npm / readable-stream / 4.8.0

readable-stream 4.8.0

Source

https://github.com/nodejs/readable-stream

Tag scanned

v4.8.0

Compared with

v4.7.0 (0 signals introduced since)

Files

391 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

4.9 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 11:00

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import src/test/browser/runner-node.mjs:71:9

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

     const __dirname = fileURLToPath(new URL('.', import.meta.url))
     await import(`file://${resolve(__dirname, `../../tmp/${configuration.bundler}/suite.node.js`)}`)
   }

   likely benign LLM, confidence 0.90 Test runner dynamically imports a locally built suite bundle selected by bundler name.

   Reasoning

   Dynamic import of a path built from resolve(__dirname) and a configuration bundler name inside a test runner. The specifier is a local file under the repo's tmp directory, not attacker-controlled remote code. Typical test harness behavior.

2. info warn → info by review dynamic-import test/browser/runner-node.mjs:71:9

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

     const __dirname = fileURLToPath(new URL('.', import.meta.url))
     await import(`file://${resolve(__dirname, `../../tmp/${configuration.bundler}/suite.node.js`)}`)
   }

   likely benign LLM, confidence 0.90 Duplicate test runner doing a local dynamic import of a built test suite.

   Reasoning

   Same code as the src/test copy: a test harness importing its own built suite file from a local tmp path. No network or untrusted input involved.

3. info warn → info by review long-line test/fixtures/elipses.txt:1:1

   line length 10000 characters (raw pass, confidence 0.65)

   …………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………… (339 bytes total)

   likely benign LLM, confidence 0.93 Text fixture containing a long line of ellipsis characters.

   Reasoning

   A plain text fixture of repeated ellipsis characters, consistent with a test for Unicode or long-line handling. Raw pass long-line signal on a fixture file has no malicious indication.

4. info warn → info by review encoding-base64 test/fixtures/tls-session-ticket.txt:2:1

   base64-like blob (1324 bytes over 21 lines, compression ratio 0.75) (raw pass, confidence 0.60)

   -----BEGIN SSL SESSION PARAMETERS-----
   MIID2wIBAQICAwEEAgA1BCAMjLe+70uBSPGvybkTnPVUMwdbdtVbkMIXf8L5M8Kl
   VAQwog+Afs00cnYUcgD1BQewJyxX1e561oRuDTpy7BHABC1hC7hxTaul+pwv+cBx
   8D72oQYCBFFQF3OiBAICASyjggNhMIIDXTCCAkWgAwIBAgIJAMUSOvlaeyQHMA0G

   likely benign LLM, confidence 0.92 Test fixture containing an SSL session parameters base64 block.

   Reasoning

   A PEM-style SSL session parameters blob in a test fixture, used for TLS session ticket testing. High base64 density is expected for certificate and session data, not obfuscation.

5. info long-line test/fixtures/x1024.txt:1:1

   line length 1024 characters (raw pass, confidence 0.50)

   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

6. info warn → info by review narrow-file-charset test/fixtures/x1024.txt:1:1

   file uses only 1 distinct printable characters ("x") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)

   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

   likely benign LLM, confidence 0.93 Text fixture of 1024 repeated 'x' characters.

   Reasoning

   A file of repeated 'x' characters, likely a fixture for size or buffer testing. The narrow-charset signal fires on trivial repeated content with no executable payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/nodejs/readable-stream readable-stream && cd readable-stream
git checkout v4.8.0
disclude scan --severity info --diff v4.7.0 .