Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', dep.value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', fromMain1AndDynamic.value1, fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = fromMain1AndDynamic.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = fromMain1And2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep1.value1, dep2.value2, something);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = dep1.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', value1, dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('a', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main', value);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
ise.all([new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic1; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic2; }), new Promise(function (resolve, reje
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
ic1; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic2; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic3; })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
ic2; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic3; })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic1; }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic2; }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({DYNAMIC_USED_BY_A}) => console.log(DYNAMIC_USED_BY_A));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
console.log('dynamic2');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
console.log('dynamic3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic5'], resolve, reject); });
console.log('dynamic4');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.shared = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log(result.default));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
return _default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(lib__namespace);
new Promise(function (resolve, reject) { require(['./lib'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
exports.lib = lib__namespace;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-included'], resolve, reject); }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
exports.default = _default.default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra = { with: { type: 'json' } };
import(specifier, extra);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./chain-2.js');
import(somethingElse);
import('external-module');
import('./imports-external.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./imported-via-special-handler.js');
import(someVariable);
import(someResolvedVariable);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(someVariable);
import(someResolvedVariable);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('existing');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('dynamic-direct-external' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-dynamic-indirect-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
Promise.resolve().then(function () { return existing; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('my' + 'replacement');
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
assetString = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt').href : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const assetObject = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt') : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./nested/chunk2'], resolve, reject); }).then(result => console.log(result, chunk$1, chunk, asset$1, asset));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const asset = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.bas
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const chunk = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/nested/chunk.js').href : new URL('nested/chunk.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy = new Promise(function (resolve, reject) { require(['./generated-lazy'], resolve, reject); });
exports.lazy = lazy;
-
line length 3070 characters (raw pass, confidence 0.65)
v272; exports({ v1: v1, v2: v2, v3: v3, v4: v4, v5: v5, v6: v6, v7: v7, v8: v8, v9: v9, v10: v10, v11: v11, v12: v12, v13: v13, v14: v14, v15: v15, v16: v16, v17: v17, v18: v18, v19: v19, v20: v20, v21: v21, v22: v22, v23: v23, v24: v24, v25: v25, v26: v26, v27: v27, v28: v28, v29: v29, v30: v30, v31: v31, v32: v32
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy1 = new Promise(function (resolve, reject) { require(['./generated-foo_20bar'], resolve, reject); });
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
exports.lazy1 = lazy1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-first'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-6Pt_L0T6'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-Bx2VuOb-'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-6Pt_L0T6'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-Bx2VuOb-'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(function (n) { return n.dep; }).then(({ foo, bar, baz }) => console.log(foo, bar, baz));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset3 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.base
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SC
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 0;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 1;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 0;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
function nested1() {
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 1;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return new Promise((resolve, reject) => require([this.outputPath], m => resolve(_interopNamespaceDefault(m)), reject));
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return Promise.resolve().then(() => _interopNamespaceDefault(require(this.outputPath)));
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return Promise.resolve().then(function () { return _interopNamespaceDefault(require(t)); }); })(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`My ${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./seven'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
import('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
logoReverse = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseUR
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.curren
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset1 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset99 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function(c,e){require(['external'],function(m){c(_interopNamespaceCompat(m))},e)}).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((c,e)=>require(['external'],m=>c(_interopNamespaceCompat(m)),e)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceCompat(m)); }, reject); }).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['external'], m => resolve(_interopNamespaceCompat(m)), reject)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra5 = { with: { type: 'json' } };
import(specifier5, extra5);
const extra6 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra6 = { with: { type: 'json' } };
import(specifier6, { with: extra6.with });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('a', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special', extra: 'value' } });
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(join('a', 'b'));
console.log(join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(pathJoin('a', 'b'));
console.log(pathJoin);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external2).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
})(externalauto, externaldefault, externaldefaultOnly, externalesModule);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
eeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m){c(_interopNamespaceDefault(m))},e)});exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Obj
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const dynamic = new Promise(function (resolve, reject) { require(['external3'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.external1 = external1.external1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['https://unpkg.com/foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(({ default: foo }) => assert.equal(foo, 42));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const someDynamicImport = () => new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.someDynamicImport = someDynamicImport;
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
console.log(undefined);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(undefined);
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return code === undefined
? require(importee)
: (exportsMap[outputId] = requireWithContext(
code,
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
export default import('x/' + 'y');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'other') return 17;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
export const path = import('path');
export const pathAgain = import(thePath);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import.source(dynamic).then(console.log)
-
base64-like blob (184 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
module.exports = main;
`
);
-
U+FEFF ZERO WIDTH NO-BREAK SPACE (BOM) in source (raw pass, confidence 0.75)
⟨U+FEFF⟩⟨U+FEFF⟩export const msg = 'foo';
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const configFile = path.join(directory, '_config.js');
const config = require(configFile);
if (!config || !config.description) {
throw new Error(`Found invalid config without description: ${configFile}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
delete require.cache[resolved];
return require(resolved);
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }));
}));
likely benign
LLM, confidence 0.90
Generated AMD entry that loads a dynamic chunk via require.
Reasoning
A literal AMD require of './generated-dynamic' in a chunking test's expected output. This is standard bundler output and the non-literal flag is incorrect.
-
line length 1489 characters (raw pass, confidence 0.50)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
-
line length 2244 characters (raw pass, confidence 0.65)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
dismissed
LLM, confidence 0.97
Long markdown line containing HTML sponsor badge links.
Reasoning
A long line of HTML sponsor badge anchors and images in a markdown README is a normal formatting pattern. The raw long-line signal has no obfuscation or malicious indicator.
-
file mixes tab and space indentation (17 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function generateBanner(commitHash: string, version: string): string {
const date = new Date(
env.SOURCE_DATE_EPOCH ? 1000 * +env.SOURCE_DATE_EPOCH : Date.now()
).toUTCString();
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
plugin = new Function('return ' + pluginText);
} else {
const match = pluginText.match(/^([\w./:@\\^{|}-]+)(=(.*))?$/);
likely benign
LLM, confidence 0.80
CLI parser evaluates an inline plugin object passed via -p.
Reasoning
The Function constructor evaluates the value of the user's own --plugin CLI argument, which is an explicit feature of a bundler CLI. It is not hidden, fetched remotely, or triggered without user input, so it is a legitimate though risky pattern.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
pluginText = match[1];
pluginArgument = new Function('return ' + match[3])();
} else {
throw new Error(`Invalid --plugin argument format: ${JSON.stringify(pluginText)}`);
likely benign
LLM, confidence 0.80
CLI parser evaluates the plugin argument expression from the --plugin option.
Reasoning
This evaluates the argument portion of a user-supplied --plugin=... option. It is the same user-controlled CLI feature, with no network source or concealment.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return require(pluginPath);
} catch {
return import(pluginPath);
likely benign
LLM, confidence 0.85
Loads a user-specified plugin module via require with an import fallback.
Reasoning
The require/import fallback loads a plugin module at a path the user named on the command line. This is the standard plugin-loading mechanism for a bundler.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
} catch {
return import(pluginPath);
}
}
likely benign
LLM, confidence 0.85
ESM fallback that dynamically imports a user-specified plugin path.
Reasoning
The dynamic import is the ESM fallback for the same user-specified plugin path. No remote or encoded source is involved.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
}
return (await import(fileUrl.href)).default;
} catch (error_: any) {
if (cannotLoadEsm) {
likely benign
LLM, confidence 0.88
Dynamically imports the user's rollup config file as an ES module.
Reasoning
This imports the project's own config file by file URL, which is expected behavior for a bundler loading rollup.config files. The AST rule is flagging a generic dynamic import.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
try {
return (await import(pathToFileURL(bundledFileName).href)).default;
} finally {
unlink(bundledFileName).catch(error => console.warn(error?.message || error));
likely benign
LLM, confidence 0.88
Imports the bundled temporary config file and removes it afterward.
Reasoning
This imports a config file that was just bundled to a temporary file and cleans it up afterward. This is the normal config-loading pipeline.
-
line length 1014 characters (raw pass, confidence 0.50)
ES modules export _live bindings_, not values, so values can be changed after they are initially imported as per [this demo](../repl/index.md?shareable=JTdCJTIyZXhhbXBsZSUyMiUzQW51bGwlMkMlMjJtb2R1bGVzJTIyJTNBJTVCJTdCJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMCU3QiUyMGNvdW50JTJDJTIwaW5jcmVtZW50JTIwJTdEJTIwZnJvbSUyMCcuJTJGaW5jcmVt
-
line length 881 characters (raw pass, confidence 0.50)
By default, when creating multiple chunks, imports of dependencies of entry chunks will be added as empty imports to the entry chunks themselves. [Example](../repl/index.md?shareable=JTdCJTIybW9kdWxlcyUyMiUzQSU1QiU3QiUyMm5hbWUlMjIlM0ElMjJtYWluLmpzJTIyJTJDJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMHZhbHVlJTIwZnJvbSUyMCcuJTJGb3RoZ
-
line length 922 characters (raw pass, confidence 0.50)
Even though Rollup will usually try to maintain exact module execution order when bundling, there are two situations when this is not always the case: code-splitting and external dependencies. The problem is most obvious with external dependencies, see the following [example](../repl/index.md?shareable=JTdCJTIybW9kdWxl
-
line length 1258 characters (raw pass, confidence 0.50)
with the execution order `external` → `polyfill.js` → `main.js`. This is not a problem caused by Rollup putting the `import` at the top of the bundle—imports are always executed first, no matter where they are located in the file. This problem can be solved by creating more chunks: If `polyfill.js` ends up in a d
-
`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
if (query.shareable) {
const rawJson = atob(query.shareable.replace(/_/g, '/').replace(/-/g, '+'));
const json = rawJson[0] === '%' ? decodeURIComponent(rawJson) : rawJson;
const {
likely benign
LLM, confidence 0.75
Decodes a base64 shareable REPL state from the URL into JSON.
Reasoning
The code base64-decodes a shareable URL parameter for the docs REPL and then, based on the snippet, parses it as JSON or percent-decoded text. The atob call alone is a common decoding pattern. No eval or fetch is shown, and the decoded value is treated as data.
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
parameters.shareable = btoa(json).replace(/\//g, '_').replace(/\+/g, '-');
const queryString = Object.keys(parameters)
.map(key => `${key}=${parameters[key]}`)
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
try {
return require(id);
} catch (error) {
if (
likely benign
LLM, confidence 0.70
Generic require of a module identifier with error fallback, likely for native binding loading.
Reasoning
This is a generic require(id) inside a try block that falls back on error. It is typical of native-binding or optional-module loading. The snippet does not show an untrusted source for the identifier.
-
file mixes tab and space indentation (709 tab-indented and 17 space-indented lines) (raw pass, confidence 0.40)
export const AST_NODES = {
PanicError: {
estreeType: "{ type: 'PanicError', message: string }",
fields: [['message', 'String']],
-
command name is a variable (`$LLVM_PROFDATA`) and `LLVM_PROFDATA` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_PROFDATA="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-profdata"
"$LLVM_PROFDATA" merge -sparse coverage/profraw/*.profraw -o coverage/rust.profdata
NODE_FILE="$(ls dist/rollup.*.node)"
likely benign
LLM, confidence 0.90
Coverage script runs llvm-profdata from the Rust toolchain sysroot.
Reasoning
The command path is built from rustc's sysroot and the rustlib host triple, then used to run llvm-profdata during coverage builds. This is a build-tooling pattern with no remote input or concealment.
-
command name is a variable (`$LLVM_COV`) and `LLVM_COV` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_COV="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-cov"
"$LLVM_COV" export \
-instr-profile=coverage/rust.profdata \
-object "$NODE_FILE" \
likely benign
LLM, confidence 0.90
Coverage script runs llvm-cov from the Rust toolchain sysroot.
Reasoning
The command path is derived from the Rust toolchain sysroot and is used to run llvm-cov for coverage reporting. This is standard developer build tooling.
-
file mixes tab and space indentation (86 tab-indented and 39 space-indented lines) (raw pass, confidence 0.40)
const astMacrosFile = new URL(
'../rust/parse_ast/src/convert_ast/converter/ast_macros.rs',
import.meta.url
);
-
file mixes tab and space indentation (150 tab-indented and 38 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node, originalNode }) => {
const definitions = [];
let offset = 0;
-
file mixes tab and space indentation (139 tab-indented and 36 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node, originalNode }) => {
const definitions = [];
let offset = 2;
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
for (const [name, node] of Object.entries(AST_NODES)) {
const astType = node.astType || name;
const keySet = (childNodeKeysByAstType[astType] ||= new Set());
for (const [fieldName, fieldType] of (node.hasSameFieldsAs
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1');
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
likely benign
LLM, confidence 0.96
Generated AMD-format test fixture requiring a dynamic chunk.
Reasoning
This is an expected-output fixture for a chunking test. AMD require with a generated chunk path is standard output from Rollup's AMD format.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
}));
likely benign
LLM, confidence 0.96
Generated AMD-format test fixture requiring another chunk.
Reasoning
This is the same generated AMD test fixture, requiring another chunk. It is expected bundler output in a test directory.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(libs.value2);
console.log(new Promise(function (resolve, reject) { require(['./generated-lib1'], resolve, reject); }).then(function (n) { return n.lib3; }).then(m => m.value3));
}));
likely benign
LLM, confidence 0.96
Generated AMD-format test fixture for dynamic import output.
Reasoning
This is a generated expected-output fixture for an AMD chunking test. The require call is the normal output for dynamic imports in AMD format.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
dismissed
LLM, confidence 0.92
Bundler-generated AMD loader call for a split chunk.
Reasoning
Same generated AMD dynamic-import pattern from Rollup's test fixtures. The specifier is a fixed relative chunk path, not attacker-controlled input.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./chunks/generated-a'], resolve, reject); });
}
dismissed
LLM, confidence 0.92
Bundler-generated AMD loader for a chunk under a base path.
Reasoning
Standard Rollup AMD output for a dynamic import with a base path. The require uses a literal chunk path inside a Promise, which is the expected bundler pattern.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
dismissed
LLM, confidence 0.92
Bundler-generated AMD loader call that fetches a split chunk.
Reasoning
This is Rollup's generated AMD output for a dynamic import of a chunk. The require call is the standard AMD async loader that bundlers emit, and the specifier is a fixed chunk path. No obfuscation or malicious behavior is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/logo2.svg').href : new URL('logo2.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
{
likely benign
LLM, confidence 0.90
Conditional require of the Node url module with a concatenated name, with a browser fallback.
Reasoning
This is Rollup's CJS output for an asset URL. The require('u' + 'rl') is a string concatenation used to load the Node url module in a browser-safe way, which is a common bundler idiom. It is not a dropper or hidden execution, and the code falls back to a normal URL in browsers.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
dismissed
LLM, confidence 0.92
Bundler-generated AMD loader for a dynamically imported chunk.
Reasoning
Generated AMD dynamic-import wrapper with literal chunk paths inside arrow functions. This is ordinary bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
console.log(importA, importB);
dismissed
LLM, confidence 0.92
Bundler-generated AMD loader for a second dynamically imported chunk.
Reasoning
Same generated AMD dynamic-import pattern with a literal chunk path. Nothing suspicious in context.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
dismissed
LLM, confidence 0.92
Generated AMD loader for a chunk in a deprecated emitFile test.
Reasoning
Rollup AMD test fixture output loading a chunk with a fixed path and chaining console.log. Benign bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dep1');
new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); });
}));
dismissed
LLM, confidence 0.92
Generated AMD loader chaining to the next chunk.
Reasoning
Chained dynamic imports between generated chunks, each using a literal relative path. Standard bundler output with no obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); });
}));
dismissed
LLM, confidence 0.92
Generated AMD entry loader for a dependency chunk.
Reasoning
Entry chunk loading a dependency chunk via a literal path in the standard AMD form. No malicious indicators.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function dynamic (num) {
return new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); })
.then(dep2 => {
return dep2.mult(num);
dismissed
LLM, confidence 0.92
Generated AMD loader within a dynamic helper function.
Reasoning
Generated AMD dynamic-import helper that loads a chunk with a fixed path and then calls a method on the result. Ordinary bundler output.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import (
'./foo.js');
likely benign
LLM, confidence 0.85
Source test fixture of a dynamic import with inline comments around a literal path.
Reasoning
Rollup test input exercising dynamic import with comments inside the parentheses. The specifier is the string literal './foo.js' with comments around it, so the flag is a parser-level false positive. Nothing executes or obfuscates a payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(dep);
}));
likely benign
LLM, confidence 0.88
Generated AMD loader for a runtime-computed dynamic import specifier.
Reasoning
Generated AMD loader for a dynamic import whose specifier is a variable t, as expected when the original source used a dynamic specifier. The module namespace is wrapped with a PURE interop helper. This is normal bundler output, and the variable is supplied by the bundled code rather than external input.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
dismissed
LLM, confidence 0.93
Bundler test expected output containing a bare dynamic import(dep) call.
Reasoning
This is a bundler test fixture showing a plain dynamic import with a variable specifier. The code is the expected output of a chunking test, not an obfuscated or malicious payload. The pattern is a normal language feature.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
dismissed
LLM, confidence 0.93
Bundler test expected output with a dynamic import(dep) in ES format.
Reasoning
Same bundler test fixture in ES module form, with a standard dynamic import using a variable. Nothing suggests obfuscation or intent to hide behaviour.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
dismissed
LLM, confidence 0.93
Test source file using a dynamic import(dep) with a non-literal specifier.
Reasoning
Source input for a chunking test that exercises dynamic imports with non-literal specifiers. This is an ordinary test case for the bundler.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
dismissed
LLM, confidence 0.93
Generated AMD require() wrapper for a dynamic import in a bundler test fixture.
Reasoning
This is the AMD-transpiled output of a dynamic import, produced by a bundler. The require call with a relative module path is the standard way the bundler emits lazy loading. It is a legitimate code-splitting pattern.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic$1; }).then(({dynamic}) => console.log('main1', dynamic));
}));
dismissed
LLM, confidence 0.93
Generated AMD require() for a dynamic import in a facade chunking test.
Reasoning
Bundler-generated AMD output for a dynamic import with a fixed relative path. The pattern is a routine transpilation artifact of code splitting, with no sign of concealment.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(dep2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.dep2 = dep2;
dismissed
LLM, confidence 0.93
Generated AMD require() loading a chunk in a manual-chunk test fixture.
Reasoning
AMD-format bundler output from a manual-chunk test. The require call loads a sibling generated chunk, which is expected behaviour for split bundles.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const inlined = Promise.resolve().then(function () { return inlined$2; });
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.inlined = inlined;
dismissed
LLM, confidence 0.93
Generated AMD require() for a separate chunk in an inline-colouring test.
Reasoning
Bundler test output for inline chunk colouring. The require call loads a separate generated chunk, which is a normal code-splitting artifact.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.separate = separate;
dismissed
LLM, confidence 0.93
Generated AMD require() loading a separate chunk in a test fixture.
Reasoning
Expected output of a bundler chunking test. The require call with a relative chunk path is ordinary AMD lazy-loading output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
async function test() {
const dep = await new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); });
console.log(dep.obj.a.a.a);
}
dismissed
LLM, confidence 0.93
Generated AMD require() inside an async function in a tree-shaking test.
Reasoning
Bundler test output for tree-shaking with await on a dynamic import. The require wraps the Promise for an async import, which is standard transpiled output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(({ obj }) => {
console.log(obj.a);
});
dismissed
LLM, confidence 0.93
Generated AMD require() with a then-chain in a tree-shaking test fixture.
Reasoning
Bundler test output for tree-shaking with a then-chain on a dynamic import. The AMD require is a routine transpilation of the import and carries no malicious signal.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
dismissed
LLM, confidence 0.93
Generated AMD require() for a generated chunk in a default-export test.
Reasoning
Expected bundler output for a default-only dynamic import test. The require loads a generated chunk and is standard AMD code-splitting output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
dismissed
LLM, confidence 0.93
Second generated AMD require() in the same default-export test fixture.
Reasoning
A second require call in the same bundler test output, loading another generated chunk. It is ordinary code-splitting output with no sign of obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({ value }) => console.log(value));
}));
dismissed
LLM, confidence 0.93
Generated AMD require() for a re-export chunk in a test fixture.
Reasoning
Bundler test output for a re-export case. The AMD require loads a generated chunk, a normal pattern for split bundles.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(({ bar }) => console.log(bar()));
}));
dismissed
LLM, confidence 0.93
Generated AMD require() for a dependency chunk in a statically-imported test.
Reasoning
Bundler test output for a module that is both statically and dynamically imported. The AMD require is standard lazy-loading output and shows no malicious intent.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./lib'], resolve, reject); }).then(function (n) { return n.lib; }).then(console.log);
}));
dismissed
LLM, confidence 0.93
Generated AMD loader call for a dynamic import of a local module, flagged as a non-literal require.
Reasoning
This is Rollup's expected AMD output for a dynamic import in a test fixture. The specifier is a literal array (['./lib']), so the non-literal flag is a false positive from matching the array form of AMD require. The surrounding code is ordinary promise plumbing.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module1'], resolve, reject); });
module.foo();
dismissed
LLM, confidence 0.93
Generated AMD require of a local module inside an async IIFE in a namespace-import test.
Reasoning
Rollup test fixture output. The require uses a literal array specifier ['./generated-module1'] and the code only calls foo() on the imported namespace. No obfuscation or malicious behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module2'], resolve, reject); });
const module1 = module;
module1.foo();
dismissed
LLM, confidence 0.93
Generated AMD require of a local test module with simple namespace member access.
Reasoning
Same Rollup fixture pattern. The specifier is a literal array and the body only renames a variable and calls a method on the module object.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module3'], resolve, reject); });
const { foo } = module;
foo();
dismissed
LLM, confidence 0.93
Generated AMD require of a local test module followed by destructuring of a named export.
Reasoning
Rollup expected-output fixture. The literal-array require is a standard AMD dynamic import, and the destructuring of foo is a normal test case.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module4'], resolve, reject); });
const { foo, ...rest } = module;
dismissed
LLM, confidence 0.93
Generated AMD require followed by object rest destructuring in a test fixture.
Reasoning
Rollup test fixture with a literal-array AMD require. The rest-destructuring of the namespace object is a standard language feature exercised by the test.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module5'], resolve, reject); });
readFoo({ foo: () => {} });
readFoo(module);
dismissed
LLM, confidence 0.93
Generated AMD require of a local module passed to a helper function in a test.
Reasoning
Rollup fixture. The require has a literal array specifier, and the readFoo calls pass an object literal and the module namespace. Nothing suspicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module6'], resolve, reject); });
function b({ foo }) {
foo();
dismissed
LLM, confidence 0.93
Generated AMD require followed by a nested function that destructures the module namespace.
Reasoning
Rollup test output. The literal-array AMD require is benign and the nested function with destructuring is ordinary code under test.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module7'], resolve, reject); });
function b({ foo, ...rest }) {
dismissed
LLM, confidence 0.93
Generated AMD require followed by a nested function using object rest destructuring.
Reasoning
Rollup fixture with a literal-array require. The rest-destructuring in the nested function is a standard syntax test case.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module8'], resolve, reject); });
function b(o1, ...rest) {
dismissed
LLM, confidence 0.93
Generated AMD require followed by a function with rest parameters in a namespace test.
Reasoning
Rollup test output. The require uses a literal array and the rest-parameter function is an ordinary language feature being tested.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module9'], resolve, reject); });
function b({ foo = 1 }) {
dismissed
LLM, confidence 0.93
Generated AMD require followed by a function with a destructuring default parameter.
Reasoning
Rollup fixture. The literal-array AMD require is benign and the default-valued destructuring parameter is an ordinary syntax case.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module10'], resolve, reject); });
(module).bar();
(global.unknown && module).foo();
dismissed
LLM, confidence 0.93
Generated AMD require followed by member-access and logical-expression edge cases in a test.
Reasoning
Rollup test fixture. The require has a literal specifier, and the code uses a parenthesized member call and a logical expression on a global, which are typical syntax-edge-case tests rather than obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./other'], resolve, reject); }).then(result =>
assert.deepEqual(result, { value: 'shared', extra: 'extra' })
);
dismissed
LLM, confidence 0.92
Bundler-generated AMD loader for a shared dynamic-import chunk.
Reasoning
Generated AMD dynamic import of a sibling module with a literal path, followed by an assertion. Typical bundler output from a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
exports.promise = promise;
dismissed
LLM, confidence 0.93
Generated AMD require of a dynamic chunk in a facaded-entry test fixture.
Reasoning
Rollup expected output for a facaded entry. The literal-array AMD require of './generated-dynamic' is a normal dynamic import, and the code only creates a promise and exports it.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(result => console.log('importer', result));
}));
dismissed
LLM, confidence 0.93
Generated AMD require of the main module from an importer, flagged as a non-literal require.
Reasoning
Rollup fixture for a dynamic import from an importer module. The literal-array require of './main' is standard AMD output with no suspicious behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.92
Rollup-generated AMD wrapper that loads a dynamically imported module.
Reasoning
This is Rollup's generated AMD output for a dynamic import in a test fixture. The require array with a literal './main' is the standard AMD dynamic-import shape, not an attempt to hide a dynamic call.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
likely benign
LLM, confidence 0.92
Rollup AMD output for a dynamic import of a generated chunk.
Reasoning
Expected-output fixture from Rollup's chunking tests. The AMD require of './generated-dynamic' is the bundler's normal dynamic import translation and has no payload or encoding.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.92
Rollup-generated AMD dynamic import of './main' in a test fixture.
Reasoning
Same Rollup AMD dynamic-import pattern as the other fixtures, with a literal module path and resolve/reject callbacks. Nothing suspicious in the snippet.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
likely benign
LLM, confidence 0.92
Rollup AMD output dynamically loading a generated chunk.
Reasoning
Rollup test expected output. The AMD require of a generated chunk is the standard translation of import() for the AMD format.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.92
Rollup-generated AMD dynamic import with namespace interop.
Reasoning
Standard Rollup AMD dynamic-import output with interop helper usage. The literal path and helper call are normal bundler code in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('no importer', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.88
Rollup CJS output that resolves a generated file URL, using a split require('url') to avoid static resolution.
Reasoning
The require('u' + 'rl') split is an unusual construction, but it is Rollup's known output for import.meta.ROLLUP_FILE_URL handling in CJS, which keeps bundlers from statically resolving 'url'. It only computes a file URL for a bundled sibling file and does not execute a payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from maim', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.88
Rollup CJS file-URL helper for a generated chunk, with a browser fallback.
Reasoning
Same generated file-URL helper as the other finding in this file. It builds a file URL for generated-lib.js with a browser fallback, which is expected bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from nested', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib2.js').href : new URL('generated-lib2.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.88
Rollup CJS file-URL helper for a nested generated chunk.
Reasoning
Same pattern as the other findings in this file: a split require('url') for pathToFileURL plus a browser URL fallback for a generated sibling file. No network or exec behavior.
-
file mixes tab and space indentation (41 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'allows adding additional chunks to be used in workers',
options: {
input: 'main',
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./chunks/nested'], resolve, reject); })
.then(result => result.getWorkerMessage())
.then(message => (document.body.innerHTML += `<h1>2: ${message.data}</h1>`));
likely benign
LLM, confidence 0.92
Rollup AMD dynamic import of a nested chunk in a worker test.
Reasoning
Rollup AMD output for a dynamic import of a nested chunk, with a literal path and a benign message-handling chain. Standard test fixture code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker-proxy.js').href : new URL('worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.88
Rollup CJS helper that resolves a worker script URL for a Web Worker.
Reasoning
Rollup CJS output that builds a file URL for worker-proxy.js for a Worker constructor, using the same split require('url') helper. It is test-fixture bundler output, not a dropper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
PLACEHOLDER((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker.js').href : new URL('worker.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.95
Rollup-generated CJS shim resolving a worker script URL via require('url').pathToFileURL.
Reasoning
This is Rollup's standard CJS output for import.meta.url or new URL(..., import.meta.url) in a worker. The require('u'+'rl') indirection is a bundler-generated shim for browser/Node compatibility, and the file is a test fixture expected-output file. The concatenated 'url' name is a benign Rollup artifact, not evasion.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.95
Rollup-generated URL resolution for a Worker script in a CJS test fixture.
Reasoning
Same Rollup import.meta.url polyfill pattern used to construct a Worker URL in a test expected-output file. The require is guarded by a typeof document check and resolves a local path under __dirname; nothing is fetched or executed from a remote source.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const getWorkerMessage = () => new Promise(resolve => {
const worker = new Worker(new URL('chunks/worker-proxy.js', import.meta.url).href);
worker.onmessage = resolve;
});
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
CSS.paintWorklet.addModule((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worklet.js').href : new URL('chunks/worklet.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.95
Rollup-generated URL resolution passed to CSS.paintWorklet.addModule in a test fixture.
Reasoning
Rollup's standard import.meta.url shim for CSS paint worklet module loading in a test fixture. The require resolves a local file relative to __dirname and is not attacker-controlled.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./ext\'ernal'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('main', dep.value);
likely benign
LLM, confidence 0.92
Rollup AMD dynamic import for an emitted chunk in a test fixture.
Reasoning
Expected output from Rollup's emit-file chunk test. The require call is the AMD translation of a dynamic import of an external-named chunk; the quote in the path is an escaped test-fixture name.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./entry-deb-amd'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.95
AMD dynamic require of a local entry module in a Rollup test fixture.
Reasoning
Standard AMD dynamic import emitted by Rollup for a local module, within a test fixture. The dependency path is a relative module name, not a remote or encoded payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.95
AMD-style dynamic loading of a local chunk module in a Rollup test fixture.
Reasoning
This is an AMD dynamic import wrapper (require with an array of dependency names and resolve/reject callbacks) emitted by Rollup in a test expected-output directory. It is a standard AMD loader pattern for loading a local chunk.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
showImage(logo);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.showImage = showImage;
likely benign
LLM, confidence 0.95
AMD dynamic require of a nested chunk in a Rollup test fixture.
Reasoning
Standard AMD dynamic require of a relative nested chunk, as emitted by Rollup for code splitting. Benign test expected output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo1-FquQRdV3.svg').href : new URL('assets/logo1-FquQRdV3.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.95
Rollup-generated URL resolution for an emitted SVG asset in a CJS test fixture.
Reasoning
Rollup's import.meta.url polyfill for resolving an emitted SVG asset URL in a CJS test fixture. The require of 'url' is a generated shim and the path is a local asset.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/../assets/logo2-DJfvToLT.svg').href : new URL('../assets/logo2-DJfvToLT.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.95
Rollup-generated URL resolution for an emitted asset from a nested CJS chunk.
Reasoning
Same Rollup import.meta.url shim, resolving a relative asset path from a nested chunk. Benign generated test output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
renderStart = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/renderStart-B4XObdBk.txt').href : new URL('assets/renderStart-B4XObdBk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).hre
likely benign
LLM, confidence 0.95
Rollup-generated URL resolution for an emitted text asset in a test fixture.
Reasoning
Rollup's standard asset URL shim for a text asset in a CJS test fixture. The require resolves a local file relative to __dirname.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderStartNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderStart.txt').href : new URL('renderStart.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.95
Rollup-generated URL resolution for a named text asset in a test fixture.
Reasoning
Same Rollup import.meta.url shim for a named text asset in a CJS test fixture. Benign generated output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const bannerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/banner.txt').href : new URL('banner.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.95
Rollup-generated URL resolution for a banner text asset in a test fixture.
Reasoning
Rollup's import.meta.url shim for a banner text asset in a CJS test fixture. Benign generated output with a local path.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const footerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/footer.txt').href : new URL('footer.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated CJS helper that lazily requires Node's url module to build a file URL for an emitted asset, with a browser fallback.
Reasoning
The split string 'u' + 'rl' is a known Rollup output pattern that keeps bundlers from resolving the Node 'url' module in browser builds. It is a generated test expectation and the require is guarded by a typeof document check. No shell, exec, or network exfiltration is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const introNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/intro.txt').href : new URL('intro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated CJS code that builds a file URL for intro.txt, using a split require for url with a browser fallback.
Reasoning
Same generated pattern as the other findings in this file: a split 'u'+'rl' require used for a Node/browser dual path in a Rollup test expectation. Nothing malicious is visible.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const outroNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/outro.txt').href : new URL('outro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated CJS code that builds a file URL for outro.txt with a split url require and browser fallback.
Reasoning
Same generated Rollup pattern with a split require('u'+'rl') guarded by a typeof document check. The concatenation serves bundler-compatibility, and the code only builds URLs.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderChunkNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderChunk.txt').href : new URL('renderChunk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated CJS code that builds a file URL for renderChunk.txt with a split url require and browser fallback.
Reasoning
Same generated Rollup pattern: split url require plus browser fallback, used only to compute a file URL for a text asset.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const generateBundleNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generateBundle.txt').href : new URL('generateBundle.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated CJS code that builds a file URL for generateBundle.txt with a split url require and browser fallback.
Reasoning
Same generated Rollup pattern: split url require plus browser fallback, used only to compute a file URL for a text asset.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.92
Generated AMD module that dynamically loads a sibling chunk via a Promise-wrapped AMD require.
Reasoning
This is AMD-style dynamic loading, require([...], resolve, reject), inside a Promise, which is standard for a generated split chunk. The specifier is a fixed relative path, and it is a test expectation file.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(console.log);
}));
likely benign
LLM, confidence 0.92
Generated AMD module that dynamically loads generated-dep1 and resolves its dep1 export.
Reasoning
Standard AMD dynamic import of a fixed relative chunk within a Promise, as produced by Rollup's AMD output. No malicious behavior is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['./generated-dep1'], resolve, reject)).then(n => n.dep1).then(console.log);
}));
likely benign
LLM, confidence 0.92
Generated AMD module that dynamically loads generated-dep1 via an arrow-function Promise wrapper.
Reasoning
Same AMD dynamic-loading pattern using an arrow function, with a fixed relative specifier. It is a benign generated test expectation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
likely benign
LLM, confidence 0.92
Generated AMD dependency module that dynamically requires a generatedDynamicDep chunk.
Reasoning
AMD dynamic require of a fixed relative chunk, generated for an implicit dependency test. It is a benign build artifact.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
exports.value = value;
likely benign
LLM, confidence 0.92
Generated AMD dependency module that dynamically requires a generatedDynamicDep chunk.
Reasoning
Same AMD dynamic-loading pattern with a fixed relative path in a generated test expectation. Nothing suspicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
likely benign
LLM, confidence 0.92
Generated AMD dependency module that dynamically requires a generatedDynamicDep chunk.
Reasoning
Same AMD dynamic-loading pattern with a fixed relative path in a generated test expectation. Nothing suspicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-lib'], resolve, reject); }).then(function (n) { return n.lib; });
}));
likely benign
LLM, confidence 0.92
Generated AMD entry that dynamically loads generated-lib and returns its lib export.
Reasoning
AMD dynamic require of a fixed relative chunk wrapped in a Promise, as Rollup emits for code-split entries. It is benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const url = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('0/1/nested.js', document.baseURI).href));
exports.url = url;
likely benign
LLM, confidence 0.93
Rollup-generated CJS polyfill that resolves import.meta.url via require('url') in a test fixture.
Reasoning
This is Rollup's generated CJS output for import.meta.url, a fixed polyfill. The require('u'+'rl') argument is a constant string, and the call only runs when document is undefined, to build a file URL. It sits in a test fixture directory, so it is a known build artifact rather than a dropper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
log('main: ' + new URL(module.uri, document.baseURI).href);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.log = log;
likely benign
LLM, confidence 0.95
AMD dynamic import of a local chunk module inside a Rollup test expected-output file.
Reasoning
This is an AMD-style require with a literal array of module ids, used for a dynamic chunk load. The scanner flagged it as non-literal, which is a false positive. Nothing in the snippet is malicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log('main: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('main.js', document.baseURI).href)));
likely benign
LLM, confidence 0.93
Rollup-generated CJS import.meta.url polyfill using require('url') in a test fixture.
Reasoning
Same Rollup import.meta.url polyfill as the other CJS outputs. The require('u'+'rl') string is constant and the branch is guarded by a typeof document check. It is a fixture expected output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
main.log('nested: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('nested/chunk.js', document.baseURI).href)));
likely benign
LLM, confidence 0.93
Rollup-generated CJS chunk using the import.meta.url polyfill with require('url').
Reasoning
The nested chunk carries the same generated polyfill, with a constant module name and a fixed URL fallback. It is consistent with Rollup output in a test directory.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.shared = shared;
likely benign
LLM, confidence 0.95
AMD dynamic chunk load of a sibling module in a Rollup test fixture.
Reasoning
A literal AMD require of a sibling chunk module, used to load a dynamic dependency. The flag on a non-literal specifier is a false positive for this pattern.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
likely benign
LLM, confidence 0.95
AMD dynamic require of generated-dynamic2 in a circular-import test fixture.
Reasoning
A literal AMD require of another generated chunk, used to test circular dynamic imports. It is ordinary bundler output with no obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); });
console.log('dynamic2');
likely benign
LLM, confidence 0.95
AMD dynamic require of main in a circular-import test fixture.
Reasoning
A literal AMD require pointing back to main, which forms the intended circular test case. This is standard bundler output with no malicious signal.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.95
AMD dynamic require of generated-dynamic2 in a circular-import test fixture.
Reasoning
A literal AMD require of a generated chunk, one of a pair of dynamic loads in the test fixture. The scanner's non-literal flag does not fit this array-literal form.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.95
AMD dynamic require of generated-dynamic1 in a circular-import test fixture.
Reasoning
Another literal AMD require of a generated chunk within the same fixture. It is ordinary bundler output with no obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
likely benign
LLM, confidence 0.95
AMD dynamic require of generated-dynamic2 in a cut-off chunking test fixture.
Reasoning
A literal AMD require of generated-dynamic2 inside a cut-off chunking test. It is standard generated code and the flag is a false positive.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.95
AMD dynamic require of generated-dynamic1 in a cut-off chunking test fixture.
Reasoning
A literal AMD require of generated-dynamic1 in a chunking test fixture. It is ordinary bundler output with no malicious signal.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.95
AMD dynamic require of generated-dynamic1 in a cut-off chunking test fixture.
Reasoning
A literal AMD require of generated-dynamic1 in a chunking test fixture, the same pattern as main1. It is benign generated code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.90
Generated AMD bundle test output that loads a dynamic chunk via a literal require.
Reasoning
The snippet is an AMD require with a literal array specifier ['./generated-dynamic1']. The specifier is not actually non-literal, and this is generated bundler output in a test fixture, so the finding is a false positive.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.90
Generated AMD bundle test output with a literal dynamic require of a chunk.
Reasoning
Same pattern as main3.js: a literal AMD require inside expected chunking output. The non-literal flag is a false positive.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value = value;
likely benign
LLM, confidence 0.90
Generated AMD chunk that dynamically requires the next chunk.
Reasoning
A literal AMD require of './generated-dynamic2' in bundler-generated expected output. Nothing malicious is shown, and the flag does not match the literal specifier.
-
18 of 35 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
18 of 32 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
16 of 30 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
24 of 38 non-conventional identifiers are single-character (63%) (token pass, confidence 0.50)
-
24 of 53 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (3 tab-indented and 31 space-indented lines) (raw pass, confidence 0.40)
var num = 2;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
var num = 1;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
var num = 3;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (7 tab-indented and 31 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function (exports, module) {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (13 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-C9ddpexS.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
file mixes tab and space indentation (13 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-C9ddpexS.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
line length 1540 characters (raw pass, confidence 0.50)
export { lazy, v1, v10, v100, v101, v102, v103, v104, v105, v106, v107, v108, v109, v11, v110, v111, v112, v113, v114, v115, v116, v117, v118, v119, v12, v120, v121, v122, v123, v124, v125, v126, v127, v128, v129, v13, v130, v131, v132, v133, v134, v135, v136, v137, v138, v139, v14, v140, v141, v142, v143, v144, v145,
-
file mixes tab and space indentation (8 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
spawnArgs: ['--config'],
env: { FORCE_COLOR: undefined, NO_COLOR: true },
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'displays logs',
skipIfWindows: true,
spawnArgs: ['--config'],
-
21 of 48 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
23 of 52 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (43 tab-indented and 21 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'immediately reloads the config file if a change happens while it is parsed',
spawnArgs: ['-cw'],
before() {
-
file mixes tab and space indentation (42 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'keeps watching the config file in case the config is changed to an invalid state',
spawnArgs: ['-cw'],
before() {
-
mean non-conventional identifier length 1.95 over 21 names (token pass, confidence 0.50)
-
line length 1453 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopName
-
line length 1429 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&
-
line length 629 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1342 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e)}function _interopName
-
line length 576 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:function(){return defaultCompat.foo}});Object.keys(defaultCompat).forEach(function(k){i
-
line length 1063 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[fu
-
line length 1948 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 1361 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&
-
line length 1337 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'d
-
line length 596 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1250 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e);var _interopNamespaceDefaultOnly=e=>Object.fr
-
line length 538 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:()=>defaultCompat.foo});Object.keys(defaultCompat).forEach(k=>{if(k!=='default'&&!Objec
-
line length 992 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[()
-
line length 1844 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 1153 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1187 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1084 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 722 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module["function"];exports({bar:module["function"],default:module,void:module["default"]});},function(module){defaultOnly=module
-
line length 1455 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
line length 1150 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1184 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1081 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 710 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module.function;exports({bar:module.function,default:module,void:module.default});},function(module){defaultOnly=module;},functi
-
line length 1452 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
20 of 46 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 15 space-indented lines) (raw pass, confidence 0.40)
console.log(
<div>
Hello
World
-
file mixes tab and space indentation (54 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
options: {
experimentalLogSideEffects: true,
-
mean non-conventional identifier length 1.97 over 59 names (token pass, confidence 0.50)
-
24 of 46 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
-
18 of 45 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
line length 785 characters (raw pass, confidence 0.50)
define(['require','exports','external1','external2'],(function(require,exports,external1,external2){'use strict';function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m
-
line length 740 characters (raw pass, confidence 0.50)
'use strict';var external1=require('external1'),external2=require('external2');function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = Promise.resolve().then(function(){return _interopNamespaceDefault(require('exte
-
line length 550 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external1,external2){'use strict';const dynamic = import('external3');exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Object.defineProperty(exports,'__proto
-
line length 811 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external1'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external1','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bundle={},g.external1,g.external2));})(this,(function(
-
23 of 32 non-conventional identifiers are single-character (72%) (token pass, confidence 0.50)
-
18 of 37 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
20 of 39 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
40 of 71 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
40 of 68 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
36 of 61 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
40 of 74 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
-
32 of 67 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
40 of 95 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
32 of 60 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
{
console.log('code21');
}
keep1() ; keep2();
-
mean non-conventional identifier length 1.62 over 45 names (token pass, confidence 0.50)
-
mean non-conventional identifier length 1.74 over 92 names (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
25 of 49 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
22 of 39 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
25 of 55 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
19 of 39 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (19 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
console.log(2); console.log(2);
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (11 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function () {
'use strict';
var a = '1\
-
file mixes tab and space indentation (15 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function () {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (12 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function (factory) {
typeof define === 'function' && define.amd ? define(factory) :
factory();
})((function () { 'use strict';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (3 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
class MyClass extends ExternalElement {
constructor() {
super();
console.log('MyClassExtendsExternalClass');
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
return Function('return require("' + name + '")')();
} catch (error) { }
}
likely benign
LLM, confidence 0.85
core-js polyfill helper that builds a Function to fetch require for a module name.
Reasoning
This is core-js's global-detection helper, which uses Function to reach the global object. It carries an eslint-disable comment marked safe, the body is a fixed string with only a module name concatenated, and it sits in a well-known library.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
validateArgumentsLength(arguments.length, 1);
var fn = isCallable(handler) ? handler : Function(handler);
var args = arraySlice(arguments, 1);
queue[++counter] = function () {
likely benign
LLM, confidence 0.85
core-js timer polyfill that compiles a string handler via Function.
Reasoning
This is core-js's setTimeout/setInterval polyfill, which accepts a string handler per the legacy spec and compiles it with Function. That is a known legitimate pattern in a widely used library, not an attacker-controlled dropper.
-
orphaned high surrogate \uD842 (no matching low surrogate) (token pass, confidence 0.65)
return '𠮷'.at(-2) !== '\uD842';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
var boundArgs = validateArgumentsLength(arguments.length, 1) > firstParamIndex;
var fn = isCallable(handler) ? handler : Function(handler);
var params = boundArgs ? arraySlice(arguments, firstParamIndex) : [];
var callback = boundArgs ? function () {
likely benign
LLM, confidence 0.85
core-js timer polyfill that compiles a string handler via Function (bound-args variant).
Reasoning
Same core-js timer polyfill as the previous finding, with the same legacy string-handler behavior. It is library code in a test expected output.
-
line length 1121 characters (raw pass, confidence 0.50)
var isCallable; var fnToStr = Function.prototype.toString, constructorRegex = /^\s*class /, isES6ClassFn = function isES6ClassFn(value) { try { var fnStr = fnToStr.call(value); var singleStripped = fnStr.replace(/\/\/.*\n/g, ''); var multiStripped = singleStripped.
-
file mixes tab and space indentation (23 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'synthetic named exports',
options: {
plugins: [
-
30 of 57 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
78 of 143 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
28 of 67 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
24 of 57 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
30 of 72 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (116 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
function _mergeNamespaces(n, m) {
m.forEach(function (e) {
e && typeof e !== 'string' && !Array.isArray(e) && Object.keys(e).forEach(function (k) {
if (k !== 'default' && !(k in n)) {
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose')};
}
-
file mixes tab and space indentation (2 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose'),
[Symbol.asyncDispose]: () => console.log('asyncDispose'),
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
try {
const function_ = new Function(contextKeys, code);
function_.apply({}, contextValues);
} catch (error) {
likely benign
LLM, confidence 0.85
Test helper that builds a function from context keys and code to evaluate bundled output.
Reasoning
This is test harness code that wraps generated function-body code with context keys and values. It is a legitimate use of the Function constructor for running bundler output in tests.
-
file mixes tab and space indentation (19 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'should provide json hint when importing a no export json file',
error: {
binding: 'default',
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function getFoo() {
return foo;
}
-
16 of 33 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (40 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles circular reexports',
exports(exports) {
assert.strictEqual(exports.exists, 42);
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function Bar () {
this.inheritsFromBaz = this.isBaz;
}
-
19 of 47 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
17 of 31 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (12 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.finally(() => {
finallyCalled = true;
})
-
file mixes tab and space indentation (10 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.then(() => {
const obj = {
value: false,
-
file mixes tab and space indentation (20 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'Throw descriptive error message for used export is not defined',
error: {
binding: 'foo',
-
file mixes tab and space indentation (47 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'warns for conflicting import attributes',
options: {
external: id => id.startsWith('external')
-
`eval` called with a non-literal expression (ast pass, confidence 0.75)
import 'external';
eval(this);
likely benign
LLM, confidence 0.80
Test fixture that calls eval on this to exercise logging in plugins.
Reasoning
A bare eval(this) in a test sample for logging behavior. It is unusual but sits inside a fixture meant to exercise plugin logging, and the snippet shows no payload or encoded input.
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
if (!b.fromExternal) {
throw new Error('External export not included');
}
-
36 of 58 non-conventional identifiers are single-character (62%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (5 tab-indented and 4 space-indented lines) (raw pass, confidence 0.40)
export const awaitable = async (iterable) => {
for await (const value of iterable) {
}
}
-
file mixes tab and space indentation (26 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
function test1() {
return true ?
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
const switchSubmit = state => {
if (state == 1) {
assert.ok(false);
} else if (state == 0) {
-
file mixes tab and space indentation (34 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles when a low resolution sourcemap is used to report an error',
options: {
plugins: [
-
file mixes tab and space indentation (565 tab-indented and 9 space-indented lines) (raw pass, confidence 0.40)
describe('incremental', () => {
let resolveIdCalls;
let transformCalls;
let modules;
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
globals,
likely benign
LLM, confidence 0.85
Test helper that runs generated IIFE code via the Function constructor with given globals.
Reasoning
This is test harness code that constructs a function from global keys and code to run an IIFE output with a set of globals. It is a legitimate test-execution pattern.
-
file mixes tab and space indentation (462 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
describe('misc', () => {
it('avoids modification of options or their properties', () => {
const { freeze } = Object;
return rollup.rollup(
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
assert.doesNotThrow(() => new Function(umdCode), 'UMD output should be valid JavaScript');
});
likely benign
LLM, confidence 0.90
Test assertion that uses new Function to verify UMD output is valid JavaScript.
Reasoning
The Function call is used only to check that UMD output parses, and the comment states this. It is a syntax validation assertion in a test, not runtime execution of hostile code.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
thisValue,
likely benign
LLM, confidence 0.85
Test helper that executes generated UMD code via the Function constructor.
Reasoning
Same test harness pattern as the IIFE test: the Function constructor runs generated UMD code with supplied globals in a test. It is not a malicious dropper.
-
file mixes tab and space indentation (64 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
export function App() {
return <div>{'.'}</div>;
}
`;
-
file mixes tab and space indentation (70 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
export function App() {
if (count) {
console.log(count);
}
-
base64-like blob (272 bytes, compression ratio 0.74) (in comment) (raw pass, confidence 0.36)
-
file mixes tab and space indentation (64 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
console.log(
this + 2
)
`;
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io