npm / pnpm / 12.14.0

pnpm 12.14.0

Source

https://github.com/pnpm/pnpm

Tag scanned

v12.14.0

Directory

pnpm/npm/pnpm (only this part of the repository was scanned)

Compared with

v12.13.0 (0 signals introduced since)

Files

15 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-15 18:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import pnpm/npm/pnpm/bin/pnpm.mjs:79:44

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

     console.error(`Downloading the pnpm ${version} binary for ${process.platform}-${process.arch}...`)
     const { downloadPnpmExecutable } = await import(GET_PNPM).catch((err) => {
       fail(`This copy of the pnpm package is missing the downloader it needs: ${err.message}`)
     })

   likely benign LLM, confidence 0.80 A pnpm launcher lazily imports a downloader module via a constant specifier, with an error fallback.

   Reasoning

   GET_PNPM is a module specifier whose value is not shown in the snippet, but the surrounding code is a launcher that lazily loads a downloader module and fails with a clear message if it is missing. This is a common pattern for lazy-loading an internal helper; the non-literal specifier is a moderate concern only because the value is not visible.

2. info warn → info by review dynamic-import pnpm/npm/pnpm/test/install.test.mjs:181:52

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

       const { setLibc, setEndianness } = fakeHost(t, 'linux', arch)
       const { getBinCandidates: candidates } = await import(`../native-binary.mjs?${arch}`)
   
       setLibc('glibc')

   likely benign LLM, confidence 0.90 A test dynamically imports a local native-binary module with a query string to reload it under a faked platform.

   Reasoning

   This is a test file importing a relative module with a query string used as a cache-buster so the module re-evaluates under faked host platform/arch. The specifier is built from a test parameter and points at a local file, which is a standard test technique and not an execution risk.

3. info warn → info by review dynamic-import pnpm/npm/pnpm/test/install.test.mjs:209:52

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

       fakeHost(t, 'android', arch)
       const { getBinCandidates: candidates } = await import(`../native-binary.mjs?android-${arch}`)
   
       // Android is bionic, so the libc ordering the linux entries go through

   likely benign LLM, confidence 0.90 A test dynamically imports a local native-binary module with a query string for an Android host simulation.

   Reasoning

   Same pattern as the sibling finding: a test imports a local relative module with a cache-busting query string after faking the Android host. Benign test scaffolding.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pnpm/pnpm pnpm && cd pnpm
git checkout v12.14.0
disclude scan --severity info --diff v12.13.0 pnpm/npm/pnpm