npm / resolve / 1.22.13

resolve 1.22.13

Source

https://github.com/browserify/resolve

Artifact scanned

resolve-1.22.13.tgz (npm tarball · 32.0 KB · SHA-256 06e23bca048b…)

Compared with

resolve-1.22.12.tgz (0 signals introduced since)

Files

93 scanned, 8 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 17:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import test/core.js:30:45

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

               // note: this must be require, not require.resolve, due to https://github.com/nodejs/node/issues/43274
               var requireFunc = function () { require(mod); }; // eslint-disable-line no-loop-func
               t.comment(mod + ': ' + resolve.core[mod]);
               if (resolve.core[mod]) {

   likely benign LLM, confidence 0.93 Test helper that requires each Node core module name in a loop to verify resolution.

   Reasoning

   The require(mod) call sits in a test loop iterating over Node core module names from resolve.core, checking that each core module can be required without throwing. The dynamic specifier is intentional and confined to a test file; this is a standard pattern in the resolve package's tests.

2. info warn → info by review dynamic-import test/core.js:54:31

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

               st.doesNotThrow(
                   function () { require(mod); }, // eslint-disable-line no-loop-func
                   'requiring ' + mod + ' does not throw'
               );

   likely benign LLM, confidence 0.93 Assertion that requiring each core module does not throw, in a test file.

   Reasoning

   Same test pattern: require(mod) inside st.doesNotThrow over the core module list, with eslint-disable comments acknowledging the loop. No attacker-controlled input or network/exec behavior.

3. info warn → info by review dynamic-import test/core.js:79:35

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

                   st.doesNotThrow(
                       function () { require(mod); }, // eslint-disable-line no-loop-func
                       'requiring ' + mod + ' does not throw'
                   );

   likely benign LLM, confidence 0.93 Second test assertion requiring core modules dynamically, in a test file.

   Reasoning

   Repeats the identical doesNotThrow over core module names in the test suite. The specifier comes from a fixed internal list, so the non-literal require is benign.

4. info warn → info by review dynamic-import test/resolver.js:347:18

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       var dir = path.join(__dirname, 'resolver/without_basedir');
       var tester = require(path.join(dir, 'main.js')); // eslint-disable-line global-require
   
       tester(t, function (err, res, pkg) {

   likely benign LLM, confidence 0.92 Test loads a fixture main.js from a __dirname-relative directory.

   Reasoning

   require(path.join(dir, 'main.js')) loads a fixture file from a path relative to __dirname, with a literal filename. It is a test fixture loader with an eslint-disable for global-require, not an obfuscated or malicious load.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o resolve-1.22.13.tgz https://registry.npmjs.org/resolve/-/resolve-1.22.13.tgz
printf '%s  %s\n' 06e23bca048b4502161be79dbc3e4403a3bb7ab6dc8e56555db92cbfc6a0e885 resolve-1.22.13.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf resolve-1.22.13.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg