qs 6.16.1

Source: https://github.com/ljharb/qs
Artifact scanned: qs-6.16.1.tgz (npm tarball · 83.5 KB · SHA-256 bdb0e06e5cde…)
Compared with: qs-6.16.0.tgz (7 signals introduced since)
Files: 18 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 13 info
Scan time: 5.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 20:24

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line dist/qs.js:8:1 new in this release

line length 8769 characters (raw pass, confidence 0.65)
```
"use strict";var getSideChannel=require(46),utils=require(5),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,getPrototypeOf=Object.getPrototypeOf,isPlainContainer=function isPlainContainer(e){if(!e||"object"!=typeof e)return!1;if(isArray(e))return!0;var t=getPrototypeOf(e);return t===Object.prototype||null===
```
likely benign LLM, confidence 0.88 Minified line from the qs npm package's distributed bundle.
Reasoning
Raw-pass long-line signal on a minified dist bundle. The visible snippet is ordinary qs/side-channel module wiring (require calls, prototype helpers, isPlainContainer). Long lines are typical of minified output and the snippet shows no decoding, dynamic execution, or network use.
info ~~warn~~ → info by review long-line dist/qs.js:11:1 new in this release

line length 5955 characters (raw pass, confidence 0.65)
```
"use strict";var getSideChannel=require(46),utils=require(5),formats=require(1),has=Object.prototype.hasOwnProperty,arrayPrefixGenerators={brackets:function brackets(e){return e+"[]"},comma:"comma",indices:function indices(e,r){return e+"["+r+"]"},repeat:function repeat(e){return e}},isArray=Array.isArray,push=Array.pr
```
likely benign LLM, confidence 0.88 Minified qs stringify-related module line in dist bundle.
Reasoning
Raw-pass long-line finding. The snippet shows standard qs internals (arrayPrefixGenerators, formats, Array.prototype.push), consistent with minified library code. Nothing in the visible portion is obfuscated payload logic.
info ~~warn~~ → info by review long-line dist/qs.js:14:1 new in this release

line length 7881 characters (raw pass, confidence 0.65)
```
"use strict";var formats=require(1),getSideChannel=require(46),defineProperty=require(14),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,overflowChannel=getSideChannel(),markOverflow=function markOverflow(e,r){return overflowChannel.set(e,r),e},isOverflow=function isOverflow(e){return overflowChannel.has(e)}
```
likely benign LLM, confidence 0.88 Minified qs overflow-tracking helper line in dist bundle.
Reasoning
Raw-pass long-line finding. The snippet is the qs overflow-channel helper using get-side-channel, a normal dependency pattern. Long length is explained by minification of the bundle.

info unicode-surrogate test/utils.js:590:32 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        st.equal(utils.decode('a++b+', null, 'iso-8859-1'), 'a  b ', 'decodes every + to a space in iso-8859-1');
        st.equal(utils.decode('\uD800x\uDC00'), '\uD800x\uDC00', 'leaves lone surrogates unchanged');
        st.equal(utils.decode('😀+'), '😀 ', 'leaves surrogate pairs unchanged');

info unicode-surrogate test/utils.js:590:39 new in this release

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        st.equal(utils.decode('a++b+', null, 'iso-8859-1'), 'a  b ', 'decodes every + to a space in iso-8859-1');
        st.equal(utils.decode('\uD800x\uDC00'), '\uD800x\uDC00', 'leaves lone surrogates unchanged');
        st.equal(utils.decode('😀+'), '😀 ', 'leaves surrogate pairs unchanged');

info unicode-surrogate test/utils.js:590:50 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        st.equal(utils.decode('a++b+', null, 'iso-8859-1'), 'a  b ', 'decodes every + to a space in iso-8859-1');
        st.equal(utils.decode('\uD800x\uDC00'), '\uD800x\uDC00', 'leaves lone surrogates unchanged');
        st.equal(utils.decode('😀+'), '😀 ', 'leaves surrogate pairs unchanged');

info unicode-surrogate test/utils.js:590:57 new in this release

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        st.equal(utils.decode('a++b+', null, 'iso-8859-1'), 'a  b ', 'decodes every + to a space in iso-8859-1');
        st.equal(utils.decode('\uD800x\uDC00'), '\uD800x\uDC00', 'leaves lone surrogates unchanged');
        st.equal(utils.decode('😀+'), '😀 ', 'leaves surrogate pairs unchanged');

info ~~warn~~ → info by review long-line dist/qs.js:49:1

line length 10097 characters (raw pass, confidence 0.65)
```
"use strict";var undefined,$Object=require(22),$Error=require(16),$EvalError=require(15),$RangeError=require(17),$ReferenceError=require(18),$SyntaxError=require(19),$TypeError=require(20),$URIError=require(21),abs=require(34),floor=require(35),max=require(37),min=require(38),pow=require(39),round=require(40),sign=requ
```
likely benign LLM, confidence 0.87 Minified bundle line importing builtin/error shims from dependencies.
Reasoning
Raw-pass long-line finding. The snippet is a block of require() calls for es-object-atoms and es-errors style builtins, a standard dependency-bundling pattern. The length comes from bundling and minification, not from any encoded payload.
info ~~warn~~ → info by review long-line dist/qs.js:128:1

line length 11175 characters (raw pass, confidence 0.65)
```
var hasMap="function"==typeof Map&&Map.prototype,mapSizeDescriptor=Object.getOwnPropertyDescriptor&&hasMap?Object.getOwnPropertyDescriptor(Map.prototype,"size"):null,mapSize=hasMap&&mapSizeDescriptor&&"function"==typeof mapSizeDescriptor.get?mapSizeDescriptor.get:null,mapForEach=hasMap&&Map.prototype.forEach,hasSet="fu
```
likely benign LLM, confidence 0.87 Minified Map/Set feature-detection code in dist bundle.
Reasoning
Raw-pass long-line finding. The snippet is feature detection for Map and Set (size descriptors, forEach), a common polyfill-style pattern in libraries like side-channel and es-get-iterator. No obfuscation or execution primitives are visible.
info unicode-surrogate test/utils.js:744:22

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
    }
    loneBoundary += '\uD83DX';
    loneExpected += '%F0%9F%91%98';
```

info unicode-mixed-script test/utils.js:767:23

identifier `Āက豈` mixes scripts: Latin + Other + Han (in string/comment) (raw pass, confidence 0.40)

    t.equal(
        utils.encode('Āက豈'),
        '%C4%80%E1%80%80%EF%A4%80',
        'encodes multibyte chars'

info unicode-surrogate test/utils.js:773:23

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

    t.equal(
        utils.encode('\uD83D \uDCA9'),
        '%F0%9F%90%A0%F0%BA%90%80',
        'encodes lone surrogates'

info unicode-surrogate test/utils.js:773:30

orphaned low surrogate \uDCA9 (no preceding high surrogate) (token pass, confidence 0.65)

    t.equal(
        utils.encode('\uD83D \uDCA9'),
        '%F0%9F%90%A0%F0%BA%90%80',
        'encodes lone surrogates'

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o qs-6.16.1.tgz https://registry.npmjs.org/qs/-/qs-6.16.1.tgz
printf '%s  %s\n' bdb0e06e5cde7b4d7e0117faa678416bbc2c9287b0672c35c04da2b9de1d3cbf qs-6.16.1.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf qs-6.16.1.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg