npm / resolve / 1.22.13

resolve 1.22.13

Source

https://github.com/browserify/resolve

Tag scanned

v1.22.13

Compared with

v1.22.12 (0 signals introduced since)

Files

94 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 14:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import test/core.js:30:45

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

               // note: this must be require, not require.resolve, due to https://github.com/nodejs/node/issues/43274
               var requireFunc = function () { require(mod); }; // eslint-disable-line no-loop-func
               t.comment(mod + ': ' + resolve.core[mod]);
               if (resolve.core[mod]) {

   likely benign LLM, confidence 0.95 Test helper that dynamically requires each Node core module name to check it resolves.

   Reasoning

   This is a test that loops over Node core module names and requires each one to confirm it loads. The eslint-disable comments and the nodejs issue link show a deliberate, known test pattern. The non-literal specifier is the point of the test and carries no sign of hiding code.

2. info warn → info by review dynamic-import test/core.js:54:31

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

               st.doesNotThrow(
                   function () { require(mod); }, // eslint-disable-line no-loop-func
                   'requiring ' + mod + ' does not throw'
               );

   likely benign LLM, confidence 0.95 Assertion that requiring each core module does not throw.

   Reasoning

   Same pattern as the other core.js findings: a doesNotThrow assertion around require(mod) across the list of core modules. It is a legitimate assertion in a test suite.

3. info warn → info by review dynamic-import test/core.js:79:35

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

                   st.doesNotThrow(
                       function () { require(mod); }, // eslint-disable-line no-loop-func
                       'requiring ' + mod + ' does not throw'
                   );

   likely benign LLM, confidence 0.95 Assertion that requiring each core module does not throw, in a second test block.

   Reasoning

   A second doesNotThrow assertion over core module names, with the same test-harness structure and eslint annotations. Nothing suggests obfuscation or malicious intent.

4. info warn → info by review dynamic-import test/resolver.js:347:18

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       var dir = path.join(__dirname, 'resolver/without_basedir');
       var tester = require(path.join(dir, 'main.js')); // eslint-disable-line global-require
   
       tester(t, function (err, res, pkg) {

   likely benign LLM, confidence 0.94 Test loader that requires a fixture main.js from a fixed directory under __dirname.

   Reasoning

   The require target is path.join of __dirname and a fixed fixture directory with main.js. It is a test fixture loader with an eslint global-require disable, which is ordinary test code and not an attacker-controlled specifier.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/browserify/resolve resolve && cd resolve
git checkout v1.22.13
disclude scan --severity info --diff v1.22.12 .