npm / pnpm / 12.11.2

pnpm 12.11.2

Source

https://github.com/pnpm/pnpm

Tag scanned

v12.11.2

Directory

pnpm/npm/pnpm (only this part of the repository was scanned)

Compared with

v12.11.1 (0 signals introduced since)

Files

15 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 19:36

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import pnpm/npm/pnpm/bin/pnpm.mjs:79:44

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

     console.error(`Downloading the pnpm ${version} binary for ${process.platform}-${process.arch}...`)
     const { downloadPnpmExecutable } = await import(GET_PNPM).catch((err) => {
       fail(`This copy of the pnpm package is missing the downloader it needs: ${err.message}`)
     })

   likely benign LLM, confidence 0.80 pnpm launcher lazily imports its downloader module via a constant specifier after logging a download message.

   Reasoning

   GET_PNPM is a module-level constant pointing at the pnpm downloader module, imported with a catch that reports a missing file. This is a version-gated lazy load of a sibling module, not an attacker-controlled specifier. The non-literal specifier is still a reduced-visibility pattern worth a glance, so the verdict is likely benign rather than fully settled.

2. info warn → info by review dynamic-import pnpm/npm/pnpm/test/install.test.mjs:181:52

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

       const { setLibc, setEndianness } = fakeHost(t, 'linux', arch)
       const { getBinCandidates: candidates } = await import(`../native-binary.mjs?${arch}`)
   
       setLibc('glibc')

   dismissed LLM, confidence 0.90 Test imports native-binary.mjs with a per-architecture query string to get a fresh module instance.

   Reasoning

   Test file dynamically importing a sibling module with an arch query string to bust the module cache, so each test sees fresh platform-dependent state. This is a standard test pattern with no execution of untrusted input.

3. info warn → info by review dynamic-import pnpm/npm/pnpm/test/install.test.mjs:209:52

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

       fakeHost(t, 'android', arch)
       const { getBinCandidates: candidates } = await import(`../native-binary.mjs?android-${arch}`)
   
       // Android is bionic, so the libc ordering the linux entries go through

   dismissed LLM, confidence 0.90 Test imports native-binary.mjs with an android-specific query string for a fresh module instance.

   Reasoning

   Same cache-busting dynamic import pattern in a test, parameterized by arch and an android label. The specifier is a template over test-controlled constants with no external input.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pnpm/pnpm pnpm && cd pnpm
git checkout v12.11.2
disclude scan --severity info --diff v12.11.1 pnpm/npm/pnpm