punycode 2.3.1

Source: https://github.com/mathiasbynens/punycode.js
Artifact scanned: punycode-2.3.1.tgz (npm tarball · 7.4 KB · SHA-256 e4ce59f9fbac…)
Compared with: punycode-2.3.0.tgz (0 signals introduced since)
Files: 5 scanned, 0 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 9 info
Scan time: 0.1 s
LLM review: LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 17:54

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info unicode-homoglyph README.md:70:22

[embedded javascript] identifier `джpумлатест` contains homoglyph candidates: у (0443)→y, а (0430)→a, е (0435)→e, с (0441)→c (in string/comment) (raw pass, confidence 0.35)
```
punycode.toUnicode('джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq');
// → 'джумла@джpумлатест.bрфa'
```
```
info unicode-mixed-script README.md:70:22

[embedded javascript] identifier `джpумлатест` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
```
punycode.toUnicode('джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq');
// → 'джумла@джpумлатест.bрфa'
```
```
info unicode-homoglyph README.md:70:44

[embedded javascript] identifier `bрфa` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)
```
punycode.toUnicode('джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq');
// → 'джумла@джpумлатест.bрфa'
```
```
info unicode-mixed-script README.md:70:44

[embedded javascript] identifier `bрфa` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
punycode.toUnicode('джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq');
// → 'джумла@джpумлатест.bрфa'
```
```
info unicode-homoglyph README.md:85:32

[embedded javascript] identifier `джpумлатест` contains homoglyph candidates: у (0443)→y, а (0430)→a, е (0435)→e, с (0441)→c (in string/comment) (raw pass, confidence 0.35)
```
// encode email addresses
punycode.toASCII('джумла@джpумлатест.bрфa');
// → 'джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq'
```
```
info unicode-mixed-script README.md:85:32

[embedded javascript] identifier `джpумлатест` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
```
// encode email addresses
punycode.toASCII('джумла@джpумлатест.bрфa');
// → 'джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq'
```
```
info unicode-homoglyph README.md:85:54

[embedded javascript] identifier `bрфa` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)
```
// encode email addresses
punycode.toASCII('джумла@джpумлатест.bрфa');
// → 'джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq'
```
```
info unicode-mixed-script README.md:85:54

[embedded javascript] identifier `bрфa` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)
```
// encode email addresses
punycode.toASCII('джумла@джpумлатест.bрфa');
// → 'джумла@xn--p-8sbkgc5ag7bhce.xn--ba-lmcq'
```
```
info unicode-surrogate README.md:99:23

[embedded javascript] surrogate pair \uD834\uDF06 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
// surrogate pair for U+1D306 TETRAGRAM FOR CENTRE:
punycode.ucs2.decode('\uD834\uDF06');
// → [0x1D306]
```

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o punycode-2.3.1.tgz https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz
printf '%s  %s\n' e4ce59f9fbac44349abab87279ab658f6b4614916bec5e088ae3be9323e193bb punycode-2.3.1.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf punycode-2.3.1.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg