Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', dep.value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', fromMain1AndDynamic.value1, fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = fromMain1AndDynamic.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = fromMain1And2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep1.value1, dep2.value2, something);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = dep1.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', value1, dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('a', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main', value);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
ise.all([new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic1; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic2; }), new Promise(function (resolve, reje
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
ic1; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic2; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic3; })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
ic2; }), new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic3; })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic1; }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic2; }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({DYNAMIC_USED_BY_A}) => console.log(DYNAMIC_USED_BY_A));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
console.log('dynamic2');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
console.log('dynamic3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic5'], resolve, reject); });
console.log('dynamic4');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.shared = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log(result.default));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
return _default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(lib__namespace);
new Promise(function (resolve, reject) { require(['./lib'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
exports.lib = lib__namespace;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-included'], resolve, reject); }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
exports.default = _default.default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra = { with: { type: 'json' } };
import(specifier, extra);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./chain-2.js');
import(somethingElse);
import('external-module');
import('./imports-external.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./imported-via-special-handler.js');
import(someVariable);
import(someResolvedVariable);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(someVariable);
import(someResolvedVariable);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('existing');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('dynamic-direct-external' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-dynamic-indirect-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
Promise.resolve().then(function () { return existing; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('my' + 'replacement');
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
assetString = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt').href : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const assetObject = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt') : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./nested/chunk2'], resolve, reject); }).then(result => console.log(result, chunk$1, chunk, asset$1, asset));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const asset = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.bas
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const chunk = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/nested/chunk.js').href : new URL('nested/chunk.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy = new Promise(function (resolve, reject) { require(['./generated-lazy'], resolve, reject); });
exports.lazy = lazy;
-
line length 3070 characters (raw pass, confidence 0.65)
v272; exports({ v1: v1, v2: v2, v3: v3, v4: v4, v5: v5, v6: v6, v7: v7, v8: v8, v9: v9, v10: v10, v11: v11, v12: v12, v13: v13, v14: v14, v15: v15, v16: v16, v17: v17, v18: v18, v19: v19, v20: v20, v21: v21, v22: v22, v23: v23, v24: v24, v25: v25, v26: v26, v27: v27, v28: v28, v29: v29, v30: v30, v31: v31, v32: v32
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy1 = new Promise(function (resolve, reject) { require(['./generated-foo_20bar'], resolve, reject); });
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
exports.lazy1 = lazy1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-first'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-CBK0ZRhv'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-DAVPlGJs'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-CBK0ZRhv'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-DAVPlGJs'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(function (n) { return n.dep; }).then(({ foo, bar, baz }) => console.log(foo, bar, baz));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset3 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.base
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SC
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 0;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 1;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 0;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
function nested1() {
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 1;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return new Promise((resolve, reject) => require([this.outputPath], m => resolve(_interopNamespaceDefault(m)), reject));
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return Promise.resolve().then(() => _interopNamespaceDefault(require(this.outputPath)));
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return Promise.resolve().then(function () { return _interopNamespaceDefault(require(t)); }); })(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`My ${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./seven'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
import('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
logoReverse = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseUR
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.curren
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset1 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset99 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function(c,e){require(['external'],function(m){c(_interopNamespaceCompat(m))},e)}).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((c,e)=>require(['external'],m=>c(_interopNamespaceCompat(m)),e)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceCompat(m)); }, reject); }).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['external'], m => resolve(_interopNamespaceCompat(m)), reject)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra5 = { with: { type: 'json' } };
import(specifier5, extra5);
const extra6 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra6 = { with: { type: 'json' } };
import(specifier6, { with: extra6.with });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('a', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special', extra: 'value' } });
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(join('a', 'b'));
console.log(join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(pathJoin('a', 'b'));
console.log(pathJoin);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external2).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
})(externalauto, externaldefault, externaldefaultOnly, externalesModule);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
eeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m){c(_interopNamespaceDefault(m))},e)});exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Obj
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const dynamic = new Promise(function (resolve, reject) { require(['external3'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.external1 = external1.external1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['https://unpkg.com/foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(({ default: foo }) => assert.equal(foo, 42));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const someDynamicImport = () => new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.someDynamicImport = someDynamicImport;
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
console.log(undefined);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(undefined);
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return code === undefined
? require(importee)
: (exportsMap[outputId] = requireWithContext(
code,
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
export default import('x/' + 'y');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'other') return 17;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
export const path = import('path');
export const pathAgain = import(thePath);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import.source(dynamic).then(console.log)
-
base64-like blob (184 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
module.exports = main;
`
);
-
U+FEFF ZERO WIDTH NO-BREAK SPACE (BOM) in source (raw pass, confidence 0.75)
⟨U+FEFF⟩⟨U+FEFF⟩export const msg = 'foo';
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const configFile = path.join(directory, '_config.js');
const config = require(configFile);
if (!config || !config.description) {
throw new Error(`Found invalid config without description: ${configFile}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
delete require.cache[resolved];
return require(resolved);
}
-
line length 1489 characters (raw pass, confidence 0.50)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
-
line length 2244 characters (raw pass, confidence 0.65)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
dismissed
LLM, confidence 0.97
Long single-line HTML sponsor badge markup in the project README.
Reasoning
A 2244-character line of HTML sponsor badge anchors in a markdown README is a formatting artifact with no obfuscation or execution risk. The raw long-line signal is a known false-positive class.
-
file mixes tab and space indentation (17 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function generateBanner(commitHash: string, version: string): string {
const date = new Date(
env.SOURCE_DATE_EPOCH ? 1000 * +env.SOURCE_DATE_EPOCH : Date.now()
).toUTCString();
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
plugin = new Function('return ' + pluginText);
} else {
const match = pluginText.match(/^([\w./:@\\^{|}-]+)(=(.*))?$/);
likely benign
LLM, confidence 0.85
Parses an inline plugin definition from the --plugin CLI argument via new Function.
Reasoning
The Function constructor evaluates the value of a user-supplied CLI flag (-p with an inline object literal). The comment documents this as an intentional feature, and the code runs only on the user's own command line, not on fetched or bundled content.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
pluginText = match[1];
pluginArgument = new Function('return ' + match[3])();
} else {
throw new Error(`Invalid --plugin argument format: ${JSON.stringify(pluginText)}`);
likely benign
LLM, confidence 0.85
Evaluates the plugin argument expression from a user-supplied --plugin CLI flag.
Reasoning
Evaluates the argument portion of a user-supplied --plugin=... CLI value. This is the same documented CLI plugin-argument feature, operating only on the user's own input.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return require(pluginPath);
} catch {
return import(pluginPath);
likely benign
LLM, confidence 0.85
Loads a user-specified plugin module by path via require with an import() fallback.
Reasoning
require(pluginPath) and import(pluginPath) load a plugin named by the user on the CLI, which is the expected plugin-loading mechanism for a bundler. There is no hidden or encoded path.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
} catch {
return import(pluginPath);
}
}
likely benign
LLM, confidence 0.80
A CLI command loader dynamically imports a plugin module from a computed path.
Reasoning
A dynamic import of a computed pluginPath inside a try/catch is the standard way a CLI loads user-configured plugins. The snippet shows no encoded payload, no decoding, and no shell or exec call. The path comes from configuration rather than from an obviously attacker-controlled or hidden source. The risk is real but modest, since loading a plugin is arbitrary code execution by design, so the finding deserves a look at where pluginPath originates.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
}
return (await import(fileUrl.href)).default;
} catch (error_: any) {
if (cannotLoadEsm) {
likely benign
LLM, confidence 0.85
Dynamically imports the rollup configuration file from its resolved file URL.
Reasoning
Dynamically imports the user's rollup config file by file URL. Loading the project's config is core bundler behavior.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
try {
return (await import(pathToFileURL(bundledFileName).href)).default;
} finally {
unlink(bundledFileName).catch(error => console.warn(error?.message || error));
likely benign
LLM, confidence 0.85
Imports the transpiled config bundle from a temp file and cleans it up afterward.
Reasoning
Imports the config file after it has been bundled to a temporary file, then deletes that file in finally. This is the standard handling for TypeScript or ESM config loading.
-
line length 1014 characters (raw pass, confidence 0.50)
ES modules export _live bindings_, not values, so values can be changed after they are initially imported as per [this demo](../repl/index.md?shareable=JTdCJTIyZXhhbXBsZSUyMiUzQW51bGwlMkMlMjJtb2R1bGVzJTIyJTNBJTVCJTdCJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMCU3QiUyMGNvdW50JTJDJTIwaW5jcmVtZW50JTIwJTdEJTIwZnJvbSUyMCcuJTJGaW5jcmVt
-
line length 881 characters (raw pass, confidence 0.50)
By default, when creating multiple chunks, imports of dependencies of entry chunks will be added as empty imports to the entry chunks themselves. [Example](../repl/index.md?shareable=JTdCJTIybW9kdWxlcyUyMiUzQSU1QiU3QiUyMm5hbWUlMjIlM0ElMjJtYWluLmpzJTIyJTJDJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMHZhbHVlJTIwZnJvbSUyMCcuJTJGb3RoZ
-
line length 922 characters (raw pass, confidence 0.50)
Even though Rollup will usually try to maintain exact module execution order when bundling, there are two situations when this is not always the case: code-splitting and external dependencies. The problem is most obvious with external dependencies, see the following [example](../repl/index.md?shareable=JTdCJTIybW9kdWxl
-
line length 1258 characters (raw pass, confidence 0.50)
with the execution order `external` → `polyfill.js` → `main.js`. This is not a problem caused by Rollup putting the `import` at the top of the bundle—imports are always executed first, no matter where they are located in the file. This problem can be solved by creating more chunks: If `polyfill.js` ends up in a d
-
`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
if (query.shareable) {
const rawJson = atob(query.shareable.replace(/_/g, '/').replace(/-/g, '+'));
const json = rawJson[0] === '%' ? decodeURIComponent(rawJson) : rawJson;
const {
likely benign
LLM, confidence 0.80
Base64-decodes a shareable REPL query parameter to restore saved state.
Reasoning
atob decodes a shareable URL parameter (base64url to base64) into a JSON string, which is then parsed to restore REPL state. It does not feed eval or fetch, so this is a plain data-decoding step in the docs site.
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
parameters.shareable = btoa(json).replace(/\//g, '_').replace(/\+/g, '-');
const queryString = Object.keys(parameters)
.map(key => `${key}=${parameters[key]}`)
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
try {
return require(id);
} catch (error) {
if (
likely benign
LLM, confidence 0.85
Loads a native module by a computed identifier, falling back on error.
Reasoning
require(id) inside a try/catch with a fallback is the usual pattern for loading a native binding or optional module by a computed name. Nothing in the snippet suggests a hidden or remote payload.
-
file mixes tab and space indentation (709 tab-indented and 17 space-indented lines) (raw pass, confidence 0.40)
export const AST_NODES = {
PanicError: {
estreeType: "{ type: 'PanicError', message: string }",
fields: [['message', 'String']],
-
command name is a variable (`$LLVM_PROFDATA`) and `LLVM_PROFDATA` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_PROFDATA="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-profdata"
"$LLVM_PROFDATA" merge -sparse coverage/profraw/*.profraw -o coverage/rust.profdata
NODE_FILE="$(ls dist/rollup.*.node)"
likely benign
LLM, confidence 0.85
Runs llvm-profdata located under the Rust toolchain sysroot to merge coverage profiles.
Reasoning
LLVM_PROFDATA is set from rustc's sysroot path and then run as a local build tool to merge coverage data. It is a developer coverage script with no network input or encoded payload.
-
command name is a variable (`$LLVM_COV`) and `LLVM_COV` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_COV="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-cov"
"$LLVM_COV" export \
-instr-profile=coverage/rust.profdata \
-object "$NODE_FILE" \
likely benign
LLM, confidence 0.85
Runs llvm-cov from the Rust toolchain sysroot to export coverage reports.
Reasoning
LLVM_COV is derived from the rustc sysroot and run to export coverage from a locally built binary. This is a standard coverage workflow.
-
file mixes tab and space indentation (86 tab-indented and 39 space-indented lines) (raw pass, confidence 0.40)
const astMacrosFile = new URL(
'../rust/parse_ast/src/convert_ast/converter/ast_macros.rs',
import.meta.url
);
-
file mixes tab and space indentation (150 tab-indented and 38 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node, originalNode }) => {
const definitions = [];
let offset = 0;
-
file mixes tab and space indentation (139 tab-indented and 36 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node, originalNode }) => {
const definitions = [];
let offset = 2;
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
for (const [name, node] of Object.entries(AST_NODES)) {
const astType = node.astType || name;
const keySet = (childNodeKeysByAstType[astType] ||= new Set());
for (const [fieldName, fieldType] of (node.hasSameFieldsAs
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1');
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
dismissed
LLM, confidence 0.90
Generated AMD dynamic-import call in a chunking test fixture.
Reasoning
This is Rollup-generated AMD expected output in a test fixture. The require([...]) calls are the AMD dynamic-import form the bundler emits for those chunks.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
}));
dismissed
LLM, confidence 0.90
Generated AMD dynamic-import call in a chunking test fixture.
Reasoning
Same generated AMD expected-output fixture with a require([...]) call for another chunk. This is the bundler's own output in a test.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(libs.value2);
console.log(new Promise(function (resolve, reject) { require(['./generated-lib1'], resolve, reject); }).then(function (n) { return n.lib3; }).then(m => m.value3));
}));
dismissed
LLM, confidence 0.90
Generated AMD require of a sample chunk in a test expectation file.
Reasoning
Generated AMD expected output in a chunking test. The require call loads a sample chunk, and the file is a snapshot of bundler output rather than attacker code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.93
Rollup test fixture: AMD dynamic import in a base-path concatenation sample.
Reasoning
Rollup-generated AMD dynamic import output in a chunking test fixture, using a literal path. This is standard bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./chunks/generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.93
Rollup test fixture: AMD dynamic import of a chunk under a base path.
Reasoning
Same Rollup-generated AMD dynamic import pattern with a literal chunk path in an expected-output fixture. Nothing indicates obfuscation or malicious intent.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.93
Rollup test fixture: AMD-format dynamic import loading a generated chunk via require.
Reasoning
This is Rollup's generated AMD output for a dynamic import of a literal chunk path inside a chunking test fixture. The flagged require is the AMD loader call that Rollup emits for code splitting, not attacker-controlled code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/logo2.svg').href : new URL('logo2.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
{
likely benign
LLM, confidence 0.85
Rollup test fixture: CJS asset URL helper that requires the url module with a split string.
Reasoning
The require('u' + 'rl') split string is a bundler-generated compatibility shim that picks Node's url module or a browser URL fallback for asset paths. The concatenation is a common bundler artifact, not a deliberate evasion, and the pattern is in an expected-output fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
likely benign
LLM, confidence 0.92
Rollup test fixture: arrow-function AMD dynamic import loader for generated-a.
Reasoning
Rollup-generated AMD dynamic import wrappers with literal chunk paths inside a chunking test fixture. Expected for code splitting.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
console.log(importA, importB);
likely benign
LLM, confidence 0.92
Rollup test fixture: arrow-function AMD dynamic import loader for generated-b.
Reasoning
Second AMD dynamic-import loader with a literal chunk path in the same generated fixture. Standard bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.93
Rollup test fixture: AMD entry chunk dynamically loading a generated chunk.
Reasoning
Rollup-generated AMD dynamic import of a literal chunk path in a deprecated emitFile test fixture. No obfuscation or malicious behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dep1');
new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); });
}));
likely benign
LLM, confidence 0.93
Rollup test fixture: AMD chunk dynamically loading generated-dep2.
Reasoning
Rollup-generated AMD chained dynamic import of a literal chunk path in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.93
Rollup test fixture: AMD main entry dynamically loading generated-dep1.
Reasoning
Rollup-generated AMD dynamic import of a literal chunk path in a chained-import test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function dynamic (num) {
return new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); })
.then(dep2 => {
return dep2.mult(num);
likely benign
LLM, confidence 0.92
Rollup test fixture: AMD helper that dynamically loads generated-dep2 and multiplies a value.
Reasoning
Rollup-generated AMD dynamic import inside a helper function with a literal chunk path, in a chunking test expected output.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import (
'./foo.js');
likely benign
LLM, confidence 0.90
Rollup test source: dynamic import() with interior comments and a literal module path.
Reasoning
A source-level dynamic import with comments inside the parentheses and a literal './foo.js' specifier, from a chunking test. The comments are there to test parser handling, and the specifier is a plain literal, not a hidden payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(dep);
}));
likely benign
LLM, confidence 0.85
Rollup test fixture: AMD dynamic import with a variable specifier wrapped in a namespace helper.
Reasoning
Rollup-generated AMD loader that calls require with a variable argument, the usual form for a dynamic import of a computed path. It sits in a test fixture, and the dynamic path is a test input rather than an attacker-controlled payload.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
likely benign
LLM, confidence 0.93
Expected-output fixture containing a dynamic import with a variable specifier.
Reasoning
This is a Rollup chunking-form test fixture. A bare dynamic import of a variable is the feature under test, and the file is generated expected output in a test directory, not shipped code.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
likely benign
LLM, confidence 0.93
Expected-output ES module with a variable dynamic import.
Reasoning
Same Rollup test fixture pattern: generated ES expected output in a test sample directory exercising dynamic import of a variable specifier.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
likely benign
LLM, confidence 0.93
Test sample source using a dynamic import with a variable specifier.
Reasoning
A test sample source file whose purpose is to exercise dynamic import with a non-literal specifier. The pattern is a normal JavaScript feature with no payload or decoding.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
likely benign
LLM, confidence 0.93
AMD bundler output lazy-loading a chunk via require with a computed module list.
Reasoning
AMD expected output from Rollup's chunking tests. The require call is the AMD loader form for lazy-loading a generated chunk, which is standard bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic$1; }).then(({dynamic}) => console.log('main1', dynamic));
}));
likely benign
LLM, confidence 0.93
AMD expected output loading a generated chunk for a dynamic import.
Reasoning
Rollup test expected output. The AMD require loads a generated dynamic chunk, which is the normal translation of dynamic import into AMD.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(dep2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.dep2 = dep2;
likely benign
LLM, confidence 0.93
AMD test output with a lazy chunk require inside a manual-chunk sample.
Reasoning
Generated AMD expected output in a Rollup test fixture. The require is the standard lazy-chunk loader for a dynamic import.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const inlined = Promise.resolve().then(function () { return inlined$2; });
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.inlined = inlined;
likely benign
LLM, confidence 0.93
AMD expected output with a lazy-loaded separate chunk in an inline-colouring test.
Reasoning
Rollup chunking test expected output. The AMD require loads a separate generated chunk, consistent with bundler code splitting.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.separate = separate;
likely benign
LLM, confidence 0.93
AMD expected output lazy-loading a generated chunk in an inline-colouring sample.
Reasoning
Same Rollup test fixture family. The require loads a generated chunk, the normal AMD output for a dynamic import.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
async function test() {
const dep = await new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); });
console.log(dep.obj.a.a.a);
}
likely benign
LLM, confidence 0.93
AMD expected output awaiting a lazily loaded module in a tree-shaking test.
Reasoning
Rollup test expected output for tree-shaking across awaited dynamic imports. The AMD require is standard chunk loading.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(({ obj }) => {
console.log(obj.a);
});
likely benign
LLM, confidence 0.93
AMD expected output with a then-chained lazy chunk load in a tree-shaking test.
Reasoning
Rollup test expected output for tree-shaking with a then-chained dynamic import. The require loads a generated chunk, which is ordinary bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
likely benign
LLM, confidence 0.93
AMD expected output loading an entry and a generated chunk for dynamic imports.
Reasoning
Rollup test expected output. The AMD require calls load the entry and a generated chunk for dynamic imports, with interop helpers, which is typical bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
likely benign
LLM, confidence 0.93
Second AMD lazy-load call on the same expected-output line in the only-default test.
Reasoning
The same line as the previous finding, with a second AMD require for a generated chunk. This is standard Rollup test output with no payload or evasion.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({ value }) => console.log(value));
}));
likely benign
LLM, confidence 0.93
AMD expected output lazy-loading a generated chunk in a re-export test.
Reasoning
Rollup chunking test expected output. The AMD require loads a generated chunk for a dynamic import that re-exports values.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(({ bar }) => console.log(bar()));
}));
likely benign
LLM, confidence 0.93
AMD expected output lazy-loading a generated chunk in a statically-imported test.
Reasoning
Rollup test expected output where a module is both statically and dynamically imported. The AMD require is normal chunk loading.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./lib'], resolve, reject); }).then(function (n) { return n.lib; }).then(console.log);
}));
dismissed
LLM, confidence 0.93
Rollup-generated AMD loader wrapper for a dynamic import of ./lib in a chunking test fixture.
Reasoning
This is Rollup's expected AMD output for a dynamic import. The AST rule fired on the AMD-style require call, but the specifier is a literal array ['./lib'] and the code is a plain Promise wrapper around the module load. Nothing suggests obfuscation or malicious execution.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module1'], resolve, reject); });
module.foo();
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module1 with a namespace-access test body.
Reasoning
Expected-output fixture from Rollup's test suite. The require array holds a literal relative path, and the body only awaits the module and calls foo(). This is a normal AMD dynamic import pattern.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module2'], resolve, reject); });
const module1 = module;
module1.foo();
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module2 in a namespace test fixture.
Reasoning
Same Rollup fixture pattern: literal './generated-module2' specifier, then ordinary property access on the resolved module. No dynamic code execution or encoding is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module3'], resolve, reject); });
const { foo } = module;
foo();
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module3 with destructuring in a test fixture.
Reasoning
Rollup test fixture. The specifier is a literal string and the destructuring of foo is standard ES module interop test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module4'], resolve, reject); });
const { foo, ...rest } = module;
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module4 with rest destructuring in a test fixture.
Reasoning
Rollup test fixture with a literal module path and rest destructuring. Ordinary code for exercising namespace handling.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module5'], resolve, reject); });
readFoo({ foo: () => {} });
readFoo(module);
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module5 passed to a readFoo test helper.
Reasoning
Rollup test fixture. Literal './generated-module5' specifier, and readFoo is called with an object and the module namespace. Benign test logic.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module6'], resolve, reject); });
function b({ foo }) {
foo();
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module6 with a nested destructured function in a test fixture.
Reasoning
Rollup test fixture with a literal module path and a nested destructuring function. No sign of malicious or obfuscated behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module7'], resolve, reject); });
function b({ foo, ...rest }) {
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module7 with rest destructuring in a test fixture.
Reasoning
Rollup test fixture. The literal './generated-module7' specifier and the rest-destructuring function are standard test patterns.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module8'], resolve, reject); });
function b(o1, ...rest) {
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module8 with rest parameters in a test fixture.
Reasoning
Rollup test fixture with a literal specifier and a function using rest parameters. Ordinary benign test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module9'], resolve, reject); });
function b({ foo = 1 }) {
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module9 with a default destructuring parameter in a test fixture.
Reasoning
Rollup test fixture. Literal './generated-module9' specifier and a default-valued destructuring parameter, which is ordinary ES syntax.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module10'], resolve, reject); });
(module).bar();
(global.unknown && module).foo();
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-module10 with namespace member-access checks in a test fixture.
Reasoning
Rollup test fixture with a literal './generated-module10' specifier. The bar/foo calls and the global.unknown guard are test scaffolding for namespace-tree-shaking behavior, not malicious code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./other'], resolve, reject); }).then(result =>
assert.deepEqual(result, { value: 'shared', extra: 'extra' })
);
likely benign
LLM, confidence 0.93
Rollup test fixture: AMD dynamic import of './other' with a promise chain and assertion.
Reasoning
Rollup-generated AMD dynamic import with a literal path inside a chunking test expected output, followed by a benign assertion.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
exports.promise = promise;
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./generated-dynamic in a facaded-entry test fixture.
Reasoning
Rollup expected output for a facaded entry. The require array holds a literal './generated-dynamic' path, and the code is a standard Promise-wrapped AMD import with a then callback.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(result => console.log('importer', result));
}));
dismissed
LLM, confidence 0.93
Generated AMD dynamic import of ./main in a facaded-entry importer fixture.
Reasoning
Rollup expected output. The literal './main' specifier inside a Promise wrapper is the normal AMD form of a dynamic import, with no obfuscation or execution hazard.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.92
AMD loader call that dynamically imports the './main' chunk inside a test fixture.
Reasoning
This is an AMD-format expected output from a Rollup chunking test. The require call takes an array of module ids and resolve/reject callbacks, which is the standard AMD async loader form. The flagged module is a test fixture, not an obfuscated payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
likely benign
LLM, confidence 0.92
AMD-style dynamic import of './generated-dynamic' in a Rollup test expected-output file.
Reasoning
This is Rollup's generated AMD output for a dynamic import of a sibling chunk, inside a chunking test fixture. The array-form require with resolve and reject is the normal AMD pattern, and nothing in the snippet is hidden or encoded.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.92
AMD loader call importing './main' in a chunking test fixture.
Reasoning
Same AMD dynamic-import wrapper as the other fixture variants, in a Rollup test directory. The specifier is a fixed './main' string inside an array, so the non-literal warning is a false positive from the AMD form.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
likely benign
LLM, confidence 0.92
AMD dynamic import of './generated-dynamic' in a Rollup test expected output.
Reasoning
Rollup's generated AMD dynamic import of a chunk in a test fixture. The require uses the standard array-plus-callbacks form, with no encoding or evasion in the snippet.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.90
AMD require of './main' with namespace interop, in a chunking test fixture.
Reasoning
AMD-format dynamic import generated by Rollup for a test case. The callback wraps the module with an interop helper, which is ordinary module-namespace handling and not malicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('no importer', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.85
CJS fallback that requires the url module to build a file URL for a generated chunk, in a Rollup test fixture.
Reasoning
Rollup's CJS output for import.meta.url-style worker or asset URL resolution. The 'u' + 'rl' split is an artifact of the bundler's code generation for the require('url') call, and the snippet only resolves a local file URL. It is not a dropper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from maim', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.85
CJS URL resolution for generated-lib.js with a browser fallback, in a Rollup test fixture.
Reasoning
Same generated CJS URL-resolution pattern as the other finding in this file. The string split of 'url' is a bundler artifact, and the code only builds a path to a sibling chunk with a browser fallback.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from nested', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib2.js').href : new URL('generated-lib2.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.85
CJS helper building a file URL for generated-lib2.js, in a Rollup test fixture.
Reasoning
Generated CJS URL helper that resolves generated-lib2.js and falls back to document.baseURI in browsers. The code is a standard asset-URL pattern used in Rollup tests and performs no network or execution action.
-
file mixes tab and space indentation (41 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'allows adding additional chunks to be used in workers',
options: {
input: 'main',
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./chunks/nested'], resolve, reject); })
.then(result => result.getWorkerMessage())
.then(message => (document.body.innerHTML += `<h1>2: ${message.data}</h1>`));
likely benign
LLM, confidence 0.90
AMD loader call importing './chunks/nested' in a worker chunking test fixture.
Reasoning
AMD dynamic import of './chunks/nested' followed by a result handler that updates the DOM, in a Rollup worker test fixture. The require form is the standard AMD loader pattern.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker-proxy.js').href : new URL('worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.85
CJS code creating a Worker from a URL to worker-proxy.js, in a Rollup worker test fixture.
Reasoning
Generated CJS code that builds a URL for worker-proxy.js to construct a Worker, with a browser fallback. This is the usual Rollup output for worker asset URLs, and the 'u' + 'rl' split is a generator artifact rather than evasion.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
PLACEHOLDER((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker.js').href : new URL('worker.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.94
Rollup-generated import.meta.url shim that builds a worker file URL in CJS output.
Reasoning
This is Rollup's generated import.meta.url fallback for CJS output. In a Node build it resolves the worker's file path with pathToFileURL(__dirname + '/worker.js'), and in browsers it uses new URL against document.baseURI. The 'u' + 'rl' split only hides the require from bundlers, which is a standard Rollup idiom, and the path is a fixed local file, not attacker-controlled input. This is a test-fixture expected output.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.94
Rollup import.meta.url shim constructing a Worker script URL in CJS output.
Reasoning
Same Rollup import.meta.url polyfill pattern: a Node pathToFileURL branch and a browser URL branch, both resolving a fixed sibling chunk path to build a Worker URL. The string split is Rollup's own convention. Test fixture expected output.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const getWorkerMessage = () => new Promise(resolve => {
const worker = new Worker(new URL('chunks/worker-proxy.js', import.meta.url).href);
worker.onmessage = resolve;
});
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
CSS.paintWorklet.addModule((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worklet.js').href : new URL('chunks/worklet.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.85
A generated test expectation file calls require on a string-concatenated 'url' module name in a worklet URL fallback.
Reasoning
The file is a bundler test fixture under _expected, which is generated output for a Rollup chunking test about emitting worklet chunks. The require('u' + 'rl') split is an artifact of how the test's source was written or transformed, not an evasion technique in a shipped package. The surrounding code is a normal browser-or-Node fallback for resolving a worklet URL and has no payload or execution of decoded content.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./ext\'ernal'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('main', dep.value);
likely benign
LLM, confidence 0.92
AMD require of an external module inside a Rollup emit-chunk test fixture.
Reasoning
AMD dynamic import of an external module in a Rollup emit-file test output. The module id is an escaped quote inside a literal string in an array, and the surrounding code is ordinary module interop.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./entry-deb-amd'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.92
AMD async require loading a sibling module for a dynamic import.
Reasoning
An AMD-style asynchronous require with a literal module id array, wrapped in a Promise. This is standard Rollup AMD code-splitting output for dynamic imports. Test fixture output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.92
AMD loader call that asynchronously loads a split chunk module.
Reasoning
This is an AMD dependency load with a literal relative module id array, which is the normal way AMD loads a code-split chunk. It is not code execution from a computed string. The flag comes from the AMD require form, not a real risk. Test fixture output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
showImage(logo);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.showImage = showImage;
likely benign
LLM, confidence 0.92
AMD async require loading a nested chunk module.
Reasoning
An AMD dependency load with a literal relative id array inside a Promise, the standard shape of Rollup's dynamic import output in AMD format. No computed or attacker-controlled specifier. Test fixture output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo1-FquQRdV3.svg').href : new URL('assets/logo1-FquQRdV3.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.94
Rollup import.meta.url shim resolving an emitted SVG asset URL.
Reasoning
Rollup's import.meta.url shim for an emitted SVG asset: a Node pathToFileURL branch and a browser URL branch resolving a fixed asset path. Standard generated code, no dropper or execution behavior. Test fixture output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/../assets/logo2-DJfvToLT.svg').href : new URL('../assets/logo2-DJfvToLT.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.94
Rollup import.meta.url shim resolving a nested-relative SVG asset URL.
Reasoning
Rollup's import.meta.url fallback resolving a relative asset path with '../' for a nested chunk. Fixed path, no untrusted input. Test fixture output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
renderStart = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/renderStart-B4XObdBk.txt').href : new URL('assets/renderStart-B4XObdBk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).hre
likely benign
LLM, confidence 0.94
Rollup import.meta.url shim resolving an emitted text asset URL.
Reasoning
Rollup's import.meta.url fallback for an emitted text asset, resolving a fixed local path in Node and the document base in browsers. Generated boilerplate, not malicious. Test fixture output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderStartNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderStart.txt').href : new URL('renderStart.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.94
Rollup import.meta.url shim resolving a sibling text asset URL.
Reasoning
Same Rollup import.meta.url shim pattern resolving a fixed sibling text file. No execution or exfiltration. Test fixture output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const bannerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/banner.txt').href : new URL('banner.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.94
Rollup import.meta.url shim resolving a banner text asset URL.
Reasoning
Same Rollup import.meta.url shim resolving a fixed banner.txt asset path in CJS output. Generated boilerplate. Test fixture output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const footerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/footer.txt').href : new URL('footer.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS fallback that loads Node's url module to build a file URL for an emitted asset.
Reasoning
This is Rollup's expected CJS output for an emitted asset URL. The fallback require('u' + 'rl') is a known Rollup codegen pattern that keeps bundlers from resolving the Node url module. The specifier is a constant, and the surrounding code only builds a file URL. It is unusual but matches a legitimate test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const introNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/intro.txt').href : new URL('intro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS fallback building a file URL for intro.txt via require('u' + 'rl').
Reasoning
Same generated pattern as the other emit-file lines: a constant 'u' + 'rl' require producing a file URL for intro.txt. No payload, execution of fetched data, or network activity appears.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const outroNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/outro.txt').href : new URL('outro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS fallback building a file URL for outro.txt.
Reasoning
Same generated pattern: a constant require of the url module with a fixed asset filename. Nothing in the snippet is dangerous.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderChunkNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderChunk.txt').href : new URL('renderChunk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS fallback building a file URL for renderChunk.txt.
Reasoning
Same generated pattern with a fixed renderChunk.txt filename. No malicious behavior is visible.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const generateBundleNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generateBundle.txt').href : new URL('generateBundle.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Generated CJS fallback building a file URL for generateBundle.txt.
Reasoning
Same generated pattern with a fixed generateBundle.txt filename. No malicious behavior is visible.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.90
AMD dynamic require of a sibling generated module, used for a Promise-based import.
Reasoning
This is an AMD-style require with a literal relative path array inside a Rollup test fixture's expected output. It is the standard AMD dynamic-import form, and the flag is a false positive from the AST rule on non-literal specifier checks.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(console.log);
}));
likely benign
LLM, confidence 0.90
AMD dynamic require of ./generated-dep1 inside a Promise chain.
Reasoning
Standard AMD dynamic require with a literal relative module path in a test expected-output file. Nothing suspicious is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['./generated-dep1'], resolve, reject)).then(n => n.dep1).then(console.log);
}));
likely benign
LLM, confidence 0.90
AMD dynamic require of ./generated-dep1 using arrow functions.
Reasoning
Same AMD dynamic require pattern with an arrow function wrapper. Literal relative path, benign test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
likely benign
LLM, confidence 0.90
AMD dynamic require of ./generated-dynamicDep in a generated dependency chunk.
Reasoning
AMD dynamic require with a literal relative module path in a bundler test fixture. No payload or dangerous sink is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
exports.value = value;
likely benign
LLM, confidence 0.90
AMD dynamic require of ./generated-dynamicDep in a generated dependency chunk.
Reasoning
Same AMD dynamic require with a literal relative path in a Rollup expected-output fixture. Benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
likely benign
LLM, confidence 0.90
AMD dynamic require of ./generated-dynamicDep in a generated dependency chunk.
Reasoning
Same AMD dynamic require with a literal relative path in a bundler test fixture. Benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-lib'], resolve, reject); }).then(function (n) { return n.lib; });
}));
likely benign
LLM, confidence 0.90
AMD dynamic require of ./generated-lib with a Promise chain.
Reasoning
AMD dynamic require of a literal relative module with a Promise wrapper, from a chunking test's expected output. Benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const url = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('0/1/nested.js', document.baseURI).href));
exports.url = url;
likely benign
LLM, confidence 0.90
Rollup-generated CJS shim that loads Node's url module to resolve import.meta.url.
Reasoning
This is Rollup's generated CJS output for import.meta.url. The require('u' + 'rl') call concatenates two literals to get the Node url module, a known pattern that keeps bundlers from rewriting the require. It is a test fixture, not a dropper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
log('main: ' + new URL(module.uri, document.baseURI).href);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.log = log;
likely benign
LLM, confidence 0.92
AMD dynamic import of a nested chunk in a Rollup test fixture.
Reasoning
This is an AMD-style require with an array of module ids and resolve/reject callbacks, the standard AMD dynamic-loading form. The specifier is a literal inside an array, so the flag is a false positive on a test expected-output file.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log('main: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('main.js', document.baseURI).href)));
likely benign
LLM, confidence 0.90
Rollup CJS import.meta.url polyfill that switches between Node file URLs and browser document URLs.
Reasoning
Same Rollup import.meta.url shim: require('u' + 'rl') resolves to the Node url module, and the rest is a document/URL fallback for browsers. Standard generated code in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
main.log('nested: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('nested/chunk.js', document.baseURI).href)));
likely benign
LLM, confidence 0.90
Rollup-generated import.meta.url shim in a nested CJS chunk.
Reasoning
Identical generated import.meta.url shim in a nested chunk. The string-concatenated module name is a known Rollup idiom, and the file is a test expected output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.shared = shared;
likely benign
LLM, confidence 0.92
AMD dynamic chunk load in a Rollup chained-dynamic test fixture.
Reasoning
AMD require with a literal array of module ids and resolve/reject callbacks, which is the normal AMD dynamic-chunk loading form in generated test output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
likely benign
LLM, confidence 0.92
AMD dynamic import of another generated chunk in a circular-import test fixture.
Reasoning
Standard AMD dynamic require with a literal module id array, used to test circular dynamic imports. Benign generated output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); });
console.log('dynamic2');
likely benign
LLM, confidence 0.92
AMD dynamic import creating a circular reference to main in a test fixture.
Reasoning
AMD require with a literal array id that points back to main, a deliberate circular import in the test. Benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.92
AMD main entry dynamically loading two generated chunks in a circular-import fixture.
Reasoning
AMD require with a literal array of ids in the test's main entry. Standard generated loader code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.92
Second AMD dynamic chunk load in the circular-import test's main entry.
Reasoning
Second AMD dynamic require in the same main file, again with literal ids. Benign generated test output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
likely benign
LLM, confidence 0.92
AMD dynamic load of generated-dynamic2 in a cut-off chunking test fixture.
Reasoning
AMD require with a literal array id inside a Rollup cut-off chunking test. The code is normal chunk-loading output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.92
AMD dynamic load of generated-dynamic1 from a cut-off test entry.
Reasoning
AMD require with a literal array id in a chunking test entry. Standard generated loader code, not malicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.92
AMD dynamic load from a second cut-off test entry.
Reasoning
AMD require with a literal array id, same pattern as the other cut-off outputs. Benign test expected output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.85
AMD-style dynamic require of a generated chunk in a bundler test fixture.
Reasoning
This is Rollup test expected output for AMD dynamic import. The require call with an array literal of a relative module path is standard AMD loader syntax, not an obfuscated or malicious dropper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.85
AMD dynamic require of a generated chunk in a test fixture.
Reasoning
Identical AMD dynamic require pattern in a bundler test fixture; the specifier is a fixed relative path.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value = value;
likely benign
LLM, confidence 0.85
Generated AMD chunk requiring another generated chunk.
Reasoning
Bundler-generated AMD chunk in test expected output; the require targets a fixed sibling chunk path, which is normal code-splitting.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.85
AMD dynamic require of a generated chunk in a test fixture.
Reasoning
Standard AMD dynamic loading of a fixed chunk path in a bundler test fixture.
-
18 of 35 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
18 of 32 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
16 of 30 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
24 of 38 non-conventional identifiers are single-character (63%) (token pass, confidence 0.50)
-
24 of 53 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (3 tab-indented and 31 space-indented lines) (raw pass, confidence 0.40)
var num = 2;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
var num = 1;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
var num = 3;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (7 tab-indented and 31 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function (exports, module) {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (13 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-C9ddpexS.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
file mixes tab and space indentation (13 tab-indented and 43 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-C9ddpexS.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
line length 1540 characters (raw pass, confidence 0.50)
export { lazy, v1, v10, v100, v101, v102, v103, v104, v105, v106, v107, v108, v109, v11, v110, v111, v112, v113, v114, v115, v116, v117, v118, v119, v12, v120, v121, v122, v123, v124, v125, v126, v127, v128, v129, v13, v130, v131, v132, v133, v134, v135, v136, v137, v138, v139, v14, v140, v141, v142, v143, v144, v145,
-
file mixes tab and space indentation (8 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
spawnArgs: ['--config'],
env: { FORCE_COLOR: undefined, NO_COLOR: true },
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'displays logs',
skipIfWindows: true,
spawnArgs: ['--config'],
-
21 of 48 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
23 of 52 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (43 tab-indented and 21 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'immediately reloads the config file if a change happens while it is parsed',
spawnArgs: ['-cw'],
before() {
-
file mixes tab and space indentation (42 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'keeps watching the config file in case the config is changed to an invalid state',
spawnArgs: ['-cw'],
before() {
-
mean non-conventional identifier length 1.95 over 21 names (token pass, confidence 0.50)
-
line length 1453 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopName
-
line length 1429 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&
-
line length 629 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1342 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e)}function _interopName
-
line length 576 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:function(){return defaultCompat.foo}});Object.keys(defaultCompat).forEach(function(k){i
-
line length 1063 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[fu
-
line length 1948 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 1361 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&
-
line length 1337 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'d
-
line length 596 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1250 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e);var _interopNamespaceDefaultOnly=e=>Object.fr
-
line length 538 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:()=>defaultCompat.foo});Object.keys(defaultCompat).forEach(k=>{if(k!=='default'&&!Objec
-
line length 992 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[()
-
line length 1844 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 1153 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1187 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1084 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 722 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module["function"];exports({bar:module["function"],default:module,void:module["default"]});},function(module){defaultOnly=module
-
line length 1455 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
line length 1150 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1184 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1081 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 710 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module.function;exports({bar:module.function,default:module,void:module.default});},function(module){defaultOnly=module;},functi
-
line length 1452 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
20 of 46 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 15 space-indented lines) (raw pass, confidence 0.40)
console.log(
<div>
Hello
World
-
file mixes tab and space indentation (54 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
options: {
experimentalLogSideEffects: true,
-
mean non-conventional identifier length 1.97 over 59 names (token pass, confidence 0.50)
-
24 of 46 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
-
18 of 45 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
line length 785 characters (raw pass, confidence 0.50)
define(['require','exports','external1','external2'],(function(require,exports,external1,external2){'use strict';function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m
-
line length 740 characters (raw pass, confidence 0.50)
'use strict';var external1=require('external1'),external2=require('external2');function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = Promise.resolve().then(function(){return _interopNamespaceDefault(require('exte
-
line length 550 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external1,external2){'use strict';const dynamic = import('external3');exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Object.defineProperty(exports,'__proto
-
line length 811 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external1'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external1','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bundle={},g.external1,g.external2));})(this,(function(
-
23 of 32 non-conventional identifiers are single-character (72%) (token pass, confidence 0.50)
-
18 of 37 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
20 of 39 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
40 of 71 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
40 of 68 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
36 of 61 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
40 of 74 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
-
32 of 67 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
40 of 95 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
32 of 60 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
{
console.log('code21');
}
keep1() ; keep2();
-
mean non-conventional identifier length 1.62 over 45 names (token pass, confidence 0.50)
-
mean non-conventional identifier length 1.74 over 92 names (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
25 of 49 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
22 of 39 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
25 of 55 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
19 of 39 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (19 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
console.log(2); console.log(2);
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (11 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function () {
'use strict';
var a = '1\
-
file mixes tab and space indentation (15 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function () {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (12 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function (factory) {
typeof define === 'function' && define.amd ? define(factory) :
factory();
})((function () { 'use strict';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (3 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
class MyClass extends ExternalElement {
constructor() {
super();
console.log('MyClassExtendsExternalClass');
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
return Function('return require("' + name + '")')();
} catch (error) { }
}
likely benign
LLM, confidence 0.80
core-js global-detection helper using Function constructor with a require string.
Reasoning
This is core-js polyfill code that uses Function to obtain a global object, with an explicit eslint-disable comment marking it safe. The body is a string built from a name, which is a known polyfill idiom and not evidence of a dropper in this context.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
validateArgumentsLength(arguments.length, 1);
var fn = isCallable(handler) ? handler : Function(handler);
var args = arraySlice(arguments, 1);
queue[++counter] = function () {
likely benign
LLM, confidence 0.80
core-js setTimeout polyfill compiling a string handler via Function.
Reasoning
core-js timers polyfill: Function(handler) mirrors the legacy setTimeout string-handler spec behavior. Standard library code in a test expected output, not malicious.
-
orphaned high surrogate \uD842 (no matching low surrogate) (token pass, confidence 0.65)
return '𠮷'.at(-2) !== '\uD842';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
var boundArgs = validateArgumentsLength(arguments.length, 1) > firstParamIndex;
var fn = isCallable(handler) ? handler : Function(handler);
var params = boundArgs ? arraySlice(arguments, firstParamIndex) : [];
var callback = boundArgs ? function () {
likely benign
LLM, confidence 0.80
core-js timer polyfill compiling a string handler via Function.
Reasoning
Same core-js timers polyfill pattern for setInterval/setTimeout string handlers; legitimate legacy-spec emulation in test output.
-
line length 1121 characters (raw pass, confidence 0.50)
var isCallable; var fnToStr = Function.prototype.toString, constructorRegex = /^\s*class /, isES6ClassFn = function isES6ClassFn(value) { try { var fnStr = fnToStr.call(value); var singleStripped = fnStr.replace(/\/\/.*\n/g, ''); var multiStripped = singleStripped.
-
file mixes tab and space indentation (23 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'synthetic named exports',
options: {
plugins: [
-
30 of 57 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
78 of 143 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
28 of 67 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
24 of 57 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
30 of 72 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (116 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
function _mergeNamespaces(n, m) {
m.forEach(function (e) {
e && typeof e !== 'string' && !Array.isArray(e) && Object.keys(e).forEach(function (k) {
if (k !== 'default' && !(k in n)) {
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose')};
}
-
file mixes tab and space indentation (2 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose'),
[Symbol.asyncDispose]: () => console.log('asyncDispose'),
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
try {
const function_ = new Function(contextKeys, code);
function_.apply({}, contextValues);
} catch (error) {
likely benign
LLM, confidence 0.80
Test runner evaluating code samples with new Function.
Reasoning
Test harness that constructs a Function from context keys and code strings to evaluate test snippets. This is a deliberate test runner mechanism in a repository test file, not an attack.
-
file mixes tab and space indentation (19 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'should provide json hint when importing a no export json file',
error: {
binding: 'default',
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function getFoo() {
return foo;
}
-
16 of 33 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (40 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles circular reexports',
exports(exports) {
assert.strictEqual(exports.exists, 42);
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function Bar () {
this.inheritsFromBaz = this.isBaz;
}
-
19 of 47 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
17 of 31 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (12 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.finally(() => {
finallyCalled = true;
})
-
file mixes tab and space indentation (10 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.then(() => {
const obj = {
value: false,
-
file mixes tab and space indentation (20 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'Throw descriptive error message for used export is not defined',
error: {
binding: 'foo',
-
file mixes tab and space indentation (47 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'warns for conflicting import attributes',
options: {
external: id => id.startsWith('external')
-
`eval` called with a non-literal expression (ast pass, confidence 0.75)
import 'external';
eval(this);
likely benign
LLM, confidence 0.80
Test sample calling eval on this within a logging plugin test.
Reasoning
A sample input in a bundler test that calls eval(this) to exercise logging behavior; it is a test fixture and the eval target is the module's own this, with no network or payload behavior.
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
if (!b.fromExternal) {
throw new Error('External export not included');
}
-
36 of 58 non-conventional identifiers are single-character (62%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (5 tab-indented and 4 space-indented lines) (raw pass, confidence 0.40)
export const awaitable = async (iterable) => {
for await (const value of iterable) {
}
}
-
file mixes tab and space indentation (26 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
function test1() {
return true ?
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
const switchSubmit = state => {
if (state == 1) {
assert.ok(false);
} else if (state == 0) {
-
file mixes tab and space indentation (34 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles when a low resolution sourcemap is used to report an error',
options: {
plugins: [
-
file mixes tab and space indentation (565 tab-indented and 9 space-indented lines) (raw pass, confidence 0.40)
describe('incremental', () => {
let resolveIdCalls;
let transformCalls;
let modules;
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
globals,
likely benign
LLM, confidence 0.80
Test helper executing bundled IIFE output via Function constructor.
Reasoning
Test helper that wraps bundled code in a Function with controlled globals to check output execution. Expected in a bundler test suite.
-
file mixes tab and space indentation (462 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
describe('misc', () => {
it('avoids modification of options or their properties', () => {
const { freeze } = Object;
return rollup.rollup(
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
assert.doesNotThrow(() => new Function(umdCode), 'UMD output should be valid JavaScript');
});
likely benign
LLM, confidence 0.80
Test checking UMD output validity via new Function.
Reasoning
Test asserting UMD output parses by constructing a Function from the code; the comment explicitly describes this verification purpose.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
thisValue,
likely benign
LLM, confidence 0.80
Test helper running UMD output via Function constructor.
Reasoning
Test helper executing UMD bundle output with supplied globals via Function constructor, consistent with a bundler test suite.
-
file mixes tab and space indentation (64 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
export function App() {
return <div>{'.'}</div>;
}
`;
-
file mixes tab and space indentation (70 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
export function App() {
if (count) {
console.log(count);
}
-
base64-like blob (272 bytes, compression ratio 0.74) (in comment) (raw pass, confidence 0.36)
-
file mixes tab and space indentation (64 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
console.log(
this + 2
)
`;
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io