disclude.io

npm / react-dom / 19.3.1

react-dom 19.3.1

Source
https://github.com/react/react
Artifact scanned
react-dom-19.3.1.tgz (npm tarball · 1.3 MB · SHA-256 8b49975821ee…)
Compared with
react-dom-19.3.0.tgz (0 signals introduced since)
Files
42 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 5 info
Scan time
1.9 s
LLM review
LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.
Disclude version
4.3.0
Scanned (UTC)
2026-10-23 20:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info high-complexity cjs/react-dom-client.development.js:3252:22

    compression ratio 0.853 is >2σ above file mean 0.677 (raw pass, confidence 0.50)

                    ? console.error(
                    'Received `%s` for a non-boolean attribute `%s`.\n\nIf you want to write it to the DOM, pass a string instead: %s="%s" or %s={value.toString()}.',
                    value,
                    name,
  2. info dynamic-execution cjs/react-dom-client.development.js:24136:44

    `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

          name =
        CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
      instance.style.viewTransitionName = name;
      null != className && (instance.style.viewTransitionClass = className);
  3. info dynamic-execution cjs/react-dom-client.production.js:15604:45

    `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

    function applyViewTransitionName(instance, name, className) {
  name = CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
  instance.style.viewTransitionName = name;
  null != className && (instance.style.viewTransitionClass = className);
  4. info dynamic-execution cjs/react-dom-profiling.development.js:24144:44

    `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

          name =
        CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
      instance.style.viewTransitionName = name;
      null != className && (instance.style.viewTransitionClass = className);
  5. info dynamic-execution cjs/react-dom-profiling.profiling.js:17497:45

    `btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

    function applyViewTransitionName(instance, name, className) {
  name = CSS.escape(name) !== name ? "r-" + btoa(name).replace(/=/g, "") : name;
  instance.style.viewTransitionName = name;
  null != className && (instance.style.viewTransitionClass = className);

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o react-dom-19.3.1.tgz https://registry.npmjs.org/react-dom/-/react-dom-19.3.1.tgz
printf '%s  %s\n' 8b49975821eec6311e00d2b3f4b8337923253c876517388a33f9839c61ab262e react-dom-19.3.1.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf react-dom-19.3.1.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg