npm / react / 0.0.0-experimental-ab0d927f-20261020

react 0.0.0-experimental-ab0d927f-20261020

Source

https://github.com/react/react

Commit scanned

ab0d927f53f6 (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

nothing (first release scanned in full)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 16:29

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 A React console.error message for lazy() misuse, with the word 'import' split across a string concatenation.

   Reasoning

   This is React's own lazy() error message, split as 'imp' + 'ort()' with an explicit comment that the split avoids the bundler parsing the text as a real dependency. It is a benign, well-known coding pattern in the React codebase.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   likely benign LLM, confidence 0.97 Example code text in a React error message, split so bundlers do not treat it as an import.

   Reasoning

   The split 'imp' + 'ort' appears inside an error-message example string, with a comment explaining it prevents the bundler from parsing the text as a dependency. This is a documentation string, not executable obfuscation.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 A duplicate React lazy() console.error message with the word 'import' split across concatenation.

   Reasoning

   Same React lazy() error message as the first finding, with the same explanatory split of 'import' for bundler safety. No executable payload is present.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   likely benign LLM, confidence 0.96 Example import text inside a React lazy() warning, split to keep bundlers from parsing it.

   Reasoning

   The concatenation is inside a developer-facing example string in a warning, with an explicit comment about avoiding dependency parsing. It is a legitimate pattern and does not execute anything dynamic.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/react/react react && cd react
git checkout ab0d927f53f6e1b5dcfc2c4e9fc438bdb5ffb678
disclude scan --severity info packages/react