated Use `style.title` instead. */ fontSize?: number, cursor?: 'no

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/microsoft/playwright playwright && cd playwright
git checkout d96199f58b23f183b45c85db3d48239bbe9beeb2
disclude scan --severity info --diff cfe490d941f992655948eee8fd4fd94e1c4234bf packages/playwright