Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', dep.value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', fromMain1AndDynamic.value1, fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = fromMain1AndDynamic.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = fromMain1And2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep1.value1, dep2.value2, something);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = dep1.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', value1, dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('a', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main', value);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
ise.all([new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic1; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic2; }), new Promise(function (resolve, reje
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
ic1; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic2; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic3; })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
ic2; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic3; })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic1; }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic2; }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({DYNAMIC_USED_BY_A}) => console.log(DYNAMIC_USED_BY_A));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
console.log('dynamic2');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
console.log('dynamic3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic5'], resolve, reject); });
console.log('dynamic4');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.shared = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log(result.default));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
return _default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(lib__namespace);
new Promise(function (resolve, reject) { require(['./lib'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
exports.lib = lib__namespace;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-included'], resolve, reject); }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
exports.default = _default.default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra = { with: { type: 'json' } };
import(specifier, extra);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./chain-2.js');
import(somethingElse);
import('external-module');
import('./imports-external.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./imported-via-special-handler.js');
import(someVariable);
import(someResolvedVariable);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(someVariable);
import(someResolvedVariable);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('existing');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('dynamic-direct-external' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-dynamic-indirect-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
Promise.resolve().then(function () { return existing; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('my' + 'replacement');
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
assetString = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt').href : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const assetObject = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt') : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./nested/chunk2'], resolve, reject); }).then(result => console.log(result, chunk$1, chunk, asset$1, asset));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const asset = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.bas
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const chunk = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/nested/chunk.js').href : new URL('nested/chunk.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy = new Promise(function (resolve, reject) { require(['./generated-lazy'], resolve, reject); });
exports.lazy = lazy;
-
line length 3070 characters (raw pass, confidence 0.65)
v272; exports({ v1: v1, v2: v2, v3: v3, v4: v4, v5: v5, v6: v6, v7: v7, v8: v8, v9: v9, v10: v10, v11: v11, v12: v12, v13: v13, v14: v14, v15: v15, v16: v16, v17: v17, v18: v18, v19: v19, v20: v20, v21: v21, v22: v22, v23: v23, v24: v24, v25: v25, v26: v26, v27: v27, v28: v28, v29: v29, v30: v30, v31: v31, v32: v32
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy1 = new Promise(function (resolve, reject) { require(['./generated-foo_20bar'], resolve, reject); });
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
exports.lazy1 = lazy1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-first'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-6Pt_L0T6'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-Bx2VuOb-'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-6Pt_L0T6'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-Bx2VuOb-'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(function (n) { return n.dep; }).then(({ foo, bar, baz }) => console.log(foo, bar, baz));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset3 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.base
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SC
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 0;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 1;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 0;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
function nested1() {
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 1;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return new Promise((resolve, reject) => require([this.outputPath], m => resolve(_interopNamespaceDefault(m)), reject));
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return Promise.resolve().then(() => _interopNamespaceDefault(require(this.outputPath)));
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return Promise.resolve().then(function () { return _interopNamespaceDefault(require(t)); }); })(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`My ${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./seven'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
import('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
logoReverse = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseUR
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.curren
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset1 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset99 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function(c,e){require(['external'],function(m){c(_interopNamespaceCompat(m))},e)}).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((c,e)=>require(['external'],m=>c(_interopNamespaceCompat(m)),e)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceCompat(m)); }, reject); }).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['external'], m => resolve(_interopNamespaceCompat(m)), reject)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra5 = { with: { type: 'json' } };
import(specifier5, extra5);
const extra6 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra6 = { with: { type: 'json' } };
import(specifier6, { with: extra6.with });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('a', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special', extra: 'value' } });
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(join('a', 'b'));
console.log(join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(pathJoin('a', 'b'));
console.log(pathJoin);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external2).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
})(externalauto, externaldefault, externaldefaultOnly, externalesModule);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
eeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m){c(_interopNamespaceDefault(m))},e)});exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Obj
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const dynamic = new Promise(function (resolve, reject) { require(['external3'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.external1 = external1.external1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['https://unpkg.com/foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(({ default: foo }) => assert.equal(foo, 42));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const someDynamicImport = () => new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.someDynamicImport = someDynamicImport;
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
console.log(undefined);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(undefined);
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return code === undefined
? require(importee)
: (exportsMap[outputId] = requireWithContext(
code,
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
export default import('x/' + 'y');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'other') return 17;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
export const path = import('path');
export const pathAgain = import(thePath);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import.source(dynamic).then(console.log)
-
base64-like blob (184 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
module.exports = main;
`
);
-
U+FEFF ZERO WIDTH NO-BREAK SPACE (BOM) in source (raw pass, confidence 0.75)
⟨U+FEFF⟩⟨U+FEFF⟩export const msg = 'foo';
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const configFile = path.join(directory, '_config.js');
const config = require(configFile);
if (!config || !config.description) {
throw new Error(`Found invalid config without description: ${configFile}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
delete require.cache[resolved];
return require(resolved);
}
-
line length 1489 characters (raw pass, confidence 0.50)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
-
line length 2244 characters (raw pass, confidence 0.65)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
dismissed
LLM, confidence 0.97
Long HTML sponsor-badge line in the README.
Reasoning
A very long line in a markdown README made of sponsor badge HTML links. Long lines in generated markdown are a formatting issue, not a code-execution or obfuscation concern.
-
file mixes tab and space indentation (17 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function generateBanner(commitHash: string, version: string): string {
const date = new Date(
env.SOURCE_DATE_EPOCH ? 1000 * +env.SOURCE_DATE_EPOCH : Date.now()
).toUTCString();
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
plugin = new Function('return ' + pluginText);
} else {
const match = pluginText.match(/^([\w./:@\\^{|}-]+)(=(.*))?$/);
likely benign
LLM, confidence 0.80
CLI parses an inline plugin expression from the --plugin argument via new Function.
Reasoning
The Function constructor evaluates the value of the user's own --plugin CLI argument. This is a deliberate feature of a build tool's command-line interface, and the input comes from the local user, not from untrusted package content.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
pluginText = match[1];
pluginArgument = new Function('return ' + match[3])();
} else {
throw new Error(`Invalid --plugin argument format: ${JSON.stringify(pluginText)}`);
likely benign
LLM, confidence 0.80
Evaluates the plugin argument value supplied on the command line.
Reasoning
Same pattern: the text after '=' in a user-supplied --plugin argument is evaluated to produce a plugin option value. It is an intentional CLI feature, though it does run arbitrary user-provided expressions.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return require(pluginPath);
} catch {
return import(pluginPath);
likely benign
LLM, confidence 0.85
Plugin loading falls back from require to import on a user-specified path.
Reasoning
The loader first tries require and then import on a plugin path that the user specified on the command line or in config. This is standard plugin resolution for a bundler.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
} catch {
return import(pluginPath);
}
}
likely benign
LLM, confidence 0.85
Dynamic import of a user-specified plugin module.
Reasoning
This is the ESM fallback of the plugin loader above, importing a user-designated plugin module. It is expected behavior for a plugin system.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
}
return (await import(fileUrl.href)).default;
} catch (error_: any) {
if (cannotLoadEsm) {
likely benign
LLM, confidence 0.88
Dynamic import of the project's configuration file.
Reasoning
Rollup loads the user's own rollup.config file via dynamic import, which is the documented way the config is read. The specifier is the project's config path.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
try {
return (await import(pathToFileURL(bundledFileName).href)).default;
} finally {
unlink(bundledFileName).catch(error => console.warn(error?.message || error));
likely benign
LLM, confidence 0.88
Imports the bundled temporary config file, then unlinks it.
Reasoning
This imports a temporarily bundled copy of the user's config file and then deletes it. It is the normal config-bundling path and the source is the project's own config.
-
line length 1014 characters (raw pass, confidence 0.50)
ES modules export _live bindings_, not values, so values can be changed after they are initially imported as per [this demo](../repl/index.md?shareable=JTdCJTIyZXhhbXBsZSUyMiUzQW51bGwlMkMlMjJtb2R1bGVzJTIyJTNBJTVCJTdCJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMCU3QiUyMGNvdW50JTJDJTIwaW5jcmVtZW50JTIwJTdEJTIwZnJvbSUyMCcuJTJGaW5jcmVt
-
line length 881 characters (raw pass, confidence 0.50)
By default, when creating multiple chunks, imports of dependencies of entry chunks will be added as empty imports to the entry chunks themselves. [Example](../repl/index.md?shareable=JTdCJTIybW9kdWxlcyUyMiUzQSU1QiU3QiUyMm5hbWUlMjIlM0ElMjJtYWluLmpzJTIyJTJDJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMHZhbHVlJTIwZnJvbSUyMCcuJTJGb3RoZ
-
line length 922 characters (raw pass, confidence 0.50)
Even though Rollup will usually try to maintain exact module execution order when bundling, there are two situations when this is not always the case: code-splitting and external dependencies. The problem is most obvious with external dependencies, see the following [example](../repl/index.md?shareable=JTdCJTIybW9kdWxl
-
line length 1258 characters (raw pass, confidence 0.50)
with the execution order `external` → `polyfill.js` → `main.js`. This is not a problem caused by Rollup putting the `import` at the top of the bundle—imports are always executed first, no matter where they are located in the file. This problem can be solved by creating more chunks: If `polyfill.js` ends up in a d
-
`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
if (query.shareable) {
const rawJson = atob(query.shareable.replace(/_/g, '/').replace(/-/g, '+'));
const json = rawJson[0] === '%' ? decodeURIComponent(rawJson) : rawJson;
const {
likely benign
LLM, confidence 0.85
Decodes base64 REPL share state from the query string.
Reasoning
The atob call decodes a shareable URL parameter for the docs REPL state. The decoded value is then parsed as JSON or URI-decoded, not executed. This is ordinary share-link handling.
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
parameters.shareable = btoa(json).replace(/\//g, '_').replace(/\+/g, '-');
const queryString = Object.keys(parameters)
.map(key => `${key}=${parameters[key]}`)
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
try {
return require(id);
} catch (error) {
if (
likely benign
LLM, confidence 0.80
Loads a native module by id with error handling.
Reasoning
A try/catch around require(id) inside a native-binding loader is a common pattern for loading optional platform binaries. Nothing in the snippet shows attacker-controlled input.
-
file mixes tab and space indentation (709 tab-indented and 17 space-indented lines) (raw pass, confidence 0.40)
export const AST_NODES = {
PanicError: {
estreeType: "{ type: 'PanicError', message: string }",
fields: [['message', 'String']],
-
command name is a variable (`$LLVM_PROFDATA`) and `LLVM_PROFDATA` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_PROFDATA="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-profdata"
"$LLVM_PROFDATA" merge -sparse coverage/profraw/*.profraw -o coverage/rust.profdata
NODE_FILE="$(ls dist/rollup.*.node)"
likely benign
LLM, confidence 0.92
Runs llvm-profdata from the rustc sysroot path.
Reasoning
The command is the llvm-profdata binary located under the rustc sysroot, which the script builds from trusted local tooling. Resolving a toolchain binary through a variable is normal in build scripts.
-
command name is a variable (`$LLVM_COV`) and `LLVM_COV` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_COV="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-cov"
"$LLVM_COV" export \
-instr-profile=coverage/rust.profdata \
-object "$NODE_FILE" \
likely benign
LLM, confidence 0.92
Runs llvm-cov from the rustc sysroot path.
Reasoning
The command is llvm-cov from the rustc sysroot, resolved the same way as the previous finding. This is a standard coverage-tooling invocation with no untrusted input.
-
file mixes tab and space indentation (86 tab-indented and 39 space-indented lines) (raw pass, confidence 0.40)
const astMacrosFile = new URL(
'../rust/parse_ast/src/convert_ast/converter/ast_macros.rs',
import.meta.url
);
-
file mixes tab and space indentation (150 tab-indented and 38 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node, originalNode }) => {
const definitions = [];
let offset = 0;
-
file mixes tab and space indentation (139 tab-indented and 36 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node, originalNode }) => {
const definitions = [];
let offset = 2;
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
for (const [name, node] of Object.entries(AST_NODES)) {
const astType = node.astType || name;
const keySet = (childNodeKeysByAstType[astType] ||= new Set());
for (const [fieldName, fieldType] of (node.hasSameFieldsAs
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1');
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
likely benign
LLM, confidence 0.96
Generated AMD require of a test chunk module.
Reasoning
This is generated AMD output from a Rollup chunking test fixture. The require calls load test chunk modules that the bundler itself produced.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
}));
likely benign
LLM, confidence 0.96
Generated AMD require of another test chunk module.
Reasoning
Also generated AMD test-fixture output, requiring a sibling chunk module. It is expected bundler output, not malicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(libs.value2);
console.log(new Promise(function (resolve, reject) { require(['./generated-lib1'], resolve, reject); }).then(function (n) { return n.lib3; }).then(m => m.value3));
}));
likely benign
LLM, confidence 0.96
Generated AMD require in a test expected-output file.
Reasoning
This is generated AMD expected-output in a test sample, requiring a test library module. It is a fixture, not runtime code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.93
Generated AMD dynamic-import wrapper for a chunk in a test fixture.
Reasoning
Expected output from a chunking test. The require call uses a literal chunk path in AMD form, which is ordinary bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./chunks/generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.93
Generated AMD lazy-load of a chunk module through a fixed relative path.
Reasoning
Same Rollup AMD dynamic-import output with a fixed chunk path. The flag fires on the AMD require-with-array form, not on any hidden or dynamic payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.93
Generated AMD loader call that lazily loads a chunk via require with a relative path.
Reasoning
This is Rollup's generated AMD output for a dynamic import. The array-literal specifier is a fixed relative path, and the call is the standard AMD loader pattern. It is a build artifact in a test fixture, not an obfuscated payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/logo2.svg').href : new URL('logo2.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
{
likely benign
LLM, confidence 0.90
Universal-module asset URL helper that uses require('url') in Node and falls back to the browser URL API.
Reasoning
The require('u' + 'rl') is a string-concatenated module name, which looks like evasion. Here it is the Rollup CJS output for a conditional that selects Node's url module when document is undefined, a common universal-bundle pattern. It requires the Node url module, with a browser fallback to new URL. No shell, eval, or network payload is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
likely benign
LLM, confidence 0.92
Two generated AMD lazy-import helpers loading fixed chunk paths.
Reasoning
Rollup AMD test output with two dynamic loader wrappers that load fixed generated chunks. Nothing about it is hidden or executes untrusted input.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
console.log(importA, importB);
likely benign
LLM, confidence 0.92
Generated AMD lazy-import helper loading a fixed chunk.
Reasoning
Second AMD lazy-import helper in the same Rollup expected output, with a fixed chunk path.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.92
Generated AMD chunk loader in a deprecated-API test fixture.
Reasoning
Generated AMD expected output for a deprecated emitFile test. The fixed chunk path is loaded with require in AMD form, and the code has no obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dep1');
new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); });
}));
likely benign
LLM, confidence 0.92
Generated AMD chunk that lazily loads the next chained dependency.
Reasoning
Chained dynamic imports in Rollup's AMD test output. Each step loads a fixed generated module.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.92
Generated AMD entry that lazily loads a fixed dependency chunk.
Reasoning
Same chained-import test fixture. The main module loads a fixed chunk through the AMD loader.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function dynamic (num) {
return new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); })
.then(dep2 => {
return dep2.mult(num);
likely benign
LLM, confidence 0.92
Generated AMD dynamic-import helper inside a chunking test fixture.
Reasoning
Rollup AMD expected output for dynamic-import chunking. The require uses a literal path and the promise chain only calls a multiplication method.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import (
'./foo.js');
likely benign
LLM, confidence 0.88
Test input checking that comments inside a dynamic import() call are handled correctly.
Reasoning
This is a source fixture for comment handling in dynamic import(). It has a literal './foo.js' with comments inside the call, a standard ES syntax test. The non-literal flag is a false positive from the comments breaking the literal detection.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(dep);
}));
likely benign
LLM, confidence 0.80
Generated AMD dynamic loader whose module path is passed in as a variable, from a dynamic-import test.
Reasoning
The AMD require takes a variable specifier t, which is a genuine non-literal. In context it is a Rollup test of dynamic import with a runtime-computed path, a legitimate pattern. The specifier comes from the module's own code, not untrusted input, so the risk is low.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
likely benign
LLM, confidence 0.90
Expected-output fixture containing a dynamic import with a variable specifier.
Reasoning
This is a Rollup chunking test fixture. The bare import(dep) is the expected output for a dynamic import whose specifier is a variable, which is exactly what the sample tests. The pattern is a normal JavaScript feature with no payload or execution chain.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
likely benign
LLM, confidence 0.90
ES expected-output fixture with a variable-specifier dynamic import.
Reasoning
Same Rollup test fixture in ES format. The bare import(dep) is the expected output of a dynamic import with a variable specifier, and nothing in the snippet is hidden or encoded.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
likely benign
LLM, confidence 0.90
Source fixture exercising a variable-specifier dynamic import.
Reasoning
Source fixture for a chunking test that deliberately uses a dynamic import with a variable specifier. This is a legitimate feature being exercised by the bundler test suite.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
dismissed
LLM, confidence 0.93
Rollup-generated AMD require of a literal local module path in a test fixture.
Reasoning
This is Rollup's AMD output for a dynamic import. The require call takes a literal array of local relative module paths, so the flag is a false positive. There is no obfuscation or dynamic execution beyond standard module loading.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic$1; }).then(({dynamic}) => console.log('main1', dynamic));
}));
dismissed
LLM, confidence 0.93
Rollup AMD facade output requiring a literal generated chunk path.
Reasoning
Compiled AMD output from a Rollup chunking test. The require uses a literal relative path array for a generated chunk, which is a normal bundler artifact and not a non-literal specifier.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(dep2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.dep2 = dep2;
dismissed
LLM, confidence 0.93
Rollup AMD output requiring a literal generated chunk from a manual-chunk fixture.
Reasoning
AMD expected output for a manual-chunk test. The require targets a literal relative chunk path, and the surrounding code only exports values, so it is ordinary bundled code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const inlined = Promise.resolve().then(function () { return inlined$2; });
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.inlined = inlined;
dismissed
LLM, confidence 0.93
Rollup AMD output lazy-loading a literal generated chunk in an inline-colouring test.
Reasoning
Rollup test expected output for inlined dynamic imports. The require call uses a literal relative path, and the code is a standard lazy-loading promise pattern.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.separate = separate;
dismissed
LLM, confidence 0.93
Rollup AMD output requiring a literal generated module in an inline-colouring fixture.
Reasoning
Expected-output fixture from a chunking test. The require uses a literal relative path to a generated module and is a benign promise wrapper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
async function test() {
const dep = await new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); });
console.log(dep.obj.a.a.a);
}
dismissed
LLM, confidence 0.93
Rollup AMD output awaiting a literal dynamic-import chunk in a tree-shaking test.
Reasoning
Expected output for a tree-shaking test with an await over a dynamic import. The require path is a literal, so the scanner's non-literal flag is wrong, and the code only logs a property.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(({ obj }) => {
console.log(obj.a);
});
dismissed
LLM, confidence 0.93
Rollup AMD output with a literal dynamic-import chunk in a tree-shaking fixture.
Reasoning
Expected output from a tree-shaking test. The require targets a literal generated chunk path and the then-callback logs a property, which is ordinary code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
dismissed
LLM, confidence 0.93
Rollup AMD output loading two literal chunks via Promise.all in a default-export fixture.
Reasoning
Expected AMD output for a default-only dynamic import test. Both require calls use literal relative paths in a Promise.all, which is a standard bundler pattern.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
dismissed
LLM, confidence 0.93
Second literal AMD require in the same default-only dynamic import fixture.
Reasoning
Same expected-output file as the 5:67 finding. The second require uses a literal relative chunk path, so the flag is a false positive.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({ value }) => console.log(value));
}));
dismissed
LLM, confidence 0.93
Rollup AMD output requiring a literal chunk in a re-export fixture.
Reasoning
Rollup AMD expected output for a re-export test. The require takes a literal relative path and the callback logs a re-exported value, which is benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(({ bar }) => console.log(bar()));
}));
dismissed
LLM, confidence 0.93
Rollup AMD output lazy-loading a literal chunk in a statically-imported fixture.
Reasoning
Expected output from a chunking test where a module is both statically and dynamically imported. The require uses a literal generated chunk path and the code is an ordinary lazy import.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./lib'], resolve, reject); }).then(function (n) { return n.lib; }).then(console.log);
}));
dismissed
LLM, confidence 0.93
Rollup-generated AMD dynamic import of a local './lib' module inside a test expected-output file.
Reasoning
This is a Rollup chunking test fixture in AMD output. The require call takes a literal array of a relative module path, which is the standard AMD form for a dynamic import. The scanner flags the array argument as non-literal, but nothing here is obfuscated or malicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module1'], resolve, reject); });
module.foo();
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module1' wrapped in an async function, from a test fixture.
Reasoning
This is a Rollup test fixture showing AMD output for a dynamic import with namespace access. The require takes a literal array with a relative path, which is normal generated code. The flag comes from the array argument, not from any real dynamic specifier.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module2'], resolve, reject); });
const module1 = module;
module1.foo();
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module2' in an async test fixture.
Reasoning
Same Rollup test fixture pattern: a literal relative module path in an AMD require array, with ordinary destructuring-style test code around it. No obfuscation or suspicious behaviour.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module3'], resolve, reject); });
const { foo } = module;
foo();
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module3' in a test fixture.
Reasoning
Rollup test fixture. The require call uses a literal relative path in an array, and the surrounding code is plain namespace destructuring used to test chunking output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module4'], resolve, reject); });
const { foo, ...rest } = module;
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module4' in a test fixture.
Reasoning
Rollup test fixture with a literal relative module path in the AMD require array and benign rest-destructuring test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module5'], resolve, reject); });
readFoo({ foo: () => {} });
readFoo(module);
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module5' in a test fixture.
Reasoning
Rollup test fixture. The require array holds a literal relative path, and the surrounding code only exercises namespace usage in the output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module6'], resolve, reject); });
function b({ foo }) {
foo();
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module6' in a test fixture.
Reasoning
Rollup test fixture. The require array uses a literal relative path, and the function body is ordinary destructuring test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module7'], resolve, reject); });
function b({ foo, ...rest }) {
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module7' in a test fixture.
Reasoning
Rollup test fixture with a literal relative module path in the AMD require array and benign rest-destructuring code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module8'], resolve, reject); });
function b(o1, ...rest) {
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module8' in a test fixture.
Reasoning
Rollup test fixture. The require array holds a literal relative path, and the rest-parameter function is ordinary test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module9'], resolve, reject); });
function b({ foo = 1 }) {
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module9' in a test fixture.
Reasoning
Rollup test fixture. The require array uses a literal relative path, and the default-destructuring function is ordinary test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module10'], resolve, reject); });
(module).bar();
(global.unknown && module).foo();
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-module10' in a test fixture with a short namespace-access test.
Reasoning
Rollup test fixture. The require array holds a literal relative path. The expression '(global.unknown && module).foo()' is an odd-looking but harmless test assertion of namespace access, not an attack.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./other'], resolve, reject); }).then(result =>
assert.deepEqual(result, { value: 'shared', extra: 'extra' })
);
likely benign
LLM, confidence 0.92
Generated AMD dynamic import of a sibling chunk followed by a test assertion.
Reasoning
Rollup AMD expected output for a dynamic import test. The chunk path is literal and the callback only runs assertions.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
exports.promise = promise;
dismissed
LLM, confidence 0.93
Generated AMD require of './generated-dynamic' inside a promise chain in a test fixture.
Reasoning
Rollup test fixture for facaded entries. The require array holds a literal relative path to './generated-dynamic', and the rest is ordinary promise chaining.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(result => console.log('importer', result));
}));
dismissed
LLM, confidence 0.93
Generated AMD require of './main' in a promise chain in a test fixture.
Reasoning
Rollup test fixture. The require array holds a literal relative path to './main', and the promise chain is ordinary test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
dismissed
LLM, confidence 0.92
Rollup test fixture where a dynamic import is transpiled to an AMD require of a local chunk.
Reasoning
This is Rollup's expected-output fixture for AMD dynamic import transpilation. The require call with a non-literal array specifier is the standard AMD loader form that replaces import(). It loads a sibling bundle chunk (./main) and has no shell, eval, or encoded payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
dismissed
LLM, confidence 0.92
Rollup-generated AMD dynamic import of a local generated chunk in a test fixture.
Reasoning
This is a Rollup chunking test expected output. The AMD require loads a local relative chunk (./generated-dynamic) as part of normal dynamic-import transpilation, with no obfuscation or malicious behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
dismissed
LLM, confidence 0.92
Rollup test fixture converting a dynamic import to an AMD require of ./main.
Reasoning
Identical Rollup test fixture pattern: AMD require of a local relative module from a dynamic import, as expected for bundler output. No suspicious constructs are present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
dismissed
LLM, confidence 0.92
Rollup test fixture with an AMD require of a local generated chunk.
Reasoning
Rollup expected-output fixture; the AMD require loads a local relative chunk, which is normal bundler transpilation of import() in a test sample.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log('importer', result));
}));
dismissed
LLM, confidence 0.92
Rollup test fixture with AMD dynamic import plus namespace interop helper.
Reasoning
Rollup test fixture. The AMD require loads a local relative module, and the callback wraps the namespace with a standard interop helper. This is normal transpiled dynamic-import output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('no importer', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
dismissed
LLM, confidence 0.93
Rollup CJS polyfill that resolves a generated chunk URL in browser or Node environments.
Reasoning
This is Rollup's standard import.meta.url polyfill for CJS output. The 'u' + 'rl' split is a bundler-generated way to load the url module without static detection, and the require is guarded by a typeof document check. It is a common, benign compatibility pattern in test output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from maim', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
dismissed
LLM, confidence 0.93
Rollup-generated environment-dependent URL resolution for a generated chunk.
Reasoning
Same Rollup import.meta.url polyfill pattern: a browser/Node branch that uses require('url') via string concatenation for pathToFileURL. The concatenation looks evasive but is bundler output. The target is a local generated file, so there is no malicious payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from nested', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib2.js').href : new URL('generated-lib2.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
dismissed
LLM, confidence 0.93
Rollup URL-resolution polyfill for a nested emitted chunk in a CJS test fixture.
Reasoning
Same benign Rollup URL-resolution polyfill for a nested generated chunk. The 'u' + 'rl' split and typeof document guard are standard bundler output for emitted files.
-
file mixes tab and space indentation (41 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'allows adding additional chunks to be used in workers',
options: {
input: 'main',
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./chunks/nested'], resolve, reject); })
.then(result => result.getWorkerMessage())
.then(message => (document.body.innerHTML += `<h1>2: ${message.data}</h1>`));
dismissed
LLM, confidence 0.92
Rollup test fixture with an AMD require of a local nested worker chunk.
Reasoning
Rollup test fixture. The AMD require loads a local nested chunk (./chunks/nested) as part of dynamic-import transpilation for a worker example. No obfuscation or malicious intent is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker-proxy.js').href : new URL('worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
dismissed
LLM, confidence 0.93
Rollup-generated URL resolution for a worker proxy script in a CJS test fixture.
Reasoning
Rollup's CJS URL-resolution polyfill for constructing a Worker from a local proxy file. The string-split require('url') and typeof document guard are standard bundler output, and the target is a sibling file.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
PLACEHOLDER((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker.js').href : new URL('worker.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
dismissed
LLM, confidence 0.93
Rollup-generated worker URL resolution boilerplate in a CJS expected-output fixture.
Reasoning
This is Rollup's standard CJS output for import.meta.url. The 'u'+'rl' concatenation is a bundler-generated way to load the url module without a literal require that bundlers would rewrite. It sits in a chunking-form test fixture with no payload, shell call, or decode step.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
dismissed
LLM, confidence 0.93
Generated Worker URL construction using the Rollup import.meta.url fallback.
Reasoning
Same Rollup import.meta.url polyfill pattern used to construct a Worker URL in a generated test fixture. The require is only reached in non-browser environments and is not an obfuscated payload.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const getWorkerMessage = () => new Promise(resolve => {
const worker = new Worker(new URL('chunks/worker-proxy.js', import.meta.url).href);
worker.onmessage = resolve;
});
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
CSS.paintWorklet.addModule((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worklet.js').href : new URL('chunks/worklet.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
dismissed
LLM, confidence 0.93
Generated paint worklet module URL resolution in a test fixture.
Reasoning
Rollup-generated import.meta.url fallback passed to CSS.paintWorklet.addModule in a test expected-output file. This is standard bundler output, not malicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./ext\'ernal'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('main', dep.value);
dismissed
LLM, confidence 0.90
Rollup test fixture with an AMD require for an external module via dynamic import.
Reasoning
Rollup expected output. The require specifier is a quoted string literal with an escaped apostrophe, which is the fixture's way of naming an external module. The callback applies a standard namespace interop helper. No malicious behavior is shown.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./entry-deb-amd'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
dismissed
LLM, confidence 0.90
AMD-style dynamic import of an entry module in generated test output.
Reasoning
Standard AMD dynamic-import output with a literal module path and resolve/reject callbacks, as generated by the bundler in a preserve-modules test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
dismissed
LLM, confidence 0.90
AMD dynamic import of a sibling chunk in a generated test fixture.
Reasoning
This is an AMD-format require with a literal array of a sibling chunk, which is the normal AMD dynamic-import wrapper Rollup emits. The flag comes from the loader-style require name, not from any real obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
showImage(logo);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.showImage = showImage;
dismissed
LLM, confidence 0.90
AMD dynamic import of a nested chunk in a reference-files test fixture.
Reasoning
AMD dynamic import of './nested/chunk' with a literal path, the expected output of a bundler test. No suspicious behaviour is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo1-FquQRdV3.svg').href : new URL('assets/logo1-FquQRdV3.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
dismissed
LLM, confidence 0.93
Generated asset URL resolution for an SVG logo in a CJS test fixture.
Reasoning
Rollup-generated import.meta.url fallback used to resolve an SVG asset URL. It is standard bundler output in an expected-output fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/../assets/logo2-DJfvToLT.svg').href : new URL('../assets/logo2-DJfvToLT.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
dismissed
LLM, confidence 0.93
Generated relative asset URL resolution in a nested CJS chunk fixture.
Reasoning
Same generated import.meta.url fallback for a relative asset path. This is bundler boilerplate in a test expected-output file.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
renderStart = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/renderStart-B4XObdBk.txt').href : new URL('assets/renderStart-B4XObdBk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).hre
dismissed
LLM, confidence 0.93
Generated text asset URL resolution in a CJS set-asset-source fixture.
Reasoning
Rollup-generated import.meta.url fallback resolving a text asset path. It is a standard emitted-file pattern in a test fixture and carries no payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderStartNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderStart.txt').href : new URL('renderStart.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
dismissed
LLM, confidence 0.93
Generated asset URL resolution for renderStart.txt in a test fixture.
Reasoning
Same bundler-generated URL fallback for a renderStart text asset. Benign generated code in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const bannerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/banner.txt').href : new URL('banner.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
dismissed
LLM, confidence 0.93
Generated asset URL resolution for banner.txt in a test fixture.
Reasoning
Same generated import.meta.url fallback for banner.txt. Benign bundler output in a chunking test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const footerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/footer.txt').href : new URL('footer.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS fallback that loads Node's url module for asset paths in a Rollup test fixture.
Reasoning
The require('u' + 'rl') call is a split string literal, which the scanner treats as a non-literal specifier. It sits inside a typeof document guard that picks a Node path (pathToFileURL) or a browser path (new URL). This is the standard shape of a bundler's generated import.meta.url fallback in a test fixture. The concatenation is odd but harmless, and nothing here runs a remote payload or a shell.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const introNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/intro.txt').href : new URL('intro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS asset-URL fallback for intro.txt in a Rollup test fixture.
Reasoning
Same generated pattern as the other lines in this file: require('u' + 'rl') behind a typeof document check, resolving a local intro.txt asset path. No network or execution sink is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const outroNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/outro.txt').href : new URL('outro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS asset-URL fallback for outro.txt in a Rollup test fixture.
Reasoning
Identical generated fallback for outro.txt, with the same split 'u'+'rl' module name inside a typeof document guard. It is a build artifact, not a dropper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderChunkNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderChunk.txt').href : new URL('renderChunk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS asset-URL fallback for renderChunk.txt in a Rollup test fixture.
Reasoning
Same generated pattern for renderChunk.txt. The specifier is a fixed built-in module name, and the code only builds a file URL.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const generateBundleNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generateBundle.txt').href : new URL('generateBundle.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS asset-URL fallback for generateBundle.txt in a Rollup test fixture.
Reasoning
Same generated pattern for generateBundle.txt. Benign build output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.90
AMD-style dynamic require of a relative chunk module in a Rollup test fixture.
Reasoning
This is an AMD dynamic import with a literal array of a relative module path ('./generated-dynamic'). The finding flags a non-literal specifier, but the specifier is a literal inside an array. This is normal AMD chunk loading.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(console.log);
}));
likely benign
LLM, confidence 0.90
AMD dynamic chunk load of generated-dep1 in a Rollup test fixture.
Reasoning
AMD dynamic require with a literal relative module array (./generated-dep1), followed by a promise chain that reads n.dep1. Ordinary chunk loading with no dynamic code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['./generated-dep1'], resolve, reject)).then(n => n.dep1).then(console.log);
}));
likely benign
LLM, confidence 0.90
Arrow-function AMD dynamic chunk load of generated-dep1 in a Rollup test fixture.
Reasoning
Same AMD dynamic chunk load as the arrow-functions-false variant, written with arrow functions. The module path is a literal array entry, so the finding is a false positive.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
likely benign
LLM, confidence 0.90
AMD dynamic dependency load of generated-dynamicDep in a Rollup test fixture.
Reasoning
AMD require with a literal array naming the relative module ./generated-dynamicDep. This is standard generated output for a dynamic dependency, and the finding flags it only because the call is in array form.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
exports.value = value;
likely benign
LLM, confidence 0.90
AMD dynamic dependency load of generated-dynamicDep in a Rollup test fixture.
Reasoning
Same AMD dynamic require of ./generated-dynamicDep with a literal array specifier. Benign generated output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
likely benign
LLM, confidence 0.90
AMD dynamic dependency load of generated-dynamicDep in a Rollup test fixture.
Reasoning
Same AMD dynamic require of ./generated-dynamicDep with a literal array specifier. Benign generated output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-lib'], resolve, reject); }).then(function (n) { return n.lib; });
}));
likely benign
LLM, confidence 0.90
AMD dynamic load of generated-lib in a Rollup test fixture.
Reasoning
AMD dynamic require with a literal relative module array (./generated-lib), followed by reading n.lib. Normal chunk loading with a literal specifier, so the finding is a false positive.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const url = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('0/1/nested.js', document.baseURI).href));
exports.url = url;
likely benign
LLM, confidence 0.90
Rollup-generated import.meta.url polyfill that calls require('url') in a CJS test fixture.
Reasoning
This is Rollup's generated CommonJS fallback for import.meta.url in a test fixture. The require('u'+'rl') concatenation is a known bundler output pattern for loading the url module without bundling it, and the file is an expected-output sample, not shipped code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
log('main: ' + new URL(module.uri, document.baseURI).href);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.log = log;
likely benign
LLM, confidence 0.93
AMD dynamic chunk loader inside a Rollup expected-output fixture.
Reasoning
The flagged call is AMD-style require(['./nested/chunk'], resolve, reject), which takes an array literal of module ids for a dynamic chunk load. The flag is a false positive from the non-literal check on the array form.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log('main: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('main.js', document.baseURI).href)));
likely benign
LLM, confidence 0.90
Rollup CJS import.meta.url fallback logging a URL in a test fixture.
Reasoning
Same Rollup import.meta.url fallback as the other fixtures: require('u'+'rl') resolves the url module to compute __filename-based URLs. It is a standard generated pattern in a test sample.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
main.log('nested: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('nested/chunk.js', document.baseURI).href)));
likely benign
LLM, confidence 0.90
Rollup-generated URL resolution shim in a nested CJS chunk fixture.
Reasoning
Generated import.meta.url shim using require('u'+'rl') and document.baseURI fallback, the standard Rollup output for this feature. No payload or network exfiltration is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.shared = shared;
likely benign
LLM, confidence 0.92
AMD dynamic import of a sibling chunk in a chunking test fixture.
Reasoning
AMD require with an array of a relative chunk id is ordinary code-splitting output. The non-literal flag is triggered by the array syntax, not by any dynamic module name.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
likely benign
LLM, confidence 0.92
AMD dynamic import of generated-dynamic2 in a circular-import fixture.
Reasoning
Standard AMD dynamic chunk load between two generated chunks in a circular-import test. No obfuscation or suspicious execution.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); });
console.log('dynamic2');
likely benign
LLM, confidence 0.92
AMD dynamic import of main from a generated chunk in a circular-import fixture.
Reasoning
Standard AMD dynamic require of main from a generated chunk, expected for circular-import test output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.92
AMD main entry loading two dynamic chunks in a circular-import fixture.
Reasoning
Two AMD dynamic chunk loads with array literals in the main entry of a test fixture. Normal bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.92
AMD main entry dynamic chunk load in a circular-import fixture.
Reasoning
Same AMD dynamic-import pattern as the line-3 finding in the same file, with the same benign reading.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
likely benign
LLM, confidence 0.92
AMD dynamic import of generated-dynamic2 in a cut-off chunking fixture.
Reasoning
Standard AMD dynamic chunk load in a cut-off chunking test fixture. The flag is a false positive from the array syntax.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.92
AMD main1 entry dynamically loading generated-dynamic1 in a cut-off fixture.
Reasoning
Standard AMD dynamic chunk load in a test fixture, matching the other Rollup-generated chunk loaders.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.92
AMD main2 entry dynamically loading generated-dynamic1 in a cut-off fixture.
Reasoning
Same AMD dynamic chunk load pattern as the other cut-off fixture files, expected bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
dismissed
LLM, confidence 0.90
Generated AMD loader call for a dynamic chunk in a test fixture.
Reasoning
The require call uses a literal module array in generated AMD output from Rollup's chunking test suite. The flag fires because the specifier sits inside an array literal, which the analyzer misreads as non-literal. Nothing malicious is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
dismissed
LLM, confidence 0.90
Generated AMD dynamic-import loader in a chunking test expectation.
Reasoning
Identical generated AMD require with a literal dependency array inside a test expectation file. This is a false positive from the analyzer.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value = value;
dismissed
LLM, confidence 0.90
Generated AMD require for a chained dynamic chunk in test output.
Reasoning
Generated AMD output from a bundler test. The require target is a fixed literal string in an array, so the warning is a false positive.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
dismissed
LLM, confidence 0.90
Generated AMD dynamic-import loader in a test expectation file.
Reasoning
Generated AMD dynamic-import output from Rollup's test suite with a literal dependency. Benign.
-
18 of 35 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
18 of 32 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
16 of 30 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
24 of 38 non-conventional identifiers are single-character (63%) (token pass, confidence 0.50)
-
24 of 53 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (3 tab-indented and 31 space-indented lines) (raw pass, confidence 0.40)
var num = 2;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
var num = 1;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
var num = 3;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (7 tab-indented and 31 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function (exports, module) {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (13 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-C9ddpexS.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
file mixes tab and space indentation (13 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-C9ddpexS.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
line length 1540 characters (raw pass, confidence 0.50)
export { lazy, v1, v10, v100, v101, v102, v103, v104, v105, v106, v107, v108, v109, v11, v110, v111, v112, v113, v114, v115, v116, v117, v118, v119, v12, v120, v121, v122, v123, v124, v125, v126, v127, v128, v129, v13, v130, v131, v132, v133, v134, v135, v136, v137, v138, v139, v14, v140, v141, v142, v143, v144, v145,
-
file mixes tab and space indentation (8 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
spawnArgs: ['--config'],
env: { FORCE_COLOR: undefined, NO_COLOR: true },
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'displays logs',
skipIfWindows: true,
spawnArgs: ['--config'],
-
21 of 48 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
23 of 52 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (43 tab-indented and 21 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'immediately reloads the config file if a change happens while it is parsed',
spawnArgs: ['-cw'],
before() {
-
file mixes tab and space indentation (42 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'keeps watching the config file in case the config is changed to an invalid state',
spawnArgs: ['-cw'],
before() {
-
mean non-conventional identifier length 1.95 over 21 names (token pass, confidence 0.50)
-
line length 1453 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopName
-
line length 1429 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&
-
line length 629 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1342 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e)}function _interopName
-
line length 576 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:function(){return defaultCompat.foo}});Object.keys(defaultCompat).forEach(function(k){i
-
line length 1063 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[fu
-
line length 1948 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 1361 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&
-
line length 1337 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'d
-
line length 596 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1250 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e);var _interopNamespaceDefaultOnly=e=>Object.fr
-
line length 538 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:()=>defaultCompat.foo});Object.keys(defaultCompat).forEach(k=>{if(k!=='default'&&!Objec
-
line length 992 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[()
-
line length 1844 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 1153 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1187 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1084 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 722 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module["function"];exports({bar:module["function"],default:module,void:module["default"]});},function(module){defaultOnly=module
-
line length 1455 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
line length 1150 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1184 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1081 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 710 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module.function;exports({bar:module.function,default:module,void:module.default});},function(module){defaultOnly=module;},functi
-
line length 1452 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
20 of 46 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 15 space-indented lines) (raw pass, confidence 0.40)
console.log(
<div>
Hello
World
-
file mixes tab and space indentation (54 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
options: {
experimentalLogSideEffects: true,
-
mean non-conventional identifier length 1.97 over 59 names (token pass, confidence 0.50)
-
24 of 46 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
-
18 of 45 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
line length 785 characters (raw pass, confidence 0.50)
define(['require','exports','external1','external2'],(function(require,exports,external1,external2){'use strict';function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m
-
line length 740 characters (raw pass, confidence 0.50)
'use strict';var external1=require('external1'),external2=require('external2');function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = Promise.resolve().then(function(){return _interopNamespaceDefault(require('exte
-
line length 550 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external1,external2){'use strict';const dynamic = import('external3');exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Object.defineProperty(exports,'__proto
-
line length 811 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external1'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external1','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bundle={},g.external1,g.external2));})(this,(function(
-
23 of 32 non-conventional identifiers are single-character (72%) (token pass, confidence 0.50)
-
18 of 37 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
20 of 39 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
40 of 71 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
40 of 68 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
36 of 61 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
40 of 74 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
-
32 of 67 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
40 of 95 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
32 of 60 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
{
console.log('code21');
}
keep1() ; keep2();
-
mean non-conventional identifier length 1.62 over 45 names (token pass, confidence 0.50)
-
mean non-conventional identifier length 1.74 over 92 names (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
25 of 49 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
22 of 39 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
25 of 55 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
19 of 39 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (19 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
console.log(2); console.log(2);
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (11 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function () {
'use strict';
var a = '1\
-
file mixes tab and space indentation (15 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function () {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (12 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function (factory) {
typeof define === 'function' && define.amd ? define(factory) :
factory();
})((function () { 'use strict';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (3 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
class MyClass extends ExternalElement {
constructor() {
super();
console.log('MyClassExtendsExternalClass');
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
return Function('return require("' + name + '")')();
} catch (error) { }
}
likely benign
LLM, confidence 0.80
Fallback that uses Function to fetch a global require inside a vendored core-js sample.
Reasoning
This is a core-js style global-object lookup that builds a require call inside Function. It is guarded by try/catch and carries an eslint-disable comment marking it as deliberate. The code is a library polyfill in an expected-output fixture, not a dropper, though the dynamic Function construction is a real pattern worth noting.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
validateArgumentsLength(arguments.length, 1);
var fn = isCallable(handler) ? handler : Function(handler);
var args = arraySlice(arguments, 1);
queue[++counter] = function () {
likely benign
LLM, confidence 0.80
Legacy string-handler support in a vendored core-js timers polyfill.
Reasoning
This is the core-js timers polyfill, which passes string handlers to Function as the legacy setTimeout/setInterval behavior. It is a known library pattern inside a test fixture, not attacker-controlled input.
-
orphaned high surrogate \uD842 (no matching low surrogate) (token pass, confidence 0.65)
return '𠮷'.at(-2) !== '\uD842';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
var boundArgs = validateArgumentsLength(arguments.length, 1) > firstParamIndex;
var fn = isCallable(handler) ? handler : Function(handler);
var params = boundArgs ? arraySlice(arguments, firstParamIndex) : [];
var callback = boundArgs ? function () {
likely benign
LLM, confidence 0.80
Legacy string-handler support in a second core-js timers polyfill location.
Reasoning
A second instance of the same core-js timers polyfill pattern, where Function converts a string handler to a callable. It is library code in a test expectation.
-
line length 1121 characters (raw pass, confidence 0.50)
var isCallable; var fnToStr = Function.prototype.toString, constructorRegex = /^\s*class /, isES6ClassFn = function isES6ClassFn(value) { try { var fnStr = fnToStr.call(value); var singleStripped = fnStr.replace(/\/\/.*\n/g, ''); var multiStripped = singleStripped.
-
file mixes tab and space indentation (23 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'synthetic named exports',
options: {
plugins: [
-
30 of 57 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
78 of 143 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
28 of 67 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
24 of 57 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
30 of 72 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (116 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
function _mergeNamespaces(n, m) {
m.forEach(function (e) {
e && typeof e !== 'string' && !Array.isArray(e) && Object.keys(e).forEach(function (k) {
if (k !== 'default' && !(k in n)) {
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose')};
}
-
file mixes tab and space indentation (2 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose'),
[Symbol.asyncDispose]: () => console.log('asyncDispose'),
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
try {
const function_ = new Function(contextKeys, code);
function_.apply({}, contextValues);
} catch (error) {
likely benign
LLM, confidence 0.80
Test helper that constructs and runs code with a provided context.
Reasoning
This is a test harness that builds a function from supplied keys and code in order to run snippets with a context. Dynamic evaluation is the purpose of the harness, and it runs only test inputs.
-
file mixes tab and space indentation (19 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'should provide json hint when importing a no export json file',
error: {
binding: 'default',
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function getFoo() {
return foo;
}
-
16 of 33 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (40 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles circular reexports',
exports(exports) {
assert.strictEqual(exports.exists, 42);
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function Bar () {
this.inheritsFromBaz = this.isBaz;
}
-
19 of 47 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
17 of 31 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (12 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.finally(() => {
finallyCalled = true;
})
-
file mixes tab and space indentation (10 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.then(() => {
const obj = {
value: false,
-
file mixes tab and space indentation (20 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'Throw descriptive error message for used export is not defined',
error: {
binding: 'foo',
-
file mixes tab and space indentation (47 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'warns for conflicting import attributes',
options: {
external: id => id.startsWith('external')
-
`eval` called with a non-literal expression (ast pass, confidence 0.75)
import 'external';
eval(this);
likely benign
LLM, confidence 0.70
Sample module that evaluates `this` as a logging-test fixture.
Reasoning
A test fixture that calls eval on the module's `this` value. It is an odd construct, but it is a sample input for a logging test and does not decode or load a payload.
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
if (!b.fromExternal) {
throw new Error('External export not included');
}
-
36 of 58 non-conventional identifiers are single-character (62%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (5 tab-indented and 4 space-indented lines) (raw pass, confidence 0.40)
export const awaitable = async (iterable) => {
for await (const value of iterable) {
}
}
-
file mixes tab and space indentation (26 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
function test1() {
return true ?
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
const switchSubmit = state => {
if (state == 1) {
assert.ok(false);
} else if (state == 0) {
-
file mixes tab and space indentation (34 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles when a low resolution sourcemap is used to report an error',
options: {
plugins: [
-
file mixes tab and space indentation (565 tab-indented and 9 space-indented lines) (raw pass, confidence 0.40)
describe('incremental', () => {
let resolveIdCalls;
let transformCalls;
let modules;
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
globals,
likely benign
LLM, confidence 0.80
Test harness that executes generated IIFE output with supplied globals.
Reasoning
A test helper that wraps supplied code in a Function with a set of globals, used to execute IIFE output in a sandbox. It runs only test code.
-
file mixes tab and space indentation (462 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
describe('misc', () => {
it('avoids modification of options or their properties', () => {
const { freeze } = Object;
return rollup.rollup(
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
assert.doesNotThrow(() => new Function(umdCode), 'UMD output should be valid JavaScript');
});
dismissed
LLM, confidence 0.90
Syntax-validity check of UMD output inside an assertion.
Reasoning
The Function call only checks that the UMD output parses, as the assertion shows. It never runs the code, so it is a syntax check in a test.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
thisValue,
likely benign
LLM, confidence 0.80
Test harness that executes generated UMD output in a sandbox.
Reasoning
A test harness that executes UMD output with a supplied this value and globals. It is the same sandbox pattern as the IIFE test and runs only test code.
-
file mixes tab and space indentation (64 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
export function App() {
return <div>{'.'}</div>;
}
`;
-
file mixes tab and space indentation (70 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
export function App() {
if (count) {
console.log(count);
}
-
base64-like blob (272 bytes, compression ratio 0.74) (in comment) (raw pass, confidence 0.36)
-
file mixes tab and space indentation (64 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
console.log(
this + 2
)
`;
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io