npm / pnpm / 12.14.0

pnpm 12.14.0

Source

https://github.com/pnpm/pnpm

Tag scanned

v12.14.0

Directory

pnpm/npm/pnpm (only this part of the repository was scanned)

Compared with

v12.13.0 (0 signals introduced since)

Files

15 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 14:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import pnpm/npm/pnpm/bin/pnpm.mjs:79:44

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

     console.error(`Downloading the pnpm ${version} binary for ${process.platform}-${process.arch}...`)
     const { downloadPnpmExecutable } = await import(GET_PNPM).catch((err) => {
       fail(`This copy of the pnpm package is missing the downloader it needs: ${err.message}`)
     })

   likely benign LLM, confidence 0.80 The pnpm launcher lazily imports a downloader module via a constant specifier, with a readable error fallback.

   Reasoning

   GET_PNPM is a module constant likely pointing to a bundled downloader module; the dynamic import is wrapped in a catch that reports a missing file. This is a common pattern for lazily loading a sibling module in a package launcher. The non-literal specifier is a generic AST signal and the surrounding code shows no network-fetched code execution beyond a versioned pnpm binary download, which is the package's purpose.

2. info warn → info by review dynamic-import pnpm/npm/pnpm/test/install.test.mjs:181:52

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

       const { setLibc, setEndianness } = fakeHost(t, 'linux', arch)
       const { getBinCandidates: candidates } = await import(`../native-binary.mjs?${arch}`)
   
       setLibc('glibc')

   likely benign LLM, confidence 0.92 Test imports native-binary.mjs with an arch query string to get a fresh module instance.

   Reasoning

   This is a test file importing a sibling module with a query string to get a fresh module instance per test case (cache busting by arch). The specifier is built from a template literal with a test-controlled arch value. No payload or execution of untrusted data.

3. info warn → info by review dynamic-import pnpm/npm/pnpm/test/install.test.mjs:209:52

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

       fakeHost(t, 'android', arch)
       const { getBinCandidates: candidates } = await import(`../native-binary.mjs?android-${arch}`)
   
       // Android is bionic, so the libc ordering the linux entries go through

   likely benign LLM, confidence 0.92 Test dynamically imports native-binary.mjs with an android query suffix to simulate that platform.

   Reasoning

   Same test pattern as the earlier finding: a dynamic import of the local native-binary module with an android arch suffix for cache-busting in a unit test. The arch values come from the test's own table, so this is ordinary test scaffolding.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/pnpm/pnpm pnpm && cd pnpm
git checkout v12.14.0
disclude scan --severity info --diff v12.13.0 pnpm/npm/pnpm