punycode 2.3.1

Source: https://github.com/mathiasbynens/punycode.js
Tag scanned: v2.3.1
Compared with: v2.3.0 (0 signals introduced since)
Files: 6 scanned, 0 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 26 info
Scan time: 0.0 s
LLM review: LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 13:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info unicode-homoglyph README.md:70:22

[embedded javascript] identifier `джpумлатест` contains homoglyph candidates: у (0443)→y, а (0430)→a, е (0435)→e, с (0441)→c (in string/comment) (raw pass, confidence 0.35)
```
punycode.toUnicode('джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq');
// → 'джумла@джpумлатест.bрфa'
```
```
info unicode-mixed-script README.md:70:22

[embedded javascript] identifier `джpумлатест` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
```
punycode.toUnicode('джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq');
// → 'джумла@джpумлатест.bрфa'
```
```
info unicode-homoglyph README.md:70:44

[embedded javascript] identifier `bрфa` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)
```
punycode.toUnicode('джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq');
// → 'джумла@джpумлатест.bрфa'
```
```
info unicode-mixed-script README.md:70:44

[embedded javascript] identifier `bрфa` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
punycode.toUnicode('джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq');
// → 'джумла@джpумлатест.bрфa'
```
```
info unicode-homoglyph README.md:85:32

[embedded javascript] identifier `джpумлатест` contains homoglyph candidates: у (0443)→y, а (0430)→a, е (0435)→e, с (0441)→c (in string/comment) (raw pass, confidence 0.35)
```
// encode email addresses
punycode.toASCII('джумла@джpумлатест.bрфa');
// → 'джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq'
```
```
info unicode-mixed-script README.md:85:32

[embedded javascript] identifier `джpумлатест` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
```
// encode email addresses
punycode.toASCII('джумла@джpумлатест.bрфa');
// → 'джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq'
```
```
info unicode-homoglyph README.md:85:54

[embedded javascript] identifier `bрфa` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)
```
// encode email addresses
punycode.toASCII('джумла@джpумлатест.bрфa');
// → 'джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq'
```
```
info unicode-mixed-script README.md:85:54

[embedded javascript] identifier `bрфa` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
// encode email addresses
punycode.toASCII('джумла@джpумлатест.bрфa');
// → 'джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq'
```
```
info unicode-surrogate README.md:99:23

[embedded javascript] surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
// surrogate pair for U+1D306 TETRAGRAM FOR CENTRE:
punycode.ucs2.decode('\uD834\uDF06');
// → [0x1D306]
```
info unicode-surrogate tests/tests.js:143:16

surrogate pair \uD83C\uDF55 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
			'decoded': [127829, 119808, 119558, 119638],
			'encoded': '\uD83C\uDF55\uD835\uDC00\uD834\uDF06\uD834\uDF56'
		},
		{
```
info unicode-surrogate tests/tests.js:143:28

surrogate pair \uD835\uDC00 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
			'decoded': [127829, 119808, 119558, 119638],
			'encoded': '\uD83C\uDF55\uD835\uDC00\uD834\uDF06\uD834\uDF56'
		},
		{
```
info unicode-surrogate tests/tests.js:143:40

surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
			'decoded': [127829, 119808, 119558, 119638],
			'encoded': '\uD83C\uDF55\uD835\uDC00\uD834\uDF06\uD834\uDF56'
		},
		{
```
info unicode-surrogate tests/tests.js:143:52

surrogate pair \uD834\uDF56 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
			'decoded': [127829, 119808, 119558, 119638],
			'encoded': '\uD83C\uDF55\uD835\uDC00\uD834\uDF06\uD834\uDF56'
		},
		{
```
info unicode-surrogate tests/tests.js:148:16

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
			'decoded': [55296, 97, 98],
			'encoded': '\uD800ab'
		},
		{
```
info unicode-surrogate tests/tests.js:153:16

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
			'decoded': [56320, 97, 98],
			'encoded': '\uDC00ab'
		},
		{
```
info unicode-surrogate tests/tests.js:158:16

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
			'decoded': [0xD800, 0xD800],
			'encoded': '\uD800\uD800'
		},
		{
```
info unicode-surrogate tests/tests.js:158:22

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
			'decoded': [0xD800, 0xD800],
			'encoded': '\uD800\uD800'
		},
		{
```
info unicode-surrogate tests/tests.js:163:16

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
			'decoded': [0xD800, 0x1D306, 0xD800],
			'encoded': '\uD800\uD834\uDF06\uD800'
		},
		{
```
info unicode-surrogate tests/tests.js:163:22

surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
			'decoded': [0xD800, 0x1D306, 0xD800],
			'encoded': '\uD800\uD834\uDF06\uD800'
		},
		{
```
info unicode-surrogate tests/tests.js:163:34

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
			'decoded': [0xD800, 0x1D306, 0xD800],
			'encoded': '\uD800\uD834\uDF06\uD800'
		},
		{
```
info unicode-surrogate tests/tests.js:168:16

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
			'decoded': [0xDC00, 0xDC00],
			'encoded': '\uDC00\uDC00'
		},
		{
```
info unicode-surrogate tests/tests.js:168:22

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
			'decoded': [0xDC00, 0xDC00],
			'encoded': '\uDC00\uDC00'
		},
		{
```
info unicode-surrogate tests/tests.js:173:16

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
			'decoded': [0xDC00, 0x1D306, 0xDC00],
			'encoded': '\uDC00\uD834\uDF06\uDC00'
		}
	],
```
info unicode-surrogate tests/tests.js:173:22

surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
			'decoded': [0xDC00, 0x1D306, 0xDC00],
			'encoded': '\uDC00\uD834\uDF06\uDC00'
		}
	],
```
info unicode-surrogate tests/tests.js:173:34

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
			'decoded': [0xDC00, 0x1D306, 0xDC00],
			'encoded': '\uDC00\uD834\uDF06\uDC00'
		}
	],
```
info unicode-surrogate tests/tests.js:203:16

surrogate pair \uD83D\uDCA9 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
			'description': 'Emoji',
			'decoded': '\uD83D\uDCA9.la',
			'encoded': 'xn--ls8h.la'
		},
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/mathiasbynens/punycode.js punycode.js && cd punycode.js
git checkout v2.3.1
disclude scan --severity info --diff v2.3.0 .