npm / pnpm / 12.15.0

pnpm 12.15.0

Source

https://github.com/pnpm/pnpm

Tag scanned

v12.15.0

Directory

pnpm/npm/pnpm (only this part of the repository was scanned)

Compared with

v12.14.0 (0 signals introduced since)

Files

15 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-21 23:29

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import pnpm/npm/pnpm/bin/pnpm.mjs:79:44

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

     console.error(`Downloading the pnpm ${version} binary for ${process.platform}-${process.arch}...`)
     const { downloadPnpmExecutable } = await import(GET_PNPM).catch((err) => {
       fail(`This copy of the pnpm package is missing the downloader it needs: ${err.message}`)
     })

   likely benign LLM, confidence 0.80 The pnpm launcher lazily imports its downloader module via a constant specifier with a friendly error on failure.

   Reasoning

   The dynamic import targets a module constant GET_PNPM, wrapped in a catch that reports a missing downloader. This is a plausible lazy-load of a bundled helper in the pnpm launcher. The specifier is not shown being derived from remote or user input, so there is no sign of a payload fetch, though the non-literal specifier is worth a glance at where GET_PNPM is defined.

2. info warn → info by review dynamic-import pnpm/npm/pnpm/test/install.test.mjs:181:52

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

       const { setLibc, setEndianness } = fakeHost(t, 'linux', arch)
       const { getBinCandidates: candidates } = await import(`../native-binary.mjs?${arch}`)
   
       setLibc('glibc')

   likely benign LLM, confidence 0.90 Test imports native-binary.mjs with an arch query string to get fresh module state per simulated architecture.

   Reasoning

   This is a test file importing a local module with a query string used as a cache-buster so each arch gets a fresh module instance. The specifier is a relative path template, consistent with test isolation of module state under fake host settings.

3. info warn → info by review dynamic-import pnpm/npm/pnpm/test/install.test.mjs:209:52

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

       fakeHost(t, 'android', arch)
       const { getBinCandidates: candidates } = await import(`../native-binary.mjs?android-${arch}`)
   
       // Android is bionic, so the libc ordering the linux entries go through

   likely benign LLM, confidence 0.90 Test re-imports native-binary.mjs with an android arch query to simulate bionic libc behavior.

   Reasoning

   Same pattern as the sibling test: a relative local module import with a query suffix to reload the module under a simulated android host. No external or encoded source is involved.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/pnpm/pnpm pnpm && cd pnpm
git checkout v12.15.0
disclude scan --severity info --diff v12.14.0 pnpm/npm/pnpm