disclude.iorolldown 1.2.15
- Source
- https://github.com/rolldown/rolldown
- Artifact scanned
rolldown-1.2.15.tgz- Compared with
rolldown-1.2.14.tgz(2 signals introduced since)- Files
- 50 scanned, 2 skipped (binary, oversized, or unrecognised)
- Signals
- 1 critical · 0 warn · 23 info
- Scan time
- 16.2 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 15 of 15 warn and critical signals; 14 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-24 00:15
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
args.; return ; } const mergers =likely benign A utility that builds a function from a dynamic body string, bundled alongside merger definitions.Reasoning
The snippet shows a helper that pushes a body string onto an args array and calls new Function(...args), followed by a mergers array. That pattern matches a configuration-merging or schema-compilation utility bundled from a dependency rather than a dropper. Dynamic Function construction with a non-literal body is still risky, and the snippet does not show where body comes from, so the call-site input is unverified.
-
-
likely benign Generated .d.mts re-export list of type names.
Reasoning
A long line in a generated TypeScript declaration file is a re-export list of type names. Long generated export lines are normal for bundler output and show no obfuscation.
-
-
-
likely benign Generated .d.mts export statement listing many public types.
Reasoning
The line is a long export type list in a generated declaration file, consistent with bundler build output. No encoded or hidden content is present.
-
const plugins = await Promise.likely benign Worker loads configured plugin modules via dynamic import of their file URLs.Reasoning
Rolldown's parallel plugin worker dynamically imports user plugin modules by their file URL and then calls their define function. Loading configured plugins this way is the documented purpose of the worker, and the snippet shows no decoding or hidden behaviour.
-
-
-
ENUMERATED_PLUGIN_HOOK_NAMES, ENUMERATED_PLUGIN_HOOK_NAMES, ENUMERATED_PLUGIN_HOOK_NAMES, ENUMERATED_PLUGIN_HOOK_NAMES, ENUMERATED_PLUGIN_HOOK_NAMES, ENUMERATED_PLUGIN_HOOK_NAMES, ENUMERATED_PLUGIN_HOOK_NAMES, ENUMERATED_PLUGIN_HOOK_NAMES, ENUMERATED_PLUGIN_HOOK_NAMES, ENUMERATED_PLUGIN_HOOK_ -
devtools: /* @__PURE__ */ -
return x === 161 || x === 164 || x === 167 || x === 168 || x === 170 || x === 173 || x === 174 || x >= 176 && x <= 180 || x >= 182 && x <= 186 || x >= 188 && x <= 191 || x === 198 || x === 208 || x === 215 || x === 216 || x >= 222 && x <= 225 || x === 230 || x >= 232 && x <= 234 || x === 236 || x === 237 || x === 240likely benign Long character-code range check, likely a Unicode East Asian width lookup.Reasoning
The line is a chain of integer range comparisons over code points, matching East Asian width tables used for terminal string width. This is ordinary generated lookup code.
-
return x >= 4352 && x <= 4447 || x === 8986 || x === 8987 || x === 9001 || x === 9002 || x >= 9193 && x <= 9196 || x === 9200 || x === 9203 || x === 9725 || x === 9726 || x === 9748 || x === 9749 || x >= 9776 && x <= 9783 || x >= 9800 && x <= 9811 || x === 9855 || x >= 9866 && x <= 9871 || x === 9875 || x === 9889 ||likely benign Long code-point range check in a character width function.Reasoning
The line is another code point range table, consistent with a wide-character width function for terminal output. The content is data, not executable payload.
-
return /[#*0-9]\uFE0F?\u20E3|[\xA9\xAE\u203C\u2049\u2122\u2139\u2194-\u2199\u21A9\u21AA\u231A\u231B\u2328\u23CF\u23ED-\u23EF\u23F1\u23F2\u23F8-\u23FA\u24C2\u25AA\u25AB\u25B6\u25C0\u25FB\u25FC\u25FE\u2600-\u2604\u260E\u2611\u2614\u2615\u2618\u2620\u2622\u2623\u2626\u262A\u262E\u262F\u2638-\u263A\u2640\u2642\u2648-\u265likely benign Very long emoji-matching regular expression literal.Reasoning
The snippet is a regex built from emoji and symbol code point escapes, used to measure or strip emoji width. Long regex literals of this kind are common in generated Unicode tables and do not execute anything.
-
const -
likely benign Generated .d.mts re-export list.
Reasoning
This is a generated declaration re-export line of type and value names from the bundler's public API. It is normal build output.
-
likely benign Dynamic import of a module specifier with an appended tracking query.
Reasoning
The module loader imports a specifier concatenated with a tracking query string, which is a cache-busting or module-tracking pattern used in bundler config and plugin loading. The specifier comes from the module graph, not from an untrusted network source, and no decoding or process spawning appears.
-
return ;likely benign Dynamic import in a module loader that records file dependencies.Reasoning
The same loader returns the imported module and collects file dependencies for watch mode. The specifier is resolved module-graph data plus a tracking query, a legitimate reload mechanism. No malicious behaviour is visible.
-
likely benign Imports a transpiled temporary config file and deletes it afterwards.
Reasoning
The config loader imports a temporary file URL, then deletes that file in a finally block. This is the standard way bundlers load a transpiled config file, so the import target is the bundler's own output.
-
} return .; } /**likely benign Re-imports the config file with a cache-busting timestamp query.Reasoning
The loader re-imports a config URL with a timestamp query to bypass the module cache when reloading. This is a common hot-reload pattern for user configuration files.
-
return .; return await ;likely benign Imports a local config file by file URL based on its extension.Reasoning
The line imports the config file by its file URL when its extension is a supported JavaScript format, and otherwise falls back to a TypeScript loader. This is the normal config resolution path and the specifier is a local config path.
-
return 55296 <= s && s <= 56319 && 56320 <= i && i <= 57343 && , D == 12288 || 65281 <= D && D <= 65376 || 65504 <= D && D <= 65510 ? "F" : D == 8361 || 65377 <= D && D <= 65470 || 65474 <= D && D <= 65479 || 65482 <= D && D <= 65487 || 65490 <= D && D <= 65495 || 65likely benign Minified bundled Unicode character-width classification code in a CLI prompt chunk.Reasoning
The line is a minified bundle chunk containing Unicode code-point classification logic (surrogate pair handling and East Asian width ranges). Long lines are ordinary in minified output, and nothing in the visible snippet is decoding, executing or reaching the network. The raw-pass long-line signal has a high false-positive rate.
-
return /\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62\uDB40\uDC7F|likely benign Minified bundled emoji and grapheme-cluster regex table.Reasoning
The line is a large minified regex of emoji and grapheme-cluster sequences (ZWJ sequences, flag tags, skin-tone modifiers). This is a standard Unicode-width or string-segmentation table compiled into a bundle, with no execution or exfiltration behaviour.
-
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&