npm / readable-stream / 4.8.0

readable-stream 4.8.0

Source

https://github.com/nodejs/readable-stream

Tag scanned

v4.8.0

Compared with

v4.7.0 (0 signals introduced since)

Files

389 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

4.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 19:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import src/test/browser/runner-node.mjs:71:9

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

     const __dirname = fileURLToPath(new URL('.', import.meta.url))
     await import(`file://${resolve(__dirname, `../../tmp/${configuration.bundler}/suite.node.js`)}`)
   }

   likely benign LLM, confidence 0.80 Test runner dynamically imports a bundled test suite from a local tmp path.

   Reasoning

   A dynamic import built from a template literal with the bundler name and a path under the repo's tmp directory is a normal test-runner pattern for loading a bundled suite; the specifier is built from local configuration, not untrusted input.

2. info warn → info by review dynamic-import test/browser/runner-node.mjs:71:9

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

     const __dirname = fileURLToPath(new URL('.', import.meta.url))
     await import(`file://${resolve(__dirname, `../../tmp/${configuration.bundler}/suite.node.js`)}`)
   }

   likely benign LLM, confidence 0.80 Duplicate test runner that dynamically imports a generated test suite bundle.

   Reasoning

   Same code as the src/test copy; a test harness loading its own generated bundle via a locally derived path is benign.

3. info warn → info by review long-line test/fixtures/elipses.txt:1:1

   line length 10000 characters (raw pass, confidence 0.65)

   …………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………… (339 bytes total)

   likely benign LLM, confidence 0.90 Test fixture consisting of a long line of ellipsis characters.

   Reasoning

   A fixture file of ellipsis characters is a long line of Unicode text used for testing; the raw long-line signal is a false positive for a test fixture.

4. info warn → info by review encoding-base64 test/fixtures/tls-session-ticket.txt:2:1

   base64-like blob (1324 bytes over 21 lines, compression ratio 0.75) (raw pass, confidence 0.60)

   -----BEGIN SSL SESSION PARAMETERS-----
   MIID2wIBAQICAwEEAgA1BCAMjLe+70uBSPGvybkTnPVUMwdbdtVbkMIXf8L5M8Kl
   VAQwog+Afs00cnYUcgD1BQewJyxX1e561oRuDTpy7BHABC1hC7hxTaul+pwv+cBx
   8D72oQYCBFFQF3OiBAICASyjggNhMIIDXTCCAkWgAwIBAgIJAMUSOvlaeyQHMA0G

   likely benign LLM, confidence 0.90 Test fixture containing a PEM-encoded TLS session ticket.

   Reasoning

   The content is a PEM-armored TLS session parameters blob in a test fixture from a Node.js test suite; base64 is the expected encoding, not a payload.

5. info long-line test/fixtures/x1024.txt:1:1

   line length 1024 characters (raw pass, confidence 0.50)

   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

6. info warn → info by review narrow-file-charset test/fixtures/x1024.txt:1:1

   file uses only 1 distinct printable characters ("x") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)

   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

   likely benign LLM, confidence 0.90 Test fixture of repeated 'x' characters used for size testing.

   Reasoning

   A file of 1024 repeated 'x' characters is a plain test fixture for size-based tests; a single-character file has no obfuscation content and the raw pass flags it on charset alone.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodejs/readable-stream readable-stream && cd readable-stream
git checkout v4.8.0
disclude scan --severity info --diff v4.7.0 .