pnpm 10.34.8

Source: https://github.com/pnpm/pnpm
Artifact scanned: pnpm-10.34.8.tgz (npm tarball · 4.7 MB · SHA-256 5be9fac97645…)
Compared with: pnpm-10.34.7.tgz (0 signals introduced since)
Files: 8 scanned, 12 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 2 warn · 176 info
Scan time: 56.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 58 of 58 warn and critical signals; 56 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 01:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn encoding-base64 dist/pnpm.cjs:162782:80

base64-like blob (138380 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
default.default.brotliDecompressSync(Buffer.from("Wy5/VjPdZhxSd5XevyfDh3R7QpEhSwfCr+o4vCxKUvD5Dih63SFA7YSqt4kV3YZiqKqmJZUxtgHuPwCIWVWlJXMYQqiVGnkj5841xgxfa/KJU8MgY2GmB0ZrsG2Ia6d6jici0S/BaIk2PIIiexSaeaKHbigtPXP1Umlj+RsB4fOlXz+e/+leZOxOUvY6i0spQSRhmGVb+WrYtkjc/mRXrvYRnwJsY6TW/UUII5xmztaQa8zyEPr9x6Z6xpfTs0JrifF/3LHpGOMEBL
```
inconclusive LLM, confidence 0.50 Large brotli-compressed base64 blob decompressed at runtime; purpose not visible in the snippet.
Reasoning
A 138 KB base64 literal is brotli-decompressed at runtime. This is unusual for a CLI and could be an embedded payload, but it is equally consistent with bundled compressed data such as a dependency asset or tarball. The snippet alone does not show what the decompressed bytes are used for, so this stays open.
warn encoding-base64 dist/pnpm.cjs:164423:78

base64-like blob (16368 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
default.default.brotliDecompressSync(Buffer.from("W7YZIYrAeaAIofn/qpGBmjpZVwDLAvMwf4yXtBPC2k244urd2MomTN2aMogfZ4A7OVKdZytVrWdTrWmYxircma0wGjinrwi97kOIB/rfPvf++/N1nmkwua4pdU0vplRnJ8uTq4/IAsPFlgkUtfMXWn1Nm4s4/1OdO8sUK02YQ8V0UUTasGUTR54r1eZDT0Tg+dfNn2bSIN6Zw+V9selvZoGapDZBTNJtWlu8YiP8VAl4vuaHrmqbStPqWMGWi1ET+Wl8hECbrj9M79
```
likely benign LLM, confidence 0.60 A base64-encoded brotli-compressed payload is decompressed at runtime in the pnpm bundle.
Reasoning
A raw-pass base64 blob passed to brotliDecompressSync is a common way bundlers embed compressed data. The decompressed content is not shown, and the raw pass has a high false-positive rate, so this leans benign without being settled.

info long-line dist/pnpm.cjs:2486:1

line length 638 characters (raw pass, confidence 0.50)

    exports2.default = /((['"])(?:(?!\2|\\).|\\(?:\r\n|[\s\S]))*(\2)?|`(?:[^`\\$]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{[^}]*\}?)*\}?)*(`)?)|(\/\/.*)|(\/\*(?:[^*]|\*(?!\/))*(\*\/)?)|(\/(?!\*)(?:\[(?:(?![\]\\]).|\\.)*\]|(?![\/\]\\]).|\\.)+\/(?:(?!\s*(?:\b|[\u0080-\uFFFF$\\'"~({]|[+\-!](?!=)|\.?\d))|[gmiyus]{1,6}\b(?![\u0080-

info ~~warn~~ → info by review long-line dist/pnpm.cjs:2517:1

line length 2269 characters (raw pass, confidence 0.65)
```
    var astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 8, 70, 5, 3, 0, 2, 
```
likely benign LLM, confidence 0.93 A long generated array of Unicode astral identifier start code points inside a bundled pnpm dependency.
Reasoning
The line is a large array of integer code-point ranges (astralIdentifierStartCodes) used for identifier-character tables in a bundled JavaScript parser. Long generated data lines are typical of minified or bundled libraries and show no execution or obfuscation intent.
info ~~warn~~ → info by review long-line dist/pnpm.cjs:8596:1

line length 7125 characters (raw pass, confidence 0.65)
```
    module2.exports.ID_Start = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u06
```
likely benign LLM, confidence 0.93 A long Unicode ID_Start character-class regex from a bundled identifier-validation library.
Reasoning
This is an ID_Start regular expression built from Unicode code point escapes, the kind of table the unicode-id libraries generate. The length comes from data, not from concealed logic.
info ~~warn~~ → info by review long-line dist/pnpm.cjs:8597:1

line length 8583 characters (raw pass, confidence 0.65)
```
    module2.exports.ID_Continue = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u
```
likely benign LLM, confidence 0.93 A long Unicode ID_Continue character-class regex in the same bundled identifier library.
Reasoning
This is the ID_Continue counterpart of the ID_Start table, a standard Unicode property regex generated from data. No decoding, execution or network behaviour is present.

info long-line dist/pnpm.cjs:12602:1

line length 585 characters (raw pass, confidence 0.50)

      return isPrintable(c) && c !== CHAR_BOM && !isWhitespace(c) && c !== CHAR_MINUS && c !== CHAR_QUESTION && c !== CHAR_COLON && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET && c !== CHAR_SHARP && c !== CHAR_A

info unicode-surrogate dist/pnpm.cjs:15936:27

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    var reLatin = /[\xc0-\xd6\xd8-\xf6\xf8-\xff\u0100-\u017f]/g;
    var rsAstralRange = "\\ud800-\\udfff";
    var rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23";
    var rsComboSymbolsRange = "\\u20d0-\\u20f0";

info unicode-surrogate dist/pnpm.cjs:15936:35

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    var reLatin = /[\xc0-\xd6\xd8-\xf6\xf8-\xff\u0100-\u017f]/g;
    var rsAstralRange = "\\ud800-\\udfff";
    var rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23";
    var rsComboSymbolsRange = "\\u20d0-\\u20f0";

info unicode-surrogate dist/pnpm.cjs:15955:20

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    var rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]";
    var rsFitz = "\\ud83c[\\udffb-\\udfff]";
    var rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")";
    var rsNonAstral = "[^" + rsAstralRange + "]";

info unicode-surrogate dist/pnpm.cjs:15955:28

orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

    var rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]";
    var rsFitz = "\\ud83c[\\udffb-\\udfff]";
    var rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")";
    var rsNonAstral = "[^" + rsAstralRange + "]";

info unicode-surrogate dist/pnpm.cjs:15955:36

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    var rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]";
    var rsFitz = "\\ud83c[\\udffb-\\udfff]";
    var rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")";
    var rsNonAstral = "[^" + rsAstralRange + "]";

info unicode-surrogate dist/pnpm.cjs:15958:27

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    var rsNonAstral = "[^" + rsAstralRange + "]";
    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsUpper = "[" + rsUpperRange + "]";

info unicode-surrogate dist/pnpm.cjs:15958:35

orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

    var rsNonAstral = "[^" + rsAstralRange + "]";
    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsUpper = "[" + rsUpperRange + "]";

info unicode-surrogate dist/pnpm.cjs:15958:43

orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

    var rsNonAstral = "[^" + rsAstralRange + "]";
    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsUpper = "[" + rsUpperRange + "]";

info unicode-surrogate dist/pnpm.cjs:15959:25

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsUpper = "[" + rsUpperRange + "]";
    var rsZWJ = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:15959:33

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsUpper = "[" + rsUpperRange + "]";
    var rsZWJ = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:15959:42

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsUpper = "[" + rsUpperRange + "]";
    var rsZWJ = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:15959:50

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsUpper = "[" + rsUpperRange + "]";
    var rsZWJ = "\\u200d";

info long-line dist/pnpm.cjs:28051:1

line length 1190 characters (raw pass, confidence 0.50)

    exports2.interval = exports2.iif = exports2.generate = exports2.fromEventPattern = exports2.fromEvent = exports2.from = exports2.forkJoin = exports2.empty = exports2.defer = exports2.connectable = exports2.concat = exports2.combineLatest = exports2.bindNodeCallback = exports2.bindCallback = exports2.UnsubscriptionE

info long-line dist/pnpm.cjs:28052:1

line length 1050 characters (raw pass, confidence 0.50)

    exports2.filter = exports2.expand = exports2.exhaustMap = exports2.exhaustAll = exports2.exhaust = exports2.every = exports2.endWith = exports2.elementAt = exports2.distinctUntilKeyChanged = exports2.distinctUntilChanged = exports2.distinct = exports2.dematerialize = exports2.delayWhen = exports2.delay = exports2.d

info long-line dist/pnpm.cjs:28053:1

line length 1018 characters (raw pass, confidence 0.50)

    exports2.switchMap = exports2.switchAll = exports2.subscribeOn = exports2.startWith = exports2.skipWhile = exports2.skipUntil = exports2.skipLast = exports2.skip = exports2.single = exports2.shareReplay = exports2.share = exports2.sequenceEqual = exports2.scan = exports2.sampleTime = exports2.sample = exports2.refC

info long-line dist/pnpm.cjs:28808:1

line length 1062 characters (raw pass, confidence 0.50)

    exports2.mergeAll = exports2.merge = exports2.max = exports2.materialize = exports2.mapTo = exports2.map = exports2.last = exports2.isEmpty = exports2.ignoreElements = exports2.groupBy = exports2.first = exports2.findIndex = exports2.find = exports2.finalize = exports2.filter = exports2.expand = exports2.exhaustMap

info long-line dist/pnpm.cjs:28809:1

line length 1037 characters (raw pass, confidence 0.50)

    exports2.timeInterval = exports2.throwIfEmpty = exports2.throttleTime = exports2.throttle = exports2.tap = exports2.takeWhile = exports2.takeUntil = exports2.takeLast = exports2.take = exports2.switchScan = exports2.switchMapTo = exports2.switchMap = exports2.switchAll = exports2.subscribeOn = exports2.startWith =

info ~~warn~~ → info by review long-line dist/pnpm.cjs:32191:1

line length 10213 characters (raw pass, confidence 0.65)
```
      return /\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62(?:\uDB40\uDC65\uDB40\uDC6E\uDB40\uDC67|\uDB40\uDC73\uDB40\uDC63\uDB40\uDC74|\uDB40\uDC77\uDB40\uDC6C\uDB40\uDC73)\uDB40\uDC7F|\uD83D\uDC68(?:\uD83C\uDFFC\u200D(?:\uD83E\uDD1D\u200D\uD83D\uDC68\uD83C\uDFFB|\uD83C[\uDF3E\uDF73\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB
```
likely benign LLM, confidence 0.92 A long emoji-sequence regex using UTF-16 surrogate escapes inside a bundled text-handling library.
Reasoning
The regex matches emoji ZWJ and flag sequences as surrogate-pair escapes, a standard emoji-segmentation pattern used by grapheme or string-width libraries. The length reflects emoji data.

info unicode-surrogate dist/pnpm.cjs:32923:19

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    "use strict";
    var regex = "[\uD800-\uDBFF][\uDC00-\uDFFF]";
    var astralRegex = (options) => options && options.exact ? new RegExp(`^${regex}$`) : new RegExp(regex, "g");
    module2.exports = astralRegex;

info unicode-surrogate dist/pnpm.cjs:32923:26

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

    "use strict";
    var regex = "[\uD800-\uDBFF][\uDC00-\uDFFF]";
    var astralRegex = (options) => options && options.exact ? new RegExp(`^${regex}$`) : new RegExp(regex, "g");
    module2.exports = astralRegex;

info unicode-surrogate dist/pnpm.cjs:32923:34

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

    "use strict";
    var regex = "[\uD800-\uDBFF][\uDC00-\uDFFF]";
    var astralRegex = (options) => options && options.exact ? new RegExp(`^${regex}$`) : new RegExp(regex, "g");
    module2.exports = astralRegex;

info unicode-surrogate dist/pnpm.cjs:32923:41

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    "use strict";
    var regex = "[\uD800-\uDBFF][\uDC00-\uDFFF]";
    var astralRegex = (options) => options && options.exact ? new RegExp(`^${regex}$`) : new RegExp(regex, "g");
    module2.exports = astralRegex;

info long-line dist/pnpm.cjs:36007:1

line length 541 characters (raw pass, confidence 0.50)

      }, cfg_), delimiterLength = strlen(cfg.delimiter), totalWidth = maxWidths.reduce((a, b) => a + b, 0), relativeWidths = maxWidths.map((w) => w / totalWidth), maxTotalWidth = cfg.maxTotalWidth - delimiterLength * (maxWidths.length - 1), excessWidth = Math.max(0, totalWidth - maxTotalWidth), computedWidths = zip([cf

info unicode-surrogate dist/pnpm.cjs:37211:29

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    module2.exports = () => {
      const astralRange = "\\ud800-\\udfff";
      const comboMarksRange = "\\u0300-\\u036f";
      const comboHalfMarksRange = "\\ufe20-\\ufe2f";

info unicode-surrogate dist/pnpm.cjs:37211:37

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    module2.exports = () => {
      const astralRange = "\\ud800-\\udfff";
      const comboMarksRange = "\\u0300-\\u036f";
      const comboHalfMarksRange = "\\ufe20-\\ufe2f";

info unicode-surrogate dist/pnpm.cjs:37219:29

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

      const varRange = "\\ufe0e\\ufe0f";
      const familyRange = "\\uD83D\\uDC69\\uD83C\\uDFFB\\u200D\\uD83C\\uDF93";
      const astral = `[${astralRange}]`;
      const combo = `[${comboRange}]`;

info unicode-surrogate dist/pnpm.cjs:37219:36

orphaned low surrogate \uDC69 (no preceding high surrogate) (token pass, confidence 0.65)

      const varRange = "\\ufe0e\\ufe0f";
      const familyRange = "\\uD83D\\uDC69\\uD83C\\uDFFB\\u200D\\uD83C\\uDF93";
      const astral = `[${astralRange}]`;
      const combo = `[${comboRange}]`;

info unicode-surrogate dist/pnpm.cjs:37219:43

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

      const varRange = "\\ufe0e\\ufe0f";
      const familyRange = "\\uD83D\\uDC69\\uD83C\\uDFFB\\u200D\\uD83C\\uDF93";
      const astral = `[${astralRange}]`;
      const combo = `[${comboRange}]`;

info unicode-surrogate dist/pnpm.cjs:37219:50

orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

      const varRange = "\\ufe0e\\ufe0f";
      const familyRange = "\\uD83D\\uDC69\\uD83C\\uDFFB\\u200D\\uD83C\\uDF93";
      const astral = `[${astralRange}]`;
      const combo = `[${comboRange}]`;

info unicode-surrogate dist/pnpm.cjs:37219:64

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

      const varRange = "\\ufe0e\\ufe0f";
      const familyRange = "\\uD83D\\uDC69\\uD83C\\uDFFB\\u200D\\uD83C\\uDF93";
      const astral = `[${astralRange}]`;
      const combo = `[${comboRange}]`;

info unicode-surrogate dist/pnpm.cjs:37219:71

orphaned low surrogate \uDF93 (no preceding high surrogate) (token pass, confidence 0.65)

      const varRange = "\\ufe0e\\ufe0f";
      const familyRange = "\\uD83D\\uDC69\\uD83C\\uDFFB\\u200D\\uD83C\\uDF93";
      const astral = `[${astralRange}]`;
      const combo = `[${comboRange}]`;

info unicode-surrogate dist/pnpm.cjs:37222:22

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

      const combo = `[${comboRange}]`;
      const fitz = "\\ud83c[\\udffb-\\udfff]";
      const modifier = `(?:${combo}|${fitz})`;
      const nonAstral = `[^${astralRange}]`;

info unicode-surrogate dist/pnpm.cjs:37222:30

orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

      const combo = `[${comboRange}]`;
      const fitz = "\\ud83c[\\udffb-\\udfff]";
      const modifier = `(?:${combo}|${fitz})`;
      const nonAstral = `[^${astralRange}]`;

info unicode-surrogate dist/pnpm.cjs:37222:38

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      const combo = `[${comboRange}]`;
      const fitz = "\\ud83c[\\udffb-\\udfff]";
      const modifier = `(?:${combo}|${fitz})`;
      const nonAstral = `[^${astralRange}]`;

info unicode-surrogate dist/pnpm.cjs:37225:29

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

      const nonAstral = `[^${astralRange}]`;
      const regional = "(?:\\uD83C[\\uDDE6-\\uDDFF]){2}";
      const surrogatePair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
      const zwj = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:37225:37

orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

      const nonAstral = `[^${astralRange}]`;
      const regional = "(?:\\uD83C[\\uDDE6-\\uDDFF]){2}";
      const surrogatePair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
      const zwj = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:37225:45

orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

      const nonAstral = `[^${astralRange}]`;
      const regional = "(?:\\uD83C[\\uDDE6-\\uDDFF]){2}";
      const surrogatePair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
      const zwj = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:37226:32

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

      const regional = "(?:\\uD83C[\\uDDE6-\\uDDFF]){2}";
      const surrogatePair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
      const zwj = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:37226:40

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

      const regional = "(?:\\uD83C[\\uDDE6-\\uDDFF]){2}";
      const surrogatePair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
      const zwj = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:37226:49

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

      const regional = "(?:\\uD83C[\\uDDE6-\\uDDFF]){2}";
      const surrogatePair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
      const zwj = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:37226:57

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      const regional = "(?:\\uD83C[\\uDDE6-\\uDDFF]){2}";
      const surrogatePair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
      const zwj = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:37228:30

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:37

orphaned low surrogate \uDFF4 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:44

orphaned high surrogate \uDB40 (no matching low surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:51

orphaned low surrogate \uDC67 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:58

orphaned high surrogate \uDB40 (no matching low surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:65

orphaned low surrogate \uDC62 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:72

orphaned high surrogate \uDB40 (no matching low surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:82

orphaned low surrogate \uDC65 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:90

orphaned low surrogate \uDC73 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:98

orphaned low surrogate \uDC77 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:106

orphaned high surrogate \uDB40 (no matching low surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:116

orphaned low surrogate \uDC6E (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:124

orphaned low surrogate \uDC63 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:132

orphaned low surrogate \uDC6C (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:140

orphaned high surrogate \uDB40 (no matching low surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:150

orphaned low surrogate \uDC67 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:158

orphaned low surrogate \uDC74 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:166

orphaned low surrogate \uDC73 (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:174

orphaned high surrogate \uDB40 (no matching low surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info unicode-surrogate dist/pnpm.cjs:37228:181

orphaned low surrogate \uDC7F (no preceding high surrogate) (token pass, confidence 0.65)

      const zwj = "\\u200d";
      const blackFlag = "(?:\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40(?:\\udc65|\\udc73|\\udc77)\\udb40(?:\\udc6e|\\udc63|\\udc6c)\\udb40(?:\\udc67|\\udc74|\\udc73)\\udb40\\udc7f)";
      const family = `[${familyRange}]`;
      const optModifier = `${modifier}?`;

info long-line dist/pnpm.cjs:38101:1

line length 604 characters (raw pass, confidence 0.50)

        }), (0, reportInstallChecks_js_1.reportInstallChecks)(log$.installCheck, { cwd }), (0, reportInstallingConfigDeps_js_1.reportInstallingConfigDeps)(log$.installingConfigDeps), (0, reportScope_js_1.reportScope)(log$.scope, { isRecursive: opts.isRecursive, cmd: opts.cmd }), (0, reportSkippedOptionalDependencies_js

info long-line dist/pnpm.cjs:48057:1

line length 501 characters (raw pass, confidence 0.50)

  return byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-"

info ~~warn~~ → info by review long-line dist/pnpm.cjs:52955:1

line length 2899 characters (raw pass, confidence 0.65)
```
    var O = { curve: { nistP256: "nistP256", p256: "nistP256", nistP384: "nistP384", p384: "nistP384", nistP521: "nistP521", p521: "nistP521", secp256k1: "secp256k1", ed25519Legacy: "ed25519Legacy", ed25519: "ed25519Legacy", curve25519Legacy: "curve25519Legacy", curve25519: "curve25519Legacy", brainpoolP256r1: "brainpo
```
likely benign LLM, confidence 0.90 A long object literal mapping elliptic-curve names and aliases in the bundled OpenPGP code.
Reasoning
This is an object literal mapping curve names and aliases to canonical identifiers, as in OpenPGP.js's curve configuration. A long declarative constant line with no executable behaviour is ordinary.

info long-line dist/pnpm.cjs:52964:1

line length 1613 characters (raw pass, confidence 0.50)

    var H = { preferredHashAlgorithm: O.hash.sha512, preferredSymmetricAlgorithm: O.symmetric.aes256, preferredCompressionAlgorithm: O.compression.uncompressed, aeadProtect: false, parseAEADEncryptedV4KeysAsLegacy: false, preferredAEADAlgorithm: O.aead.gcm, aeadChunkSizeByte: 12, v6Keys: false, enableParsingV5Entities:

info dynamic-execution dist/pnpm.cjs:53239:23

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

      return new Uint8Array(t2.buffer, t2.byteOffset, t2.byteLength);
    }) : (q = (e2) => btoa(G.uint8ArrayToString(e2)), V = (e2) => G.stringToUint8Array(atob(e2)));
    var ee = [Array(255), Array(255), Array(255), Array(255)];
    for (let e2 = 0; e2 <= 255; e2++) {

info ~~warn~~ → info by review dynamic-execution dist/pnpm.cjs:53239:88

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
      return new Uint8Array(t2.buffer, t2.byteOffset, t2.byteLength);
    }) : (q = (e2) => btoa(G.uint8ArrayToString(e2)), V = (e2) => G.stringToUint8Array(atob(e2)));
    var ee = [Array(255), Array(255), Array(255), Array(255)];
    for (let e2 = 0; e2 <= 255; e2++) {
```
likely benign LLM, confidence 0.85 A base64-to-bytes conversion helper using atob inside the bundled OpenPGP encoding utilities.
Reasoning
atob is used in an OpenPGP-style runtime fallback that converts base64 to bytes for key and armor handling. It is a standard encoding helper, not a fetch or eval step, and the decoded value is only turned into a byte array here.
info ~~warn~~ → info by review long-line dist/pnpm.cjs:53476:1

line length 3848 characters (raw pass, confidence 0.65)
```
    var Be = [7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137, 139, 149, 151, 157, 163, 167, 173, 179, 181, 191, 193, 197, 199, 211, 223, 227, 229, 233, 239, 241, 251, 257, 263, 269, 271, 277, 281, 283, 293, 307, 311, 313, 317, 331, 337, 347,
```
likely benign LLM, confidence 0.93 A long array of prime-number constants in the bundled cryptography code.
Reasoning
The line is a list of small primes, the kind of constant table used in cryptographic routines such as prime sieving or key generation in the bundled library. It is data, not obfuscation.

info long-line dist/pnpm.cjs:53596:1

line length 677 characters (raw pass, confidence 0.50)

    ze[1] = [48, 32, 48, 12, 6, 8, 42, 134, 72, 134, 247, 13, 2, 5, 5, 0, 4, 16], ze[2] = [48, 33, 48, 9, 6, 5, 43, 14, 3, 2, 26, 5, 0, 4, 20], ze[3] = [48, 33, 48, 9, 6, 5, 43, 36, 3, 2, 1, 5, 0, 4, 20], ze[8] = [48, 49, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 1, 5, 0, 4, 32], ze[9] = [48, 65, 48, 13, 6, 9, 96, 13

info long-line dist/pnpm.cjs:54742:1

line length 710 characters (raw pass, confidence 0.50)

    var Xr = Zr ? { [O.curve.secp256k1]: Wr.includes("secp256k1") ? "secp256k1" : void 0, [O.curve.nistP256]: Wr.includes("prime256v1") ? "prime256v1" : void 0, [O.curve.nistP384]: Wr.includes("secp384r1") ? "secp384r1" : void 0, [O.curve.nistP521]: Wr.includes("secp521r1") ? "secp521r1" : void 0, [O.curve.ed25519Legac

info ~~warn~~ → info by review long-line dist/pnpm.cjs:54743:1

line length 2063 characters (raw pass, confidence 0.65)
```
    var $r = { [O.curve.nistP256]: { oid: [6, 8, 42, 134, 72, 206, 61, 3, 1, 7], keyType: O.publicKey.ecdsa, hash: O.hash.sha256, cipher: O.symmetric.aes128, node: Xr[O.curve.nistP256], web: Jr[O.curve.nistP256], payloadSize: 32, sharedSize: 256, wireFormatLeadingByte: 4 }, [O.curve.nistP384]: { oid: [6, 5, 43, 129, 4,
```
likely benign LLM, confidence 0.92 A long declarative table of elliptic-curve parameters in the bundled OpenPGP library.
Reasoning
This is a table keyed by curve name holding OIDs, key types, hash and cipher choices and payload sizes, a standard OpenPGP curve-parameter declaration. It contains no execution or hidden payload.

info long-line dist/pnpm.cjs:54752:1

line length 511 characters (raw pass, confidence 0.50)

        this.keyType = t2.keyType, this.oid = t2.oid, this.hash = t2.hash, this.cipher = t2.cipher, this.node = t2.node, this.web = t2.web, this.payloadSize = t2.payloadSize, this.sharedSize = t2.sharedSize, this.wireFormatLeadingByte = t2.wireFormatLeadingByte, this.web && G.getWebCrypto() ? this.type = "web" : this.n

info long-line dist/pnpm.cjs:56467:1

line length 1419 characters (raw pass, confidence 0.50)

        this.version = null, this.signatureType = null, this.hashAlgorithm = null, this.publicKeyAlgorithm = null, this.signatureData = null, this.unhashedSubpackets = [], this.unknownSubpackets = [], this.signedHashValue = null, this.salt = null, this.created = null, this.signatureExpirationTime = null, this.signature

info long-line dist/pnpm.cjs:56543:1

line length 1393 characters (raw pass, confidence 0.50)

        t2.push(qs(e2.signatureCreationTime, true, G.writeDate(this.created))), null !== this.signatureExpirationTime && t2.push(qs(e2.signatureExpirationTime, true, G.writeNumber(this.signatureExpirationTime, 4))), null !== this.exportable && t2.push(qs(e2.exportableCertification, true, new Uint8Array([this.exportable

info ~~warn~~ → info by review long-line dist/pnpm.cjs:56547:1

line length 2329 characters (raw pass, confidence 0.65)
```
        })), null !== this.preferredHashAlgorithms && (r2 = G.stringToUint8Array(G.uint8ArrayToString(this.preferredHashAlgorithms)), t2.push(qs(e2.preferredHashAlgorithms, false, r2))), null !== this.preferredCompressionAlgorithms && (r2 = G.stringToUint8Array(G.uint8ArrayToString(this.preferredCompressionAlgorithms))
```
likely benign LLM, confidence 0.90 A long OpenPGP signature-packet serialization expression in the bundled library.
Reasoning
The line serializes OpenPGP signature subpackets (preferred hash and compression algorithms) through utility conversions. It is long because of chained expressions in generated code, a common pattern in bundled crypto libraries, and shows no malicious behaviour.

info long-line dist/pnpm.cjs:56805:1

line length 520 characters (raw pass, confidence 0.50)

        if (e2.signatureType !== this.signatureType || e2.hashAlgorithm !== this.hashAlgorithm || e2.publicKeyAlgorithm !== this.publicKeyAlgorithm || !e2.issuerKeyID.equals(this.issuerKeyID) || 3 === this.version && 6 === e2.version || 6 === this.version && 6 !== e2.version || 6 === this.version && !G.equalsUint8Array

info long-line dist/pnpm.cjs:57611:1

line length 521 characters (raw pass, confidence 0.50)

        return this.s2kUsage && "gnu-dummy" !== this.s2k.type && r2.push(...this.iv), (5 === this.version || 6 === this.version && this.s2kUsage) && t2.push(new Uint8Array([r2.length])), t2.push(new Uint8Array(r2)), this.isDummy() || (this.s2kUsage || (this.keyMaterial = Ln(this.algorithm, this.privateParams)), 5 === t

info long-line dist/pnpm.cjs:58506:1

line length 519 characters (raw pass, confidence 0.50)

        return e3.preferredHashAlgorithms = s2([O.hash.sha512, O.hash.sha256, O.hash.sha3_512, O.hash.sha3_256], n2.preferredHashAlgorithm), e3.preferredCompressionAlgorithms = s2([O.compression.uncompressed, O.compression.zlib, O.compression.zip], n2.preferredCompressionAlgorithm), e3.features = [0], e3.features[0] |=

info long-line dist/pnpm.cjs:59310:1

line length 800 characters (raw pass, confidence 0.50)

    var nu = /* @__PURE__ */ Uint32Array.from([1116352408, 1899447441, 3049323471, 3921009573, 961987163, 1508970993, 2453635748, 2870763221, 3624381080, 310598401, 607225278, 1426881987, 1925078388, 2162078206, 2614888103, 3248222580, 3835390401, 4022224774, 264347078, 604807628, 770255983, 1249150122, 1555081692, 199

info long-line dist/pnpm.cjs:59377:1

line length 603 characters (raw pass, confidence 0.50)

        ({ h: r2, l: n2 } = Jc(0 | this.Ah, 0 | this.Al, 0 | r2, 0 | n2)), { h: i2, l: s2 } = Jc(0 | this.Bh, 0 | this.Bl, 0 | i2, 0 | s2), { h: a2, l: o2 } = Jc(0 | this.Ch, 0 | this.Cl, 0 | a2, 0 | o2), { h: c2, l: u2 } = Jc(0 | this.Dh, 0 | this.Dl, 0 | c2, 0 | u2), { h: h2, l: f2 } = Jc(0 | this.Eh, 0 | this.El, 0

info long-line dist/pnpm.cjs:59802:1

line length 603 characters (raw pass, confidence 0.50)

          return g3 = n2.add(g3, g3), h3 = n2.mul(i3, o3), h3 = n2.add(h3, h3), c3 = n2.mul(e3, h3), u3 = n2.mul(r3, y3), u3 = n2.add(c3, u3), c3 = n2.sub(l3, u3), u3 = n2.add(l3, u3), u3 = n2.mul(c3, u3), c3 = n2.mul(g3, c3), h3 = n2.mul(r3, h3), y3 = n2.mul(e3, y3), g3 = n2.sub(f3, y3), g3 = n2.mul(e3, g3), g3 = n2.a

info long-line dist/pnpm.cjs:59812:1

line length 666 characters (raw pass, confidence 0.50)

          return m3 = n2.mul(m3, b3), b3 = n2.add(g3, d3), m3 = n2.sub(m3, b3), b3 = n2.add(r3, i3), u3 = n2.add(o3, c3), b3 = n2.mul(b3, u3), u3 = n2.add(p3, d3), b3 = n2.sub(b3, u3), f3 = n2.mul(l3, m3), u3 = n2.mul(y3, d3), f3 = n2.add(u3, f3), u3 = n2.sub(p3, f3), f3 = n2.add(p3, f3), h3 = n2.mul(u3, f3), p3 = n2.a

info long-line dist/pnpm.cjs:60161:1

line length 518 characters (raw pass, confidence 0.50)

    var $u = { p: BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff"), n: BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"), h: BigInt(1), a: BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc"), b: BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651

info long-line dist/pnpm.cjs:60617:1

line length 549 characters (raw pass, confidence 0.50)

      const t2 = nf.p, r2 = BigInt(3), n2 = BigInt(6), i2 = BigInt(11), s2 = BigInt(22), a2 = BigInt(23), o2 = BigInt(44), c2 = BigInt(88), u2 = e2 * e2 * e2 % t2, h2 = u2 * u2 * e2 % t2, f2 = mc(h2, r2, t2) * h2 % t2, l2 = mc(f2, r2, t2) * h2 % t2, y2 = mc(l2, af, t2) * u2 % t2, g2 = mc(y2, i2, t2) * y2 % t2, p2 = mc(

info long-line dist/pnpm.cjs:60629:1

line length 637 characters (raw pass, confidence 0.50)

    var df = Xu({ a: pf.create(BigInt("0x7bc382c63d8c150c3c72080ace05afa0c2bea28e4fb22787139165efba91f90f8aa5814a503ad4eb04a8c7dd22ce2826")), b: BigInt("0x04a8c7dd22ce28268b39b55416f0447c2fb77de107dcd2a62e880ea53eeb62d57cb4390295dbc9943ab78696fa504c11"), Fp: pf, n: BigInt("0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed54

info ~~warn~~ → info by review long-line dist/pnpm.cjs:60827:1

line length 6680 characters (raw pass, confidence 0.65)
```
      s2 += (n2 = t2[0]) * T2, a2 += n2 * F2, o2 += n2 * L2, c2 += n2 * N2, u2 += n2 * O2, h2 += n2 * H2, f2 += n2 * z2, l2 += n2 * G2, y2 += n2 * j2, g2 += n2 * q2, p2 += n2 * V2, d2 += n2 * _2, A2 += n2 * Y2, w2 += n2 * Z2, m2 += n2 * J2, b2 += n2 * W2, a2 += (n2 = t2[1]) * T2, o2 += n2 * F2, c2 += n2 * L2, u2 += n2 
```
likely benign LLM, confidence 0.93 A long unrolled big-integer multiplication sequence in the bundled elliptic-curve arithmetic.
Reasoning
The line is an unrolled arithmetic sequence over multi-word integers, the typical output of a big-number or Poly1305/curve25519 field multiplication routine. It is a computational kernel, not concealed logic.

info long-line dist/pnpm.cjs:60850:1

line length 1896 characters (raw pass, confidence 0.50)

    var vl = [1116352408, 3609767458, 1899447441, 602891725, 3049323471, 3964484399, 3921009573, 2173295548, 961987163, 4081628472, 1508970993, 3053834265, 2453635748, 2937671579, 2870763221, 3664609560, 3624381080, 2734883394, 310598401, 1164996542, 607225278, 1323610764, 1426881987, 3590304994, 1925078388, 4068182383

info ~~warn~~ → info by review long-line dist/pnpm.cjs:60854:1

line length 2686 characters (raw pass, confidence 0.65)
```
        for (E2 = 0; E2 < 80; E2++) if (i2 = x2, s2 = Q2, a2 = M2, o2 = R2, c2 = T2, u2 = F2, h2 = L2, N2, l2 = O2, y2 = H2, g2 = z2, p2 = G2, d2 = j2, A2 = q2, w2 = V2, _2, S2 = 65535 & (B2 = _2), K2 = B2 >>> 16, C2 = 65535 & (I2 = N2), D2 = I2 >>> 16, S2 += 65535 & (B2 = (j2 >>> 14 | T2 << 18) ^ (j2 >>> 18 | T2 << 14
```
likely benign LLM, confidence 0.93 An unrolled SHA-512 compression round in the bundled hashing code.
Reasoning
The line is part of an unrolled 80-round loop with rotations and XORs on 64-bit words, the structure of a SHA-512 compression function. Standard hash implementations are expected in this bundle and show no malicious intent.
info ~~warn~~ → info by review long-line dist/pnpm.cjs:60855:1

line length 2341 characters (raw pass, confidence 0.65)
```
        S2 = 65535 & (B2 = O2), K2 = B2 >>> 16, C2 = 65535 & (I2 = x2), D2 = I2 >>> 16, I2 = e2[0], K2 += (B2 = t2[0]) >>> 16, C2 += 65535 & I2, D2 += I2 >>> 16, D2 += (C2 += (K2 += (S2 += 65535 & B2) >>> 16) >>> 16) >>> 16, e2[0] = x2 = 65535 & C2 | D2 << 16, t2[0] = O2 = 65535 & S2 | K2 << 16, S2 = 65535 & (B2 = H2),
```
likely benign LLM, confidence 0.90 Minified 64-bit arithmetic routine inside pnpm's bundled crypto code.
Reasoning
The snippet is a chain of 16-bit split arithmetic on BigInt-style word pairs, typical of a bundled crypto library's 64-bit multiply/add routines. It is a long line in a minified bundle with no execution, decoding or network behavior, so the long-line signal reflects bundling rather than obfuscation.
info ~~warn~~ → info by review long-line dist/pnpm.cjs:60998:1

line length 4519 characters (raw pass, confidence 0.65)
```
      const a2 = [16843776, 0, 65536, 16843780, 16842756, 66564, 4, 65536, 1024, 16843776, 16843780, 1024, 16778244, 16842756, 16777216, 4, 1028, 16778240, 16778240, 66560, 66560, 16842752, 16842752, 16778244, 65540, 16777220, 16777220, 65540, 0, 1028, 66564, 16777216, 65536, 16843780, 4, 16842752, 16843776, 16777216, 
```
likely benign LLM, confidence 0.92 Large integer constant table (DES-style S-box data) in a bundled cipher library.
Reasoning
The long line is a constant lookup table of integers in the DES-style S-box pattern, which is a standard cipher table embedded in a bundled crypto library. Data tables in a bundle are a legitimate pattern and this is not an encoded payload.

info long-line dist/pnpm.cjs:61016:1

line length 515 characters (raw pass, confidence 0.50)

        for (m2 = t2[I2++] << 24 | t2[I2++] << 16 | t2[I2++] << 8 | t2[I2++], b2 = t2[I2++] << 24 | t2[I2++] << 16 | t2[I2++] << 8 | t2[I2++], d2 = 252645135 & (m2 >>> 4 ^ b2), b2 ^= d2, m2 ^= d2 << 4, d2 = 65535 & (m2 >>> 16 ^ b2), b2 ^= d2, m2 ^= d2 << 16, d2 = 858993459 & (b2 >>> 2 ^ m2), m2 ^= d2, b2 ^= d2 << 2, d2

info long-line dist/pnpm.cjs:61020:1

line length 548 characters (raw pass, confidence 0.50)

        m2 = m2 >>> 1 | m2 << 31, b2 = b2 >>> 1 | b2 << 31, d2 = 1431655765 & (m2 >>> 1 ^ b2), b2 ^= d2, m2 ^= d2 << 1, d2 = 16711935 & (b2 >>> 8 ^ m2), m2 ^= d2, b2 ^= d2 << 8, d2 = 858993459 & (b2 >>> 2 ^ m2), m2 ^= d2, b2 ^= d2 << 2, d2 = 65535 & (m2 >>> 16 ^ b2), b2 ^= d2, m2 ^= d2 << 16, d2 = 252645135 & (m2 >>> 4

info long-line dist/pnpm.cjs:61032:1

line length 1944 characters (raw pass, confidence 0.50)

      const t2 = [0, 4, 536870912, 536870916, 65536, 65540, 536936448, 536936452, 512, 516, 536871424, 536871428, 66048, 66052, 536936960, 536936964], r2 = [0, 1, 1048576, 1048577, 67108864, 67108865, 68157440, 68157441, 256, 257, 1048832, 1048833, 67109120, 67109121, 68157696, 68157697], n2 = [0, 8, 2048, 2056, 167772

info long-line dist/pnpm.cjs:61036:1

line length 535 characters (raw pass, confidence 0.50)

        b2 = 252645135 & (p3 >>> 4 ^ v6), v6 ^= b2, p3 ^= b2 << 4, b2 = 65535 & (v6 >>> -16 ^ p3), p3 ^= b2, v6 ^= b2 << -16, b2 = 858993459 & (p3 >>> 2 ^ v6), v6 ^= b2, p3 ^= b2 << 2, b2 = 65535 & (v6 >>> -16 ^ p3), p3 ^= b2, v6 ^= b2 << -16, b2 = 1431655765 & (p3 >>> 1 ^ v6), v6 ^= b2, p3 ^= b2 << 1, b2 = 16711935 &

info long-line dist/pnpm.cjs:61037:1

line length 544 characters (raw pass, confidence 0.50)

        for (let e3 = 0; e3 < 16; e3++) A2[e3] ? (p3 = p3 << 2 | p3 >>> 26, v6 = v6 << 2 | v6 >>> 26) : (p3 = p3 << 1 | p3 >>> 27, v6 = v6 << 1 | v6 >>> 27), p3 &= -15, v6 &= -15, w2 = t2[p3 >>> 28] | r2[p3 >>> 24 & 15] | n2[p3 >>> 20 & 15] | i2[p3 >>> 16 & 15] | s2[p3 >>> 12 & 15] | a2[p3 >>> 8 & 15] | o2[p3 >>> 4 & 1

info long-line dist/pnpm.cjs:61060:1

line length 1345 characters (raw pass, confidence 0.50)

          a2 = c2, c2 = o2 ^ r2(c2, this.masking[0], this.rotate[0]), o2 = a2, a2 = c2, c2 = o2 ^ n2(c2, this.masking[1], this.rotate[1]), o2 = a2, a2 = c2, c2 = o2 ^ i2(c2, this.masking[2], this.rotate[2]), o2 = a2, a2 = c2, c2 = o2 ^ r2(c2, this.masking[3], this.rotate[3]), o2 = a2, a2 = c2, c2 = o2 ^ n2(c2, this.mas

info long-line dist/pnpm.cjs:61067:1

line length 1343 characters (raw pass, confidence 0.50)

          a2 = c2, c2 = o2 ^ r2(c2, this.masking[15], this.rotate[15]), o2 = a2, a2 = c2, c2 = o2 ^ i2(c2, this.masking[14], this.rotate[14]), o2 = a2, a2 = c2, c2 = o2 ^ n2(c2, this.masking[13], this.rotate[13]), o2 = a2, a2 = c2, c2 = o2 ^ r2(c2, this.masking[12], this.rotate[12]), o2 = a2, a2 = c2, c2 = o2 ^ i2(c2,

info long-line dist/pnpm.cjs:61072:1

line length 681 characters (raw pass, confidence 0.50)

      e2[0] = [, , , ,], e2[0][0] = [4, 0, 13, 15, 12, 14, 8], e2[0][1] = [5, 2, 16, 18, 17, 19, 10], e2[0][2] = [6, 3, 23, 22, 21, 20, 9], e2[0][3] = [7, 1, 26, 25, 27, 24, 11], e2[1] = [, , , ,], e2[1][0] = [0, 6, 21, 23, 20, 22, 16], e2[1][1] = [1, 4, 0, 2, 1, 3, 18], e2[1][2] = [2, 5, 7, 6, 5, 4, 17], e2[1][3] = [3

info long-line dist/pnpm.cjs:61086:1

line length 617 characters (raw pass, confidence 0.50)

      t2[0] = [, , , ,], t2[0][0] = [24, 25, 23, 22, 18], t2[0][1] = [26, 27, 21, 20, 22], t2[0][2] = [28, 29, 19, 18, 25], t2[0][3] = [30, 31, 17, 16, 28], t2[1] = [, , , ,], t2[1][0] = [3, 2, 12, 13, 8], t2[1][1] = [1, 0, 14, 15, 13], t2[1][2] = [7, 6, 8, 9, 3], t2[1][3] = [5, 4, 10, 11, 7], t2[2] = [, , , ,], t2[2][

info ~~warn~~ → info by review long-line dist/pnpm.cjs:61105:1

line length 24097 characters (raw pass, confidence 0.65)
```
      s2[0] = [821772500, 2678128395, 1810681135, 1059425402, 505495343, 2617265619, 1610868032, 3483355465, 3218386727, 2294005173, 3791863952, 2563806837, 1852023008, 365126098, 3269944861, 584384398, 677919599, 3229601881, 4280515016, 2002735330, 1136869587, 3744433750, 2289869850, 2731719981, 2714362070, 879511577,
```
likely benign LLM, confidence 0.92 Large 32-bit constant array consistent with a block cipher's initialization tables.
Reasoning
The line is a large array of 32-bit unsigned integer constants, consistent with Blowfish or similar cipher initialization tables in a bundled crypto library. It is data, not executed code, and the long-line flag is expected for minified or generated content.

info long-line dist/pnpm.cjs:61150:1

line length 651 characters (raw pass, confidence 0.50)

          const A2 = [[8, 1, 7, 13, 6, 15, 3, 2, 0, 11, 5, 9, 14, 12, 10, 4], [2, 8, 11, 13, 15, 7, 6, 14, 3, 1, 9, 4, 0, 10, 12, 5]], w2 = [[14, 12, 11, 8, 1, 2, 3, 5, 15, 4, 10, 6, 7, 0, 9, 13], [1, 14, 2, 11, 4, 12, 3, 7, 6, 13, 10, 5, 15, 9, 0, 8]], m2 = [[11, 10, 5, 14, 6, 13, 9, 0, 12, 8, 15, 3, 2, 4, 7, 1], [4,

info ~~warn~~ → info by review long-line dist/pnpm.cjs:61218:1

line length 12485 characters (raw pass, confidence 0.65)
```
    Zl.keySize = Zl.prototype.keySize = 32, Zl.blockSize = Zl.prototype.blockSize = 16, Jl.prototype.BLOCKSIZE = 8, Jl.prototype.SBOXES = [[3509652390, 2564797868, 805139163, 3491422135, 3101798381, 1780907670, 3128725573, 4046225305, 614570311, 3012652279, 134345442, 2240740374, 1667834072, 1901547113, 2757295779, 410
```
likely benign LLM, confidence 0.92 Cipher parameter setup and S-box constants in a bundled crypto library.
Reasoning
The line sets key and block sizes and a large SBOX table for a Blowfish/Triple-DES-style cipher. This is standard cipher configuration inside a bundled library, and nothing in the snippet executes or exfiltrates anything.

info long-line dist/pnpm.cjs:61277:1

line length 700 characters (raw pass, confidence 0.50)

    var iy = new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3, 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4, 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8, 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13, 2, 12, 6, 10, 0, 11,

info ~~warn~~ → info by review long-line dist/pnpm.cjs:61475:1

line length 3075 characters (raw pass, confidence 0.65)
```
        return r2.Bzip2Error = e3, r2.crcTable = [0, 79764919, 159529838, 222504665, 319059676, 398814059, 445009330, 507990021, 638119352, 583659535, 797628118, 726387553, 890018660, 835552979, 1015980042, 944750013, 1276238704, 1221641927, 1167319070, 1095957929, 1595256236, 1540665371, 1452775106, 1381403509, 178003
```
likely benign LLM, confidence 0.93 bzip2 decompressor setup with a precomputed CRC32 lookup table.
Reasoning
The line assigns a bzip2 error constructor and a precomputed CRC32 lookup table. This is the standard bzip2 decompressor code, a common legitimate dependency, and the table is a computed checksum lookup rather than an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62007:61

84 rows of base64-like lines, lines 62007-62007 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQENBFq44CwBCADNRnp3EGOqifmbqOgRb64hkObYdNAClPy/aQfxyWvrZBuVw8OF\nDhtziM8M8g986wALaE/nCMufVLrWLVFr4hDHrKr9weaX8vdrPVgvbk/wLfokumnT\nied2EXUYv4i1+PFPLnBEfb/FhG/x11mSStIra74JIw7C3uLbBdZfU5SBI9SRjFEg\nIMHnnTVrXsoZCf+MBUU5nN+tEuOk5s2bnb8rZOsDfdkMLblLbk7j9OvU4OfJ9cLa\ntNk0w
```
likely benign LLM, confidence 0.95 Embedded OpenPGP public key block stored as a string literal.
Reasoning
The matched text is an ASCII-armored OpenPGP public key block embedded as a string, which is public key material and not an obfuscated payload. Such keys are used legitimately for signature verification in package tooling, so the base64 signal is a false positive here.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62011:61

46 rows of base64-like lines, lines 62011-62011 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFWujE4BEAC8YwRvCMbhE0CV0F7U3Swr96hLPerVWEVmFoVshq9acXc8x+NL\na4BjGBt+GBZR2E6cRw4kEbIHmNj/XEE2fF4MG/L149feRxMwk8SuakQbcbvopSmZ\ncVc+IqLTYcZ36nJH1Vvij4gREL2BnPGHZKSJ2RxMtoc75t1Mgdx3D1MmOPHrBmCB\njN9xCvMBx24Fv5QHCXoL5ObOyZbJ+J4Et+nR2e5tL5ixWXA99Vomy6mAkYIinlNc\n/BqvV
```
likely benign LLM, confidence 0.95 Embedded OpenPGP public key block stored as a string literal.
Reasoning
This is another ASCII-armored PGP public key block in the same key-list string, the same kind of public key material used for verifying signatures. It is base64 by format and carries no executable content.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62015:61

34 rows of base64-like lines, lines 62015-62015 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQENBFtYnJsBCACdDOWJYl/Zd38Mt6kg3j+ooN7sl1bR+SBPEv4yS+lK0cLenv3F\nM+cYZEy152H8542OpJpASvQQ+N4TSHcoqDauSR1oQYKkHOj3k+U7wgODlkh5LioO\n9Z+WyMuawMcaK6daN323OdiEt5uALLP2/60BC6As9Sl6KO7BSz2nWjEqtb4daGps\nxzyjuBgzl4A3Ct9PpBEuft4L6TVhLv8bQOTJIkjM3q4iDX312elbtZxs+4wCsVpa\nsY0Oa
```
likely benign LLM, confidence 0.95 Embedded OpenPGP public key block stored as a string literal.
Reasoning
The snippet is an armored PGP public key block in a key-list string, consistent with keys bundled for signature verification. The base64 flag reflects the armor format, not hidden code.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62019:61

70 rows of base64-like lines, lines 62019-62019 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFZypZgBEADeIdm42LaylSWw5CosOAte2m6S9DgAGEBrg/yHSFTZWz341EZr\nlq1fghIC9nHh09wVlJNOOo3orB9tYoJ3LArB0MQb7Ha7dcnfn98O1od0T4QTlEro\nEeJaOfuElLD+5b9HVYqhdRtMIFiUTfSTbEXbQcvZhaLf3M8aI1G+poPRYNVRx30p\nX9PM5N8DDmW8Q/xYg3T1uHuYUmd6HlzBiESNE2WWcJoxoKuQR2Lk4Wkt+qYnxdHH\n0vYIs
```
likely benign LLM, confidence 0.95 Embedded OpenPGP public key block stored as a string literal.
Reasoning
The snippet is an armored PGP public key block inside a list of keys, the same benign public key material as the surrounding entries. There is no decode-and-execute path in the snippet.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62023:61

45 rows of base64-like lines, lines 62023-62023 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFf3hmYBEAC6YQyQighf1meU1gG8OyjlfRp7KMJJHmxtBjtH5fWtM8IWCdmZ\nnCoUgNbJHIYD2Fn3h/ijX4/S/492mbymadmW24D7mYde/OBuAQCmffjypBCUS5Gh\nZmZF0tu9Dg4cn5Zx+mchnt330m7T6cUreWR1/CiBXINJWQ6ISuwO8MDW/OSKJNyr\nRdrf4Hq73PDBkSkHK3awXVHyHfypeJP44fqBWbG+j437xWJFEqnVSIhMlk5y+qS7\nToZTm
```
likely benign LLM, confidence 0.95 Embedded OpenPGP public key block stored as a string literal.
Reasoning
This is an armored OpenPGP public key block in a string, consistent with the other key entries in the file. Base64 armor of a public key is expected and is not an encoded dropper.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62027:61

139 rows of base64-like lines, lines 62027-62027 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFRgAMsBEAC1SlN8Db9p/+pQcrlXM0xtbVDOZksBQynOzUV+Y/NBTmeBnYMo\ngh+gTau0Iv7UlDanKlB8pQubo1Gwp6ToLB6pcoh+Zuy6BRB1yHYtNFhrb33QZ5Qu\nQjtnM1qRhIuZI74StyJvfvfg5xG+Z15rvGalIhJ95s3574t6sFnnkdAx3FnHZS93\n2Bv9Dg7FsgKB7BAANa0rTbe0PS2NdzMRtelvomUnT97Z7Ik7NLNYddu+9LRXUqQw\nsxt0b
```
likely benign LLM, confidence 0.93 An embedded armored PGP public key block inside the bundled pnpm CLI.
Reasoning
The snippet is a PGP public key block stored as a string literal, which is standard for a bundled package that verifies signatures. Base64 armor is the expected encoding for such keys, and the raw pass flags it only by its shape. Nothing here decodes or executes anything.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62031:61

46 rows of base64-like lines, lines 62031-62031 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBF5MceABEADFVslAVcrIyj7pcWEPeYgnr+psd6CNKlqOslf0+WUFSf0RVl45\nuTckfS/D46llZRGbnOOixtM0v0fK60iSjLfWOTQJWAF8BIHaCEb3nAafZcFGnRb/\nLYwBYHakhtlvQFprEp7R+ja3e5+m4N3x7Rr/WEG57g+PXigsH2oGOZxgjRbaoAw8\nQovG3ngU1/4Zo6p+7spTtPQ2eyhuE3qd039zJ4mKysJWqdZUsByNPfFITKVtbj5m\nhtZPT
```
likely benign LLM, confidence 0.93 An armored PGP public key block embedded as a string in pnpm's bundle.
Reasoning
This is another PGP public key block in a string literal, the same kind of key material as the neighbouring findings. It is a raw base64-armor match with no decoding or execution, consistent with a bundled key list.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62035:61

101 rows of base64-like lines, lines 62035-62035 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFM7JpoBEACmf7uB5P5QJ8X38ARQn+dr+/O+6/wzkKzUcoFvRArwZTcpdEO/\n0C12kNSpK2UkVMh4sorYwA8W0yv3spZJWU3TiIfCVryxqZaAWEIU+dwsQ0P6EAUy\nthjdQEs81bG6aN0dUqE26fWjGL/mU7BPtAwfzg6lty2cwZJP5zaNCl/PjRUeTKC2\noNas3M5dWoOqWq6HLPqnTEPHPlZ/mhkOfLOnJA6r669sQcml5R+Lhwd8wdJp+ANi\nDLW66
```
likely benign LLM, confidence 0.93 A PGP public key block literal in the pnpm bundle.
Reasoning
The snippet is an armored PGP public key in a string constant. Base64 armor is expected for key material, and the finding comes from the raw pass, which has a high false-positive rate. No code consumes this blob in a suspicious way within the shown snippet.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62039:61

63 rows of base64-like lines, lines 62039-62039 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFcGZx4BEACa92SjEniMQIBdb0btnZRu8vzOGNe+ndzXIWPyu2h+p0xZ/2JN\nMDQW5hc8USoV4/rTssdqDOqcu3AkmLtZi14IaRJ1TQP6Zb05I8MOEm58WXXn7fSF\nYJwhD3LDrAdAHAs896QvsFG7X3Rw18+j7RpK/MPIXZDA5GS3QPfrB67q/J3vvJyQ\neNz9jSlnMpkNO3KQYvUuU1KqeBpMXZtJi52B6FQY7y3H27MgjmJ2EEX9f1uNaxUw\n0SzHC
```
likely benign LLM, confidence 0.93 A PGP public key string constant in the pnpm bundle.
Reasoning
The snippet is a PGP public key block in a JavaScript string, typical of signature-verification key sets shipped with a package manager. The base64 match is the armor encoding of a public key, not a payload.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62043:61

222 rows of base64-like lines, lines 62043-62043 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFaVjpQBEADt/ZC4FsskPNkAgLq240K+CjPJzq/0cuEyABJeAVeYWJFUJRcb\nzNHBVzr85vW0pEKJUGyTyVxGV1P9VzkqaL5RRiupViwC5lf48P78fCMgEa2z4LIt\nnlIiWnJ1UlDeTvLc1DiLCxWgsYTRRj+x70/sL6EmH7laE1C/5RlnkGnuxM4Vgruc\nT1UMHsZJE/kefPe95NhzJtu+ii/v345ZqHhsGPyfeJYV2CiS2iTIqxvyvrlidrVw\nhqird
```
likely benign LLM, confidence 0.93 An embedded armored PGP public key in pnpm's bundled JavaScript.
Reasoning
The snippet is a long armored PGP public key block. Public keys are not secret and are commonly embedded for release verification. The raw pass flags the base64 shape alone, and there is no decode-and-run step visible.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62047:61

36 rows of base64-like lines, lines 62047-62047 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQGNBGKD3OQBDAC3ESxNd7dHfM7Hl3sE7Xn2osS4UZkJtmXA7hdbfybzf164wCbL\ncYECq0GrGfgdnKEMWNzr2S08KkUWQwJZd70Jt1voVpqWVXdtBH/KxGwifixMkTEy\nlu0ePvJM7L5HNOIZP5njcAU03hKgIibYQW+SWj/G37yfdyNprN2uX8p4CUyJbnBc\nYOZ2W1tUzNsddvTV03JlDmfR5kwHoi5sTCqvQWTzsIQn/vGHxMqa3XjabfSvim1A\nytE1J
```
likely benign LLM, confidence 0.93 A PGP public key literal in the pnpm bundle.
Reasoning
This is a PGP public key block string. The header and body are standard armored key material, and the surrounding bundle is a legitimate package manager. The base64 finding does not indicate obfuscation.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62051:61

85 rows of base64-like lines, lines 62051-62051 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBF222c0BEAC/wIiI7EYmA7yprNa/0en2leF+CrF09BlCItTHH5IgjSLGq2tI\nBi3hIhf7TitDlu6GphHlFjvhj6UDgdEmr0itcoOLRhtER6WlmMaXtS+im5fPSLWW\nskZSAh1YC3iqOQCErkAnVFUWY5nUbWfxgv0pKrc5GTT2RkiD6ngor5YIAkRaYQ+n\nniHsekUYOuLln0p4n/K0/iRw5NMok9Q2FwlEj7H0kCfDPuqsgfEoDXoVv8QSVIpB\n1gdOQ
```
likely benign LLM, confidence 0.93 An armored PGP public key block string in pnpm's bundle.
Reasoning
The snippet contains an armored PGP public key in a string. This is expected key data for a package manager's verification logic and is not executed or decoded in the snippet shown.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62055:61

31 rows of base64-like lines, lines 62055-62055 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQENBFKKodABCADiE7Ex8GXnQNgipqbTADO5+BfufYFeq9YLEKkuOUfnjAZ8Wzle\n4eLL4rdfFSuwuUO0rkSFOpNjkjKqxfRo0RkmlMxdHwT2auf/yrfX4EyhyKDn1Vh8\nMP2JecXQN3FVa1yR8AMGfT0zOP138MNp21tNp3Dy9r/ds6ZhttrnR+mrKnhKMmTj\n1J+MX/LKw3o9ERIz0O8dxw75pA27npX1EcSCM1Vcq1bam7xD6d3cfQtfQsidXkQ/\nnFpD7
```
likely benign LLM, confidence 0.93 A PGP public key literal embedded in the pnpm JavaScript bundle.
Reasoning
The finding is a PGP public key block in a string literal. Key blocks in the bundle are legitimate verification material, and the raw base64 signal reflects their encoding rather than hidden logic.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62059:61

46 rows of base64-like lines, lines 62059-62059 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFhJehkBEADNX8qrO9msK8u1znGaBG+Fr0FS5qzMxpC9oStGZV8abX/rrLkN\nNiImTUMQG6Ooz7luOBSSF7VbYT2xSrgzuYV8WrSJE4Oo0AjVNn2YnbwgyzcQ5FhY\noDcfthDk1HALwXPxjyxvWA2RYf9NZj5OsT2j7nzVoRrQZRtDDB4l2dyEObZ4Am5R\nMRdmAApgHYB1vdTqseHIQjB14V5RcuEzZaE6qez/vJuCHWQby5y2c7JhbY4Hj7gw\nMCkB4
```
likely benign LLM, confidence 0.93 A PGP public key block string inside pnpm's bundled code.
Reasoning
This is an armored PGP public key in a string constant. It is public data with no execution path in the snippet, and the match is a base64 false positive typical of raw-pass heuristics on key material.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62063:61

45 rows of base64-like lines, lines 62063-62063 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFl60g4BEAChHPOjxooUAUjigTKIERl8uYyOTA0JL9nICb7Azbl2J3ygmku6\nHdbaqgfaHRwap+hE0s8/oLkccFJVnab6b0rexWQEvarOtzkARJ0wqbxQIQBJKhfS\nV9KCjeacnohnd7CZCW64PtNLC1M9J7rBR32/f5YjllVQeZ/JesWW4HjxbxQLQZ5q\nccjuFw3ZG82zXZZ6gn5b1hNcrDuBLhmQ70UV25rNQopM916o62jXVIbCRNh/nflb\nhGaWr
```
likely benign LLM, confidence 0.93 An embedded PGP public key string in the pnpm bundle.
Reasoning
The snippet is a PGP public key block stored as a string. Public keys are non-secret, and this pattern is a common, legitimate way to ship verification keys in a CLI bundle. The raw base64 detection is not evidence of malicious intent.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62067:61

46 rows of base64-like lines, lines 62067-62067 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFltAggBEADHYmcgBOWwJTVRJCnqEpC8IvOber468ikSgNolQHFbyUkJy/kd\ncx+byBnvqs+s050N6EocIkmPvaa+ptNYf21uDnGKPyFqPMKn68iAXwVDasUK1SST\nlQSixf4qyHjcD7oyDm+1behw0J+KEnjLj941/Q4TOTu93ntRtgBKX0urXTvGjuxk\niHyMiPSiisuV4S0cpi5XsPOPrCvRFrx6xUGRAPf5+MVJkbS5AknmE/aFaMa7yfXe\nhZEYI
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block in the bundled pnpm CLI.
Reasoning
The snippet is an ASCII-armored PGP public key block, which is public key material, not a payload. Base64 is the expected encoding for PGP armor, and the flag is a raw-pass base64-like heuristic on it. This is a bundled key list, consistent with pnpm verifying signed releases.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62071:61

25 rows of base64-like lines, lines 62071-62071 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQENBFTROWUBCACslqx8p2znj3CwEqWK+bEgyfxykVC1iFEABB6UCQ5UrlAiYTjI\n0vwFaTlbWkD3dWBxiFN2+n24Lro549ATmXGO+i0Sacr7DTgawZdkJuM17nNmlAW1\nc1lo6D/KfQ1K7QrakloQw10LzLLW3uxi3OXVoefY1JKTeQn43jolrCHho9iNvZ0N\nxyihQYzSiRzqMQGltKw5UDdbhwuzr9jROgHuUH+msOzax9IkLb8mm2VqJ3HaDJWk\noAaU9
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block in the bundled pnpm CLI.
Reasoning
Another armored PGP public key block inside the same bundled key list. The base64 content is standard key data, so the encoding-base64 raw hit is a false positive.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62075:61

25 rows of base64-like lines, lines 62075-62075 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQENBEx8nbMBCACjmblSAGggunFHAWRGZLWLKltA2PG6rIM0bOokJFWtGwRqBCAa\ndKuNwBGy7eBwFQAxuHnNwDKqyGgCKUBe4RUuz0gKr1WgkPAzHZppo/n5BhE4iIxr\nlWJBKVKk/gjXVUBPhRPWNTa23JbzJHntxzHqeMQWIwIdBXoyOf0tOuXcfH2oVBdq\np8nFaeJQ906F6olUD8U12LgIhkg6/NTDLymwkau4YcOe8c2repNITVFaP6w5FmSj\naWTny
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block in the bundled pnpm CLI.
Reasoning
Same pattern: an armored PGP public key string in a list of trusted keys. Nothing decodes or executes it, and public keys are not secrets.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62079:61

46 rows of base64-like lines, lines 62079-62079 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFiGktYBEADoBPdUkwVA9dNViz2wxb+e3XiaQaesSHvRReDpOpWQ7yuw2yLd\nxeUer6Iexcoje/i18x+eD7FF1gi+Lo2J1LVIRchTCx2vGs9P2iYW1iypCRl89C72\nsq0aHz6SiW0OActk5FOJtlOycuYpGra8bKqyTk8en17s6EyjEcvQ54FWacriLz6f\nk1ZnV3mBIiy03IWEOaVUxIvmuBM8MQRUXYn/BxUX1Vpo0qpqf9qtXR7QbiUyjTN/\ndHUz3
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block in the bundled pnpm CLI.
Reasoning
An armored PGP public key block, with the base64 body typical of RSA key material. The raw pass flags its encoding only; there is no decode-and-run step.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62083:61

46 rows of base64-like lines, lines 62083-62083 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFSvCTEBEADIa8J6pku+vT9RZ/cU4wKmC441OVghEZ8Cuct4AynkZQZ8Hpra\n4mq9SEjB9t2KSM7kvN/yBrrJBJwAnR7Q+e3+gfthL8Hmgr7K2J+qJdSm7Va/LcSK\nzZjN8UX0EFC+gh+gda9qm0nwRTgxR9k9nWu3l6zcvEsLE79m9Uir3W8BtGak9HCU\n69aSaaWupoqTXgPvYuh0LaF5C+qEccUls/Bmuw8FPP+T8OmOc5SU8pD9uz2r2S+p\nrBqh6
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block in the bundled pnpm CLI.
Reasoning
Armored PGP public key data as a string constant. This is expected in a package that verifies signatures, and the base64 flag is a heuristic false positive.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62087:61

69 rows of base64-like lines, lines 62087-62087 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQGiBEPOjg4RBAC2iPU+EHukOrmApMnhYym03gV/VbdPDydVVj+fc7TyjULlKWP7\niEMFZb58EBjjK4Db3O5JiC9yZ7NRgYvqCFGP7hTVBTykJucXIyT8wCmaAImrtAlg\nhA7LKTKlMdkPMz+iTiaVivt5F2W24Lfy/f664J5POcUH3Y5e1dhImNY6fwCg9TN8\nT2QKrFuudsbvqdw+w9I9ZD8EALBfpb39xdZenQllhq6MnODIzeHf5+wQV0slAzaO\nRZCAV
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block in the bundled pnpm CLI.
Reasoning
Armored PGP public key block containing a v4 key packet layout. It is static data within a key list and is not executed or decoded at runtime in the snippet.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62091:61

124 rows of base64-like lines, lines 62091-62091 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBF/qTWsBEADlnzvN5W//gwj5oOpnyPQLjjguiXi0NPe9o0LcQgOmccD8a76R\nr4VQDDM9iFieOcmdcJzTeEcTli165+pBTilqR/RBjq63N4jFzzsiCDJaf8utUhlW\nV7ISG3tpzEJWcgdqK+YlNgVv5C0K1BwvXfh5H5P8pRzvLTpmnhvBIoV4srnVP158\nPifAkbeEBIZU5xyjmFSgevX1QSvjpIdAGvo7RKNzNbbG8SK5KNOkrPzGq3lOtpwA\nduj21
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block in the bundled pnpm CLI.
Reasoning
Armored PGP public key material. Long base64 is normal for key blocks, and the finding only reflects the encoding heuristic.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62095:61

81 rows of base64-like lines, lines 62095-62095 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBGHo9TgBEADbSK0AjEvbVkjrvHk3HG1InM3H0kqEjXxenzTukSHQOl8ytLUD\ngP1PPzuHmgTqgONkNa3JNHv7AMO7lUukIYTSvtzOI6fl2i13ZeASDGCBfFHYjxeA\nAcwVe0lTbQUrQA6sUTBJIxL/3JcP0h8mCc5usIiafSclgnTTMbjhbyN5/GJ4AYgv\nv85oyarvX5q2qQhtP6JcevhNwTAxU00XBnPyMr5bL9CSAImOpHDAk/8CLoC4UIW5\nioBFI
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block in the bundled pnpm CLI.
Reasoning
Armored PGP public key block, a static key constant. Nothing in the snippet decodes or runs it.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62099:61

9 rows of base64-like lines, lines 62099-62099 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmDMEZAFttBYJKwYBBAHaRw8BAQdA9UUQNclFp0rIrgtQnNw6BgjDINkFPoVbuS4H\nsQNEf+e0LEp1YW4gSm9zw6kgQXJib2xlZGEgPHNveWp1YW5hcmJvbEBnbWFpbC5j\nb20+iJMEExYKADsWIQTdeS9Zc8beUsQyy9rHer+gDdvytwUCZAFttAIbAwULCQgH\nAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRDHer+gDdvyt3PYAP9A8XbvZYT+N7k9\n2xnRM
```
likely benign LLM, confidence 0.92 Embedded armored PGP public key block for a named maintainer in the bundled pnpm CLI.
Reasoning
Armored PGP public key block with a User ID line for a named maintainer, followed by base64 key packets. This is a maintainer's public key in a trusted-key list, which is ordinary for a release-verification feature.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62103:179

175 rows of base64-like lines, lines 62103-62103 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
 ulises Gascon <ulisesgascongonzalez@gmail.com>\n\nxsFNBF0VqLoBEACiPJYKX/UT5OFnucsBQqSmFNPsRD6JaClRqNe8wQfOZKFNLyat\njtNj2Bvuq2wDTdKSiwcT3PWtPCEVEQ5i4MMzwmnflAV4KTtj8mLCGTR3ighnf9kF\nhBdX+G4I3lQ2rIAc7ie+sI67zFmsAC7wFTw06DrB18vxl5uX7H5UqDXLsOQKE3+D\nQ2SsygI+JsCanaZ+kk6pxgflNDlWj5uRIPe82Cwxg0gS0aQKX5m//diavfhlPmuo\nYaQio
```
likely benign LLM, confidence 0.92 Embedded armored PGP public key block for a named maintainer in the bundled pnpm CLI.
Reasoning
Armored PGP public key block with a maintainer's User ID header and base64 key packets. It is static key data, and the base64 heuristic only fires on the encoding.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62107:61

47 rows of base64-like lines, lines 62107-62107 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBGYFoj0BEACm4UKYcykICb5oxZQQxSZRYwzkSngpeFcrruHVHfg2jcQ+VmRV\nC3NrbhSrBQuJ0pMx/zq/yZB6K4JS+EMf5GpaX2ZsVsj/MPoSKVHcyXR4clIulCxN\nrUyKYS78awl3bE+dwf9U+IY2fMoMVLwNL8kT2Yr28dI2u47bOPRqxDTxJ8VkRMR2\n4Nv8VbFn2kZVm4u/ZE4lVlAr82vuM8dOdo+RA6OTfnJRBtuwp8YmSLQnoE+BeR+i\nLgbmq
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key string in the pnpm bundle.
Reasoning
Raw-pass base64 hit inside a string literal that holds an ASCII-armored PGP public key block. Public keys are supposed to be distributed openly, and the blob is just armored key data, so this is a legitimate embedded key rather than a payload.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62111:61

47 rows of base64-like lines, lines 62111-62111 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBGHwIyoBEADN55NGkn1hvOjFotJVr8aeU6/xGZF3gPLi7q2qaX5CXtVMGS2B\n5h9kiBKrNo1+xeC1+jRu9r5179lTiYV808qNFBQdr+5ZBnOoszadlMPMtU89qsR9\njxr8wJT563nIPoCeRl+0oFeam9ktAZnnpLz0dmPxyHHVaFXsVauDpwjJxOPo5Vyo\n2MHTacVUBWZA6R92ZETWIOHSg3ZtLf+jq7IyzeYSnj31kbx5djGtawLKZZ9bbIdr\nihRys
```
likely benign LLM, confidence 0.93 Another embedded armored PGP public key string in the bundle.
Reasoning
Same pattern as the other PGP key literals: a public key block in a string constant, consistent with pnpm's signature-verification keyring. Raw-pass base64 matches on armored keys are expected false positives.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62115:61

13 rows of base64-like lines, lines 62115-62115 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmDMEaGA63BYJKwYBBAHaRw8BAQdAo/yU+MutacFmmn0CEX495goNrBxR24235XLM\ncvHYjfq0L0FudG9pbmUgZHUgSGFtZWwgPGR1aGFtZWxhbnRvaW5lMTk5NUBnbWFp\nbC5jb20+iI4EExYKADYWIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCaGA63AIbAwQL\nCQgHBBUKCQgFFgIDAQACHgUCF4AACgkQILGjkLFo01afgwEA/sLHqsj7ml2vyDoT\nKDPE8
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block, benign data.
Reasoning
A PGP public key block in a string literal, with the armor and key-packet structure intact. Nothing here executes or fetches anything.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:62119:61

9 rows of base64-like lines, lines 62119-62119 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
moredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmDMEakIjcxYJKwYBBAHaRw8BAQdAYRFWvBCAd9dDjKTePuAvvzAWxhvojAXco0m4\n2AMh/MC0H1N0ZXdhcnQgWCBBZGRpc29uIDxzeGFAaWJtLmNvbT6ImQQTFgoAQRYh\nBGVfO1wfs/qNGgymveSn0jK5NtL9BQJqQiNzAhsDBQkDwmcABQsJCAcCAiICBhUK\nCQgLAgQWAgMBAh4HAheAAAoJEOSn0jK5NtL9FOEBAMpIjknm4fnEQvTmIlzy0kDu\nVplF4
```
likely benign LLM, confidence 0.93 Embedded armored PGP public key block, benign data.
Reasoning
Armored PGP public key data in a string constant. It is static key material with no decoding-to-execution path visible.

info long-line dist/pnpm.cjs:78508:1

line length 606 characters (raw pass, confidence 0.50)

    exports2.xfs = exports2.extendFs = exports2.patchFs = exports2.VirtualFS = exports2.ProxiedFS = exports2.PosixFS = exports2.NodeFS = exports2.NoFS = exports2.MountFS = exports2.LazyFS = exports2.JailFS = exports2.CwdFS = exports2.BasePortableFakeFS = exports2.FakeFS = exports2.AliasFS = exports2.ppath = exports2.np

info long-line dist/pnpm.cjs:78835:1

line length 667 characters (raw pass, confidence 0.50)

      }, peg$c177 = /^[$@*?#a-zA-Z0-9_\-]/, peg$c178 = peg$classExpectation(["$", "@", "*", "?", "#", ["a", "z"], ["A", "Z"], ["0", "9"], "_", "-"], false, false), peg$c179 = /^[()}<>$|&; \t"']/, peg$c180 = peg$classExpectation(["(", ")", "}", "<", ">", "$", "|", "&", ";", " ", "	", '"', "'"], false, false), peg$c181 =

info long-line dist/pnpm.cjs:82325:1

line length 625 characters (raw pass, confidence 0.50)

          return doubleQuoteIfRequested(typeof argumentSegment.defaultValue === `undefined` ? typeof argumentSegment.alternativeValue === `undefined` ? `\${${argumentSegment.name}}` : argumentSegment.alternativeValue.length === 0 ? `\${${argumentSegment.name}:+}` : `\${${argumentSegment.name}:+${argumentSegment.alterna

info ~~critical~~ → info by review dynamic-execution dist/pnpm.cjs:83918:16

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
      if (ast.body[0].expression.body.type === "BlockStatement") {
        return new Function(params, source.slice(body[0] + 1, body[1] - 1));
      }
      return new Function(params, "return " + source.slice(body[0], body[1]));
```
likely benign LLM, confidence 0.72 Function constructor building a function from parsed source text in a YAML function-type handler.
Reasoning
This is the js-yaml-style !!js/function support, which builds a function from source text in a YAML document. It is a known library feature that executes YAML-provided code, so it is a real risk for untrusted input, but it is standard library behaviour in a parser rather than injected malicious code. The lower confidence reflects that the bundled copy still exposes dynamic execution.
info ~~critical~~ → info by review dynamic-execution dist/pnpm.cjs:83920:14

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
      }
      return new Function(params, "return " + source.slice(body[0], body[1]));
    }
    function representJavascriptFunction(object) {
```
likely benign LLM, confidence 0.72 Second Function constructor call in the same YAML function representer/loader code.
Reasoning
Second Function-constructor call in the same YAML function-type handler (the non-block-body branch). Same reasoning: library parser behaviour, not a dropper or hidden payload.

info long-line dist/pnpm.cjs:85253:1

line length 582 characters (raw pass, confidence 0.50)

      return isPrintable(c) && c !== 65279 && !isWhitespace(c) && c !== CHAR_MINUS && c !== CHAR_QUESTION && c !== CHAR_COLON && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET && c !== CHAR_SHARP && c !== CHAR_AMPE

info long-line dist/pnpm.cjs:85838:1

line length 739 characters (raw pass, confidence 0.50)

      }, peg$c82 = /^[0-9a-fA-F]/, peg$c83 = peg$classExpectation([["0", "9"], ["a", "f"], ["A", "F"]], false, false), peg$c84 = peg$otherExpectation("blank space"), peg$c85 = /^[ \t]/, peg$c86 = peg$classExpectation([" ", "	"], false, false), peg$c87 = peg$otherExpectation("white space"), peg$c88 = /^[ \t\n\r]/, peg$c

info long-line dist/pnpm.cjs:87632:1

line length 567 characters (raw pass, confidence 0.50)

    exports2.stringifySyml = exports2.parseSyml = exports2.stringifyResolution = exports2.parseResolution = exports2.stringifyValueArgument = exports2.stringifyShellLine = exports2.stringifyRedirectArgument = exports2.stringifyEnvSegment = exports2.stringifyCommandLineThen = exports2.stringifyCommandLine = exports2.str

info long-line dist/pnpm.cjs:94303:1

line length 787 characters (raw pass, confidence 0.50)

    exports2.isAbsolute = exports2.partitionAbsoluteAndRelative = exports2.removeDuplicateSlashes = exports2.matchAny = exports2.convertPatternsToRe = exports2.makeRe = exports2.getPatternParts = exports2.expandBraceExpansion = exports2.expandPatternsWithBraceExpansion = exports2.isAffectDepthOfReadingPattern = exports

info long-line dist/pnpm.cjs:102459:1

line length 509 characters (raw pass, confidence 0.50)

      return x != null && typeof x["fantasy-land/empty"] === "function" ? x["fantasy-land/empty"]() : x != null && x.constructor != null && typeof x.constructor["fantasy-land/empty"] === "function" ? x.constructor["fantasy-land/empty"]() : x != null && typeof x.empty === "function" ? x.empty() : x != null && x.construc

info dynamic-execution dist/pnpm.cjs:105749:22

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

        return void 0;
      const auth64 = btoa(`${uri.username}:${uri.password}`);
      return `Basic ${auth64}`;
    }

info ~~warn~~ → info by review dynamic-execution dist/pnpm.cjs:121050:23

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
        } else if (typeof atob === "function") {
          const str = atob(src.replace(/[\n\r]/g, ""));
          const buffer = new Uint8Array(str.length);
          for (let i = 0; i < str.length; ++i)
```
likely benign LLM, confidence 0.85 Browser-compatible base64 decode helper using atob into a Uint8Array.
Reasoning
A fallback that decodes base64 with atob into a Uint8Array when Buffer is unavailable. This is a generic browser-compatible base64 decoding utility, and the decoded bytes are only copied into a buffer here.

info dynamic-execution dist/pnpm.cjs:121071:17

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

            s += String.fromCharCode(buf[i]);
          str = btoa(s);
        } else {
          throw new Error("This environment does not support writing binary tags; either Buffer or btoa is required");

info ~~warn~~ → info by review dynamic-import dist/pnpm.cjs:126490:26

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      try {
        const pnpmfile = require(pnpmFilePath);
        if (typeof pnpmfile === "undefined") {
          logger_1.logger.warn({
```
likely benign LLM, confidence 0.85 Loads the project's pnpmfile hook module via a computed path.
Reasoning
pnpm loads the user's .pnpmfile via require with a computed path. That is a documented hook feature of pnpm, so a non-literal specifier here is expected.

info unicode-surrogate dist/pnpm.cjs:132159:27

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    var reIsOctal = /^0o[0-7]+$/i;
    var rsAstralRange = "\\ud800-\\udfff";
    var rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23";
    var rsComboSymbolsRange = "\\u20d0-\\u20f0";

info unicode-surrogate dist/pnpm.cjs:132159:35

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    var reIsOctal = /^0o[0-7]+$/i;
    var rsAstralRange = "\\ud800-\\udfff";
    var rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23";
    var rsComboSymbolsRange = "\\u20d0-\\u20f0";

info unicode-surrogate dist/pnpm.cjs:132165:20

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    var rsCombo = "[" + rsComboMarksRange + rsComboSymbolsRange + "]";
    var rsFitz = "\\ud83c[\\udffb-\\udfff]";
    var rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")";
    var rsNonAstral = "[^" + rsAstralRange + "]";

info unicode-surrogate dist/pnpm.cjs:132165:28

orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

    var rsCombo = "[" + rsComboMarksRange + rsComboSymbolsRange + "]";
    var rsFitz = "\\ud83c[\\udffb-\\udfff]";
    var rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")";
    var rsNonAstral = "[^" + rsAstralRange + "]";

info unicode-surrogate dist/pnpm.cjs:132165:36

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    var rsCombo = "[" + rsComboMarksRange + rsComboSymbolsRange + "]";
    var rsFitz = "\\ud83c[\\udffb-\\udfff]";
    var rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")";
    var rsNonAstral = "[^" + rsAstralRange + "]";

info unicode-surrogate dist/pnpm.cjs:132168:27

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    var rsNonAstral = "[^" + rsAstralRange + "]";
    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsZWJ = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:132168:35

orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

    var rsNonAstral = "[^" + rsAstralRange + "]";
    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsZWJ = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:132168:43

orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

    var rsNonAstral = "[^" + rsAstralRange + "]";
    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsZWJ = "\\u200d";

info unicode-surrogate dist/pnpm.cjs:132169:25

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsZWJ = "\\u200d";
    var reOptMod = rsModifier + "?";

info unicode-surrogate dist/pnpm.cjs:132169:33

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsZWJ = "\\u200d";
    var reOptMod = rsModifier + "?";

info unicode-surrogate dist/pnpm.cjs:132169:42

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsZWJ = "\\u200d";
    var reOptMod = rsModifier + "?";

info unicode-surrogate dist/pnpm.cjs:132169:50

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
    var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
    var rsZWJ = "\\u200d";
    var reOptMod = rsModifier + "?";

info long-line dist/pnpm.cjs:135970:1

line length 525 characters (raw pass, confidence 0.50)

      numbers: ["\u24EA", "\u2460", "\u2461", "\u2462", "\u2463", "\u2464", "\u2465", "\u2466", "\u2467", "\u2468", "\u2469", "\u246A", "\u246B", "\u246C", "\u246D", "\u246E", "\u246F", "\u2470", "\u2471", "\u2472", "\u2473", "\u3251", "\u3252", "\u3253", "\u3254", "\u3255", "\u3256", "\u3257", "\u3258", "\u3259", "\u3

info ~~warn~~ → info by review dynamic-import dist/pnpm.cjs:159637:35

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      }
      const { devDependencies } = require(packageJsonPath);
      return Boolean(devDependencies && devDependencies[packageDetails.packageNames[0]]);
    }
```
likely benign LLM, confidence 0.90 Reads a package.json by computed path to check for a devDependency.
Reasoning
Reads a package.json by computed path to check devDependencies. Reading manifests is routine package-manager behaviour with no code execution beyond loading JSON.
info ~~warn~~ → info by review dynamic-import dist/pnpm.cjs:159692:37

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      }
      const { version: version2 } = require((0, path_1.join)(packageDir, "package.json"));
      const result2 = semver_12.default.valid(version2);
      if (result2 === null) {
```
likely benign LLM, confidence 0.90 Reads an installed package's package.json to get its version.
Reasoning
Requires the package.json of an installed package to read its version. Loading JSON via require for version lookup is a standard pattern.
info ~~warn~~ → info by review error-stack-inspection dist/pnpm.cjs:163753:23

`match` called on `new Error().stack` — string-matching the call stack is the structural shape of sandbox/analyzer detection (ast pass, confidence 0.85)
```
        }
        const stack = new Error().stack.match(/(?<=^ +)at.*/gm)?.slice(2) ?? [];
        if (stack.length > 0) {
          console.error();
```
likely benign LLM, confidence 0.80 Parses the error stack to locate caller frames, a common caller-location utility.
Reasoning
Parses new Error().stack to find caller frames, slicing off the first two. This is a common caller-location utility pattern used for locating the calling module or logging context. Sandbox detection would look for environment checks, not a stack-frame split like this.

info encoding-base64 dist/pnpm.cjs:173140:64

base64-like blob (67 bytes, compression ratio 0.88) (in comment) (raw pass, confidence 0.36)

      }],
      // https://github.com/vuejs/vue-cli/pull/6060/files#diff-857cfb6f3e9a676b0de4a00c2c712297068c038a7d5820c133b8d6aa8cceb146R28
      [`@vue/cli-plugin-typescript@<=5.0.0-alpha.0`, {
        dependencies: {

info long-line dist/pnpm.cjs:179493:1

line length 697 characters (raw pass, confidence 0.50)

        exports3.getFirstSuitableFolder = exports3.readFirstAvailableStream = exports3.makeTempDir = exports3.hardlinksWork = exports3.writeFilePreservingEol = exports3.getFileSizeOnDisk = exports3.walk = exports3.symlink = exports3.find = exports3.readJsonAndFile = exports3.readJson = exports3.readFileAny = exports3.h

info ~~critical~~ → info by review dynamic-execution dist/pnpm.cjs:183638:53

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
            queue[++counter] = function() {
              invoke(typeof fn == "function" ? fn : Function(fn), args);
            };
            defer(counter);
```
likely benign LLM, confidence 0.80 A timer-style deferral helper falls back to Function(fn) when given a string body.
Reasoning
The surrounding code queues callbacks and calls Function(fn) only when fn is not already a function. This matches the string-form fallback of a setTimeout/setImmediate polyfill, a long-standing legitimate pattern. It is still a dynamic-execution sink, so some doubt remains.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:192850:17

base64-like blob (124 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
```
        "scheme": "ecdsa-sha2-nistp256",
        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="
      },
      {
```
likely benign LLM, confidence 0.90 A base64-encoded ECDSA P-256 public key in a JSON data structure.
Reasoning
The value is an ECDSA P-256 SubjectPublicKeyInfo encoding (the MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE prefix) inside a JSON structure with a scheme field. Public keys are routinely embedded this way and carry no malicious intent.
info ~~warn~~ → info by review encoding-base64 dist/pnpm.cjs:192857:17

base64-like blob (124 bytes, compression ratio 1.02) (raw pass, confidence 0.60)
```
        "scheme": "ecdsa-sha2-nistp256",
        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="
      }
    ];
```
likely benign LLM, confidence 0.90 A second base64-encoded ECDSA P-256 public key in a JSON array.
Reasoning
This is the same kind of ECDSA P-256 public key encoding, with the same SPKI header and a JSON scheme field. It is ordinary key material.

info long-line dist/pnpm.cjs:202605:1

line length 644 characters (raw pass, confidence 0.50)

      return stdout.replace(new RegExp(`(a|b)(${(0, escape_string_regexp_1.default)(`/${removeTrailingAndLeadingSlash(folderAN)}/`)})`, "g"), "$1/").replace(new RegExp(`(a|b)${(0, escape_string_regexp_1.default)(`/${removeTrailingAndLeadingSlash(folderBN)}/`)}`, "g"), "$1/").replace(new RegExp((0, escape_string_regexp_

info long-line dist/worker.js:10740:1

line length 638 characters (raw pass, confidence 0.50)

    exports2.default = /((['"])(?:(?!\2|\\).|\\(?:\r\n|[\s\S]))*(\2)?|`(?:[^`\\$]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{[^}]*\}?)*\}?)*(`)?)|(\/\/.*)|(\/\*(?:[^*]|\*(?!\/))*(\*\/)?)|(\/(?!\*)(?:\[(?:(?![\]\\]).|\\.)*\]|(?![\/\]\\]).|\\.)+\/(?:(?!\s*(?:\b|[\u0080-\uFFFF$\\'"~({]|[+\-!](?!=)|\.?\d))|[gmiyus]{1,6}\b(?![\u0080-

info ~~warn~~ → info by review long-line dist/worker.js:10771:1

line length 2269 characters (raw pass, confidence 0.65)
```
    var astralIdentifierStartCodes = [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 8, 70, 5, 3, 0, 2, 
```
likely benign LLM, confidence 0.95 A long minified array of Unicode identifier code points from a parser library.
Reasoning
The array of astral identifier start code points is a standard Unicode identifier table, as found in parser libraries such as acorn and babel. A long line is typical for minified generated tables.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pnpm-10.34.8.tgz https://registry.npmjs.org/pnpm/-/pnpm-10.34.8.tgz
printf '%s  %s\n' 5be9fac9764583af5fa07015b9b0aa930ef634535df9fa6f464020d72b195630 pnpm-10.34.8.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf pnpm-10.34.8.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg