npm / react-dom / 0.0.0-experimental-9ffcb463-20261021

react-dom 0.0.0-experimental-9ffcb463-20261021

Source

https://github.com/react/react

Artifact scanned

react-dom-0.0.0-experimental-9ffcb463-20261021.tgz (npm tarball · 1.8 MB · SHA-256 19f055eeb637…)

Compared with

react-dom-0.0.0-experimental-9ff738f53-20220826.tgz (15 signals introduced since)

Files

47 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 15 info

Scan time

2.6 s

LLM review

LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 12:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info high-complexity cjs/react-dom-client.development.js:3215:22 new in this release

   compression ratio 0.853 is >2σ above file mean 0.678 (raw pass, confidence 0.50)

                   ? console.error(
                       'Received `%s` for a non-boolean attribute `%s`.\n\nIf you want to write it to the DOM, pass a string instead: %s="%s" or %s={value.toString()}.',
                       value,
                       name,

2. info dynamic-execution cjs/react-dom-client.development.js:26169:44 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

         name =
           CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
         instance.style.viewTransitionName = name;
         null != className && (instance.style.viewTransitionClass = className);

3. info dynamic-execution cjs/react-dom-client.production.js:17250:45 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

   function applyViewTransitionName(instance, name, className) {
     name = CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
     instance.style.viewTransitionName = name;
     null != className && (instance.style.viewTransitionClass = className);

4. info dynamic-execution cjs/react-dom-profiling.development.js:26177:44 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

         name =
           CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
         instance.style.viewTransitionName = name;
         null != className && (instance.style.viewTransitionClass = className);

5. info dynamic-execution cjs/react-dom-profiling.profiling.js:19296:45 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

   function applyViewTransitionName(instance, name, className) {
     name = CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
     instance.style.viewTransitionName = name;
     null != className && (instance.style.viewTransitionClass = className);

6. info dynamic-execution cjs/react-dom-server-legacy.browser.development.js:275:15 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

               ? Buffer.from(arrayBuffer).toString("base64")
               : btoa(
                   String.fromCharCode.apply(String, new Uint8Array(arrayBuffer))
                 );

7. info dynamic-execution cjs/react-dom-server-legacy.browser.production.js:140:11 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

           ? Buffer.from(arrayBuffer).toString("base64")
           : btoa(String.fromCharCode.apply(String, new Uint8Array(arrayBuffer)));
       return (
         "data:" +

8. info dynamic-execution cjs/react-dom-server-legacy.node.development.js:275:15 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

               ? Buffer.from(arrayBuffer).toString("base64")
               : btoa(
                   String.fromCharCode.apply(String, new Uint8Array(arrayBuffer))
                 );

9. info dynamic-execution cjs/react-dom-server-legacy.node.production.js:125:11 new in this release

   `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

           ? Buffer.from(arrayBuffer).toString("base64")
           : btoa(String.fromCharCode.apply(String, new Uint8Array(arrayBuffer)));
       return (
         "data:" +

10. info dynamic-execution cjs/react-dom-server.edge.development.js:347:15 new in this release

    `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

                ? Buffer.from(arrayBuffer).toString("base64")
                : btoa(
                    String.fromCharCode.apply(String, new Uint8Array(arrayBuffer))
                  );

11. info dynamic-execution cjs/react-dom-server.edge.production.js:198:11 new in this release

    `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

            ? Buffer.from(arrayBuffer).toString("base64")
            : btoa(String.fromCharCode.apply(String, new Uint8Array(arrayBuffer)));
        return (
          "data:" +

12. info high-complexity cjs/react-dom-unstable_testing.development.js:3256:22 new in this release

    compression ratio 0.853 is >2σ above file mean 0.678 (raw pass, confidence 0.50)

                    ? console.error(
                        'Received `%s` for a non-boolean attribute `%s`.\n\nIf you want to write it to the DOM, pass a string instead: %s="%s" or %s={value.toString()}.',
                        value,
                        name,

13. info dynamic-execution cjs/react-dom-unstable_testing.development.js:26392:44 new in this release

    `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

          name =
            CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
          instance.style.viewTransitionName = name;
          null != className && (instance.style.viewTransitionClass = className);

14. info dynamic-execution cjs/react-dom-unstable_testing.production.js:17522:45 new in this release

    `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

    function applyViewTransitionName(instance, name, className) {
      name = CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
      instance.style.viewTransitionName = name;
      null != className && (instance.style.viewTransitionClass = className);

15. info dynamic-execution unstable_server-external-runtime.js:81:22 new in this release

    `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

              CSS.escape(element) !== element
                ? "r-" + btoa(element).replace(/=/g, "")
                : element),
            (classAttributeName.viewTransitionName = element),

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o react-dom-0.0.0-experimental-9ffcb463-20261021.tgz https://registry.npmjs.org/react-dom/-/react-dom-0.0.0-experimental-9ffcb463-20261021.tgz
printf '%s  %s\n' 19f055eeb637d8f9890991033f4eb632d3b53c42b416cfef10047ac6f6b19a71 react-dom-0.0.0-experimental-9ffcb463-20261021.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf react-dom-0.0.0-experimental-9ffcb463-20261021.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg