npm / resolve / 1.22.13

resolve 1.22.13

Source

https://github.com/browserify/resolve

Tag scanned

v1.22.13

Compared with

v1.22.12 (0 signals introduced since)

Files

94 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

3.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 19:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import test/core.js:30:45

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

               // note: this must be require, not require.resolve, due to https://github.com/nodejs/node/issues/43274
               var requireFunc = function () { require(mod); }; // eslint-disable-line no-loop-func
               t.comment(mod + ': ' + resolve.core[mod]);
               if (resolve.core[mod]) {

   likely benign LLM, confidence 0.95 Test helper that requires each Node core module name in a loop to verify it loads.

   Reasoning

   This is the test suite for the resolve package, iterating over Node core module names from resolve.core to check that each one can be required. A non-literal require is the intended behavior here, and the loop variable comes from a fixed internal list, not untrusted input. The eslint-disable comments show ordinary lint-suppressed test code.

2. info warn → info by review dynamic-import test/core.js:54:31

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

               st.doesNotThrow(
                   function () { require(mod); }, // eslint-disable-line no-loop-func
                   'requiring ' + mod + ' does not throw'
               );

   likely benign LLM, confidence 0.95 Assertion that requiring each core module does not throw, using a dynamic specifier.

   Reasoning

   Same test pattern: st.doesNotThrow wraps require(mod) over core module names from the library's own list. Dynamic require is the purpose of the test; no attacker-controlled input or obfuscation is present.

3. info warn → info by review dynamic-import test/core.js:79:35

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

                   st.doesNotThrow(
                       function () { require(mod); }, // eslint-disable-line no-loop-func
                       'requiring ' + mod + ' does not throw'
                   );

   likely benign LLM, confidence 0.95 Nested test assertion requiring each core module dynamically to confirm it loads.

   Reasoning

   Duplicate of the same test-suite pattern in a nested block, iterating over the library's own core module list with lint suppression. Benign.

4. info warn → info by review dynamic-import test/resolver.js:347:18

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       var dir = path.join(__dirname, 'resolver/without_basedir');
       var tester = require(path.join(dir, 'main.js')); // eslint-disable-line global-require
   
       tester(t, function (err, res, pkg) {

   likely benign LLM, confidence 0.90 Test loads a fixture module via a path built from __dirname and a fixed subdirectory.

   Reasoning

   The require path is built with path.join from __dirname and a fixed fixture directory, loading main.js from the test fixtures. The specifier is not attacker-controlled and the code is a normal test harness pattern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/browserify/resolve resolve && cd resolve
git checkout v1.22.13
disclude scan --severity info --diff v1.22.12 .