disclude.ionpm / playwright / 1.65.0-alpha-2026-10-23
playwright 1.65.0-alpha-2026-10-23
- Source
- https://github.com/microsoft/playwright
- Artifact scanned
playwright-1.65.0-alpha-2026-10-23.tgz- Compared with
playwright-1.65.0-alpha-2026-10-22.tgz(1 signals introduced since)- Files
- 55 scanned, 5 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 60 info
- Scan time
- 28.2 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 32 of 32 warn and critical signals; 32 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 09:29
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
-
process.env. = "true"; const = ; const babelResult = ;likely benign Loads the package's own bundled babel transform module via a computed path.Reasoning
The require specifier is built from the package's own libPath helper to load the bundled babel transform. This is a self-referential internal load, not attacker-controlled input.
-
const fileName = import_url2..; const ;likely benign Uses eval to hide a dynamic ESM import of a test file from transpilation.Reasoning
The eval wraps a dynamic import() so that the bundler or transpiler does not rewrite it into require. The argument is a file URL produced by pathToFileURL and JSON-stringified, so the code is not attacker-controlled. This is a known test-loader idiom.
-
return await .;likely benign Eval-wrapped dynamic import of an optional preflight module next to a test file.Reasoning
Same idiom as the sibling finding: eval of import() with a JSON-stringified, derived file path to load an optional preflight ESM module. Not an obfuscated payload.
-
} const result = ; const depsCollector = ;likely benign Requires the test file being loaded by the runner.Reasoning
The require loads the user's own test file path during test loading. Dynamic loading of user-specified test modules is the expected behavior of a test runner.
-
return "string" === typeof type || "function" === typeof type || type === REACT_FRAGMENT_TYPE || type === REACT_PROFILER_TYPE || type === REACT_STRICT_MODE_TYPE || type === REACT_SUSPENSE_TYPE || type === REACT_SUSPENSE_LIST_TYPE || "object" === typeof type && null !== type && -
var REACT_ELEMENT_TYPE = /* @__PURE__ */ Symbol., REACT_PORTAL_TYPE = /* @__PURE__ */ Symbol., REACT_FRAGMENT_TYPE = /* @__PURE__ */ Symbol., REACT_STRICT_MODE_TYPE = /* @__PURE__ */ Symbol., REACT_PROFILER_TYPE = /* -
return "string" === typeof type || "function" === typeof type || type === REACT_FRAGMENT_TYPE || type === REACT_PROFILER_TYPE || type === REACT_STRICT_MODE_TYPE || type === REACT_SUSPENSE_TYPE || type === REACT_SUSPENSE_LIST_TYPE || "object" === typeof type && null !== type && -
exports2. = /||| -
var astralIdentifierStartCodes =likely benign A long numeric lookup table of Unicode identifier code points.Reasoning
The very long line is a table of Unicode code point ranges for identifier-start and identifier-part characters, as found in the bundled babel or jest parser. Long data tables are common in generated code and this one carries no executable content.
-
const moduleUrl = ; const importedModule = awaitlikely benign Dynamic import of a user module by file URL inside the bundled expect module loader.Reasoning
This is the standard jest-style ESM loader that imports a module by file URL, with a webpackIgnore hint. The path comes from the test configuration, not from untrusted input.
-
} const requiredModule = ;likely benign CJS require of a resolved module path in the bundled loader.Reasoning
This is the CJS fallback of the same module loader, requiring a resolved file path. It is ordinary module loading with no decoding or network activity.
-
const message = pass ? -
const message = pass ? -
const message = pass ? : -
const message = pass ? -
const packageRoot = import_path..; const packageJSON = ;likely benign Reads the package's own package.json at load time.Reasoning
The require reads the package's own package.json via a path built from __dirname. This is a standard, benign pattern.
-
likely benign Decodes base64-encoded worker stdout/stderr chunks for reporting.
Reasoning
atob decodes base64 stdio chunks forwarded from worker processes when isBase64 is set. The decoded data is written as output, not evaluated or fetched, so this is ordinary output plumbing.
-
const ; const libCoverage = ; const libReport = ; const reports = ;likely benign Loads istanbul-lib-coverage from the project's config directory for coverage reporting.Reasoning
The coverage library is resolved relative to the config directory, which is the normal way a test runner loads optional reporting dependencies. Nothing is decoded or executed beyond a plain require.
-
const libCoverage = ; const libReport = ; const reports = ; const context = libReport.likely benign Loads istanbul-lib-report for coverage output.Reasoning
Loads istanbul-lib-report through the same config-relative resolution used for coverage reporting. Standard behavior.
-
const libReport = ; const reports = ; const context = libReport.likely benign Loads istanbul-reports for coverage report generation.Reasoning
Loads istanbul-reports for coverage reporters through the standard config-relative resolver. Standard behavior.
-
var -
var astralIdentifierStartCodes =likely benign A long array literal of Unicode identifier code points inside a bundled Babel library.Reasoning
The long line is a numeric code-point table for astral identifier start characters, a standard pattern in bundled Babel parser code. The raw long-line signal is a formatting artifact, not obfuscation.
-
exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. -
exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2.likely benign A long chain of exports assignments for AST node types in a bundled Babel library.Reasoning
The long line is a generated list of exports assignments, typical of the transpiled Babel AST type module. Length alone indicates nothing malicious.
-
exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = explikely benign A long chain of exports assignments for TypeScript AST node types in a bundled library.Reasoning
This is the same generated exports-assignment chain for TypeScript AST node types. It is standard bundler output with no decoding or execution.
-
exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. -
exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = exports2. = e -
var astralIdentifierStartCodes =likely benign A long array of astral Unicode identifier code points in a bundled Babel library.Reasoning
This is a duplicate of the astral identifier table found elsewhere in the same bundle, a legitimate Unicode data array.
-
var reservedWordLikeSet = /* @__PURE__ */ -
var _node$directive, _node$decorators, _node$optional, _node$typeAnnotation, _node$accessibility, _node$decorators2, _node$override, _node$readonly, _node$static, _node$declare, _node$returnType, _node$typeParameters, _node$optional2, _node$optional3, _node$accessibility2, _node$readonly2, _node$static2, _node$ -
exports2. = /||| -
module2.. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u06likely benign A large regex of Unicode ID_Start ranges in a bundled library.Reasoning
This is a large regex character class encoding the Unicode ID_Start property, a standard data table in identifier-handling libraries.
-
module2.. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\ulikely benign A large regex of Unicode ID_Continue ranges in a bundled library.Reasoning
This is a large regex character class for the Unicode ID_Continue property, the counterpart to ID_Start, and is standard library data.
-
var a = -
let g = null != e2 ? e2 : , q = -
e3., n2 > e3 && < e3. && -
module2. = -
module2. =likely benign A very large static browser-compatibility data object from caniuse-lite.Reasoning
This is a caniuse-lite browser compatibility data object embedded in the bundle. It is plain static data with no executable logic, so the length is expected.
-
module2. = -
} var queries = ;likely benign Browserslist's dynamic require of a resolved query module.Reasoning
This is browserslist's config loader resolving a package path via require.resolve with explicit search paths, which is the library's intended way to load shared configs. The specifier is not attacker-controlled input in a suspicious way, so this is a legitimate dynamic require.
-
} var stats =likely benign Browserslist's dynamic require of its browserslist-stats.json data file.Reasoning
This dynamic require resolves browserslist-stats.json from the user's own package path, a documented browserslist feature. It is a normal non-literal require pattern.
-
likely benign Browserslist loads a caniuse-lite regional data file by name.
Reasoning
The require concatenates a region code into a caniuse-lite data path inside a try block, a common data-loading pattern. The code is validated by a surrounding error message and the target is a fixed data directory.
-
likely benign Browserslist loads a caniuse-lite feature data file by name.
Reasoning
This is the same caniuse-lite feature-data loader pattern, with a fixed data directory prefix and a thrown error on failure. It is a legitimate lookup, not a payload fetch.
-
likely benign A helper that decodes a base64 string via atob, used for inline source-map handling.
Reasoning
The function decodes base64 with atob and then decodeURIComponent, the standard way to read inline base64 source maps in source-map tooling. The decoded data is not executed, and the snippet shows no eval or fetch.
-
var json = this.; return ; } -
; }likely benign A bundled Babel helper that wraps a dynamic import of a caller-supplied file path.Reasoning
This is the standard dynamic-import helper emitted by Babel's bundling of CommonJS interop. It takes a filepath argument from its caller, which is normal for a config or plugin loader. Nothing in the snippet fetches remote content or decodes data.
-
-
path. -
acc. -
...plugins, ...pluginsEpilogue. ], compact: false,likely benign Resolves Babel plugin names from a configuration list via require.Reasoning
The require is inside a map over pluginsEpilogue entries of [name, options], which is how Babel resolves plugin names from configuration. Loading a named plugin is expected behaviour for a transpiler, and the snippet shows no decoding or network activity.
-
module2.. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u06dismissed A generated Unicode ID_Start character-class regex on one long line.Reasoning
This is a very long regex literal encoding the Unicode ID_Start property table, a common output of generated Unicode data files. Its length is expected and it contains no executable behaviour.
-
module2.. = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\udismissed A generated Unicode ID_Continue character-class regex on one long line.Reasoning
Same as the ID_Start finding: this is a generated Unicode ID_Continue regex table. Long lines are typical of minified or generated data and this is not obfuscation of logic.
-
process.env. = "true"; const = ; const babelResult = ;likely benign Loads the package's own babelBundle module via a computed path.Reasoning
The specifier is a path built by libPath from fixed internal arguments ('transform', 'babelBundle'), so it is an internal module load rather than attacker-controlled input. The surrounding code is a normal transform step.
-
const fileName = import_url2..; const ;likely benign Uses eval to perform a native dynamic import of a local module path.Reasoning
This is a known loader technique for forcing a native dynamic import from CommonJS, used by tools such as ts-node and tsx. The path is JSON.stringify-escaped, so it is not an injection vector, and the file is a local module being loaded. The use of eval is unusual and worth a note, but the purpose is legitimate.
-
return await .;likely benign Uses eval to dynamically import an optional preflight file next to a loaded module.Reasoning
This evaluates a dynamic import of a sibling '.esm.preflight' file derived from the local module path, JSON.stringify-escaped and wrapped in a catch that logs failures. It follows the same legitimate loader pattern, though the eval use is unusual.
-
} const result = ; const depsCollector = ;likely benign Requires the target module file inside a loader that also tracks dependencies.Reasoning
This is a plain require of the file being loaded, which is the normal way a module loader executes a user's module or config. The following lines collect dependencies, which is ordinary loader bookkeeping.
-
var -
const snapshotPath = template..... -
video: VideoMode | /** deprecated */ 'retry-with-video' |
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&