Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', dep.value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', fromMain1AndDynamic.value1, fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = fromMain1AndDynamic.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = fromMain1And2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep1.value1, dep2.value2, something);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = dep1.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', value1, dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('a', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main', value);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = Promise.all([new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-d'], resolve, reject); })]).then(() => {
assert.strictEqual(globalThis.xLoaded, true);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = Promise.all([new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-d'], resolve, reject); })]).then(() => {
assert.strictEqual(globalThis.xLoaded, true);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-m'], resolve, reject); }).then(m => console.log(m, DEP));
exports.DEP = DEP;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(n => console.log(n.a));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.mB; }).then(m => console.log(m.MB, m.OTHER, X));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.mB; }).then(n => console.log(n.b, manual.a));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.all([new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.all([new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.all([new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({DYNAMIC_USED_BY_A}) => console.log(DYNAMIC_USED_BY_A));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-x'], resolve, reject); }).then(n => console.log(n.x, manual.m));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.x; }).then(n => console.log(n.x, manual.m));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
console.log('dynamic2');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
console.log('dynamic3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic5'], resolve, reject); });
console.log('dynamic4');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.shared = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log(result.default));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
return _default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(lib__namespace);
new Promise(function (resolve, reject) { require(['./lib'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
exports.lib = lib__namespace;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-included'], resolve, reject); }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
exports.default = _default.default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra = { with: { type: 'json' } };
import(specifier, extra);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./chain-2.js');
import(somethingElse);
import('external-module');
import('./imports-external.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./imported-via-special-handler.js');
import(someVariable);
import(someResolvedVariable);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(someVariable);
import(someResolvedVariable);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('existing');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('dynamic-direct-external' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-dynamic-indirect-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
Promise.resolve().then(function () { return existing; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('my' + 'replacement');
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
assetString = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt').href : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const assetObject = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt') : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./nested/chunk2'], resolve, reject); }).then(result => console.log(result, chunk$1, chunk, asset$1, asset));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const asset = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.bas
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const chunk = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/nested/chunk.js').href : new URL('nested/chunk.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy = new Promise(function (resolve, reject) { require(['./generated-lazy'], resolve, reject); });
exports.lazy = lazy;
-
line length 3070 characters (raw pass, confidence 0.65)
v272; exports({ v1: v1, v2: v2, v3: v3, v4: v4, v5: v5, v6: v6, v7: v7, v8: v8, v9: v9, v10: v10, v11: v11, v12: v12, v13: v13, v14: v14, v15: v15, v16: v16, v17: v17, v18: v18, v19: v19, v20: v20, v21: v21, v22: v22, v23: v23, v24: v24, v25: v25, v26: v26, v27: v27, v28: v28, v29: v29, v30: v30, v31: v31, v32: v32
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy1 = new Promise(function (resolve, reject) { require(['./generated-foo_20bar'], resolve, reject); });
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
exports.lazy1 = lazy1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-first'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(function (n) { return n.dep; }).then(({ foo, bar, baz }) => console.log(foo, bar, baz));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset3 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.base
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SC
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 0;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 1;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 0;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
function nested1() {
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 1;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return new Promise((resolve, reject) => require([this.outputPath], m => resolve(_interopNamespaceDefault(m)), reject));
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return Promise.resolve().then(() => _interopNamespaceDefault(require(this.outputPath)));
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return Promise.resolve().then(function () { return _interopNamespaceDefault(require(t)); }); })(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`My ${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./seven'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
import('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
logoReverse = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseUR
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.curren
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset1 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset99 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function(c,e){require(['external'],function(m){c(_interopNamespaceCompat(m))},e)}).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((c,e)=>require(['external'],m=>c(_interopNamespaceCompat(m)),e)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceCompat(m)); }, reject); }).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['external'], m => resolve(_interopNamespaceCompat(m)), reject)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra5 = { with: { type: 'json' } };
import(specifier5, extra5);
const extra6 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra6 = { with: { type: 'json' } };
import(specifier6, { with: extra6.with });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('a', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special', extra: 'value' } });
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(join('a', 'b'));
console.log(join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(pathJoin('a', 'b'));
console.log(pathJoin);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external2).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
})(externalauto, externaldefault, externaldefaultOnly, externalesModule);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
eeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m){c(_interopNamespaceDefault(m))},e)});exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Obj
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const dynamic = new Promise(function (resolve, reject) { require(['external3'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.external1 = external1.external1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['https://unpkg.com/foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(({ default: foo }) => assert.equal(foo, 42));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const someDynamicImport = () => new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.someDynamicImport = someDynamicImport;
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
console.log(undefined);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(undefined);
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return code === undefined
? require(importee)
: (exportsMap[outputId] = requireWithContext(
code,
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
export default import('x/' + 'y');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'other') return 17;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
export const path = import('path');
export const pathAgain = import(thePath);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import.source(dynamic).then(console.log)
-
base64-like blob (184 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
module.exports = main;
`
);
-
U+FEFF ZERO WIDTH NO-BREAK SPACE (BOM) in source (raw pass, confidence 0.75)
⟨U+FEFF⟩⟨U+FEFF⟩export const msg = 'foo';
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const configFile = path.join(directory, '_config.js');
const config = require(configFile);
if (!config || !config.description) {
throw new Error(`Found invalid config without description: ${configFile}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
delete require.cache[resolved];
return require(resolved);
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-6Pt_L0T6'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-Bx2VuOb-'], resolve, reject); });
likely benign
LLM, confidence 0.90
Generated AMD require of hashed dynamic chunk names in a sourcemap test.
Reasoning
Expected output for a sourcemap file-naming test. The require targets hashed local chunk names, which is ordinary bundler output for dynamic imports.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-6Pt_L0T6'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-Bx2VuOb-'], resolve, reject); });
}));
likely benign
LLM, confidence 0.90
Generated AMD require of a second hashed dynamic chunk in a sourcemap test.
Reasoning
Same generated AMD dynamic-import pattern for a hashed local chunk; typical bundler output in a test fixture.
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
line length 1489 characters (raw pass, confidence 0.50)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
-
line length 2244 characters (raw pass, confidence 0.65)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
dismissed
LLM, confidence 0.97
Long line of sponsor badge HTML in the README.
Reasoning
A 2244-character line made of sponsor badge HTML anchors and images in a README is a typical markdown pattern with no obfuscation or malicious content. The raw long-line signal is a known false-positive class.
-
file mixes tab and space indentation (17 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function generateBanner(commitHash: string, version: string): string {
const date = new Date(
env.SOURCE_DATE_EPOCH ? 1000 * +env.SOURCE_DATE_EPOCH : Date.now()
).toUTCString();
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
plugin = new Function('return ' + pluginText);
} else {
const match = pluginText.match(/^([\w./:@\\^{|}-]+)(=(.*))?$/);
likely benign
LLM, confidence 0.80
Rollup CLI evaluates a user-provided --plugin expression as a function body.
Reasoning
This evaluates the text of a user-supplied CLI --plugin argument with new Function. That is intentional in a bundler CLI, where the operator supplies the input, so it is not a hidden payload. It is still dynamic code evaluation of an argument, which is worth noting.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
pluginText = match[1];
pluginArgument = new Function('return ' + match[3])();
} else {
throw new Error(`Invalid --plugin argument format: ${JSON.stringify(pluginText)}`);
likely benign
LLM, confidence 0.80
Rollup CLI evaluates the argument of a --plugin option via new Function.
Reasoning
The same CLI plugin-argument path evaluates the user's --plugin argument value. It is operator-supplied input in a developer tool, not attacker-controlled data in a package.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return require(pluginPath);
} catch {
return import(pluginPath);
likely benign
LLM, confidence 0.85
Plugin loader requires or imports a user-specified plugin path.
Reasoning
The fallback loads a plugin by path, first with require and then with import, where the path comes from the user's configuration or CLI. This is the expected plugin-loading mechanism for a bundler.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
} catch {
return import(pluginPath);
}
}
likely benign
LLM, confidence 0.88
Dynamic import fallback for loading a user plugin module.
Reasoning
This is the import fallback of the same plugin loader, used to load user-specified plugin modules. No hidden or obfuscated behavior is shown.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
}
return (await import(fileUrl.href)).default;
} catch (error_: any) {
if (cannotLoadEsm) {
likely benign
LLM, confidence 0.88
Dynamic import of the user's rollup config file as an ESM module.
Reasoning
This imports the rollup config file the user has pointed to, which is the documented config-loading behavior. The specifier is a file URL derived from the config path.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
try {
return (await import(pathToFileURL(bundledFileName).href)).default;
} finally {
unlink(bundledFileName).catch(error => console.warn(error?.message || error));
likely benign
LLM, confidence 0.88
Imports a bundled temporary config file, then unlinks it.
Reasoning
This imports a temporarily bundled version of the user's config file and deletes it afterwards. This is the standard config-bundling workflow.
-
line length 1014 characters (raw pass, confidence 0.50)
ES modules export _live bindings_, not values, so values can be changed after they are initially imported as per [this demo](../repl/index.md?shareable=JTdCJTIyZXhhbXBsZSUyMiUzQW51bGwlMkMlMjJtb2R1bGVzJTIyJTNBJTVCJTdCJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMCU3QiUyMGNvdW50JTJDJTIwaW5jcmVtZW50JTIwJTdEJTIwZnJvbSUyMCcuJTJGaW5jcmVt
-
line length 881 characters (raw pass, confidence 0.50)
By default, when creating multiple chunks, imports of dependencies of entry chunks will be added as empty imports to the entry chunks themselves. [Example](../repl/index.md?shareable=JTdCJTIybW9kdWxlcyUyMiUzQSU1QiU3QiUyMm5hbWUlMjIlM0ElMjJtYWluLmpzJTIyJTJDJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMHZhbHVlJTIwZnJvbSUyMCcuJTJGb3RoZ
-
line length 922 characters (raw pass, confidence 0.50)
Even though Rollup will usually try to maintain exact module execution order when bundling, there are two situations when this is not always the case: code-splitting and external dependencies. The problem is most obvious with external dependencies, see the following [example](../repl/index.md?shareable=JTdCJTIybW9kdWxl
-
line length 1258 characters (raw pass, confidence 0.50)
with the execution order `external` → `polyfill.js` → `main.js`. This is not a problem caused by Rollup putting the `import` at the top of the bundle—imports are always executed first, no matter where they are located in the file. This problem can be solved by creating more chunks: If `polyfill.js` ends up in a d
-
`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
if (query.shareable) {
const rawJson = atob(query.shareable.replace(/_/g, '/').replace(/-/g, '+'));
const json = rawJson[0] === '%' ? decodeURIComponent(rawJson) : rawJson;
const {
likely benign
LLM, confidence 0.90
Decodes a shareable REPL state from base64 in a URL parameter.
Reasoning
atob decodes a base64url-encoded shareable REPL state from a query parameter, then parses it as JSON or URI-encoded text. It is data decoding for a documentation REPL, not code execution.
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
parameters.shareable = btoa(json).replace(/\//g, '_').replace(/\+/g, '-');
const queryString = Object.keys(parameters)
.map(key => `${key}=${parameters[key]}`)
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
try {
return require(id);
} catch (error) {
if (
likely benign
LLM, confidence 0.85
Loads a native binding module by id with a try/catch fallback.
Reasoning
This is the standard fallback that loads the native binding by id with require inside a try/catch, which is a common pattern in native-binding loaders. The id is a fixed module name, not attacker input.
-
file mixes tab and space indentation (1042 tab-indented and 17 space-indented lines) (raw pass, confidence 0.40)
export type AstNodeName =
| 'PanicError'
| 'ParseError'
| 'ArrayExpression'
-
command name is a variable (`$LLVM_PROFDATA`) and `LLVM_PROFDATA` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_PROFDATA="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-profdata"
"$LLVM_PROFDATA" merge -sparse coverage/profraw/*.profraw -o coverage/rust.profdata
NODE_FILE="$(ls dist/rollup.*.node)"
likely benign
LLM, confidence 0.85
Coverage script runs llvm-profdata located via the rustc sysroot.
Reasoning
The command path is derived from rustc's sysroot and the llvm-profdata location inside the Rust toolchain. This is a standard build-script pattern for coverage tooling.
-
command name is a variable (`$LLVM_COV`) and `LLVM_COV` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_COV="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-cov"
"$LLVM_COV" export \
-instr-profile=coverage/rust.profdata \
-object "$NODE_FILE" \
likely benign
LLM, confidence 0.85
Coverage script runs llvm-cov from the rustc sysroot.
Reasoning
The llvm-cov command is found the same way, through the rustc sysroot, and is used to export coverage from a local build. Nothing in the snippet is malicious.
-
file mixes tab and space indentation (81 tab-indented and 45 space-indented lines) (raw pass, confidence 0.40)
const astMacrosFile = new URL(
'../rust/parse_ast/src/convert_ast/converter/ast_macros.rs',
import.meta.url
);
-
file mixes tab and space indentation (151 tab-indented and 38 space-indented lines) (raw pass, confidence 0.40)
interface AstTypeDescription {
fields: FieldDescription[];
flags?: string[];
index: number;
-
file mixes tab and space indentation (71 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
function getFieldType(field: FieldDescription, node: NodeDescription): string {
switch (field.type) {
case 'Node': {
const baseType = field.nodeTypes.join(' | ');
-
file mixes tab and space indentation (155 tab-indented and 37 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node, originalNode }) => {
const definitions: string[] = [];
let offset = 0;
let needsBuffer = false;
-
file mixes tab and space indentation (115 tab-indented and 36 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node }) => {
const definitions: string[] = [];
let offset = 2;
if (node.flags) {
-
file mixes tab and space indentation (119 tab-indented and 37 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node }) => {
const definitions: string[] = [];
let offset = 2;
if (node.flags) {
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
for (const [name, node] of Object.entries(AST_NODES)) {
const astType = node.astType || name;
const keySet = (childNodeKeysByAstType[astType] ||= new Set());
for (const { name: fieldName, type: fieldType } of (node.hasSameFieldsAs
-
file mixes tab and space indentation (6 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
for (const [index, { name, node }] of astNodeNamesWithFieldOrder.entries()) {
const astType = node.astType || name;
const ids = (nodeIdsByAstType[astType] ||= []);
ids.push(index);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
process.chdir(workspace.repoPath);
await import(workspace.scriptPath('prepublish.ts'));
}
likely benign
LLM, confidence 0.92
Test imports the repo's prepublish script from a workspace path.
Reasoning
This test imports a repository script at a path built from a fixed workspace helper. It is a test harness loading a local script.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
process.chdir(workspace.repoPath);
const { default: publishWasmNodePackage } = await import(
workspace.scriptPath('publish-wasm-node-package.ts')
);
likely benign
LLM, confidence 0.92
Test dynamically imports the repo's wasm publish script.
Reasoning
This test dynamically imports a repository build script through a workspace helper. It is ordinary test setup in a build repo.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1');
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
dismissed
LLM, confidence 0.95
Generated AMD test fixture calling require with dependency arrays.
Reasoning
This is a generated AMD expected-output fixture for a chunking test, where require takes an array of module ids and callbacks. It is a test artifact, not executed hostile code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
}));
likely benign
LLM, confidence 0.93
Rollup-generated AMD dynamic import loading a sibling chunk in a test fixture.
Reasoning
This is Rollup's own generated AMD output for dynamic imports in a chunking-form test fixture. The require call with an array of literal chunk paths is the standard AMD async loader pattern. The specifier is an array, so the scanner flags it as non-literal, but the content is benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(libs.value2);
console.log(new Promise(function (resolve, reject) { require(['./generated-lib1'], resolve, reject); }).then(function (n) { return n.lib3; }).then(m => m.value3));
}));
likely benign
LLM, confidence 0.93
Rollup-generated AMD dynamic import of a library chunk in a test fixture.
Reasoning
Generated AMD output from Rollup's test suite, loading a literal chunk path via require with resolve/reject callbacks. This is a normal dynamic import transform.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.93
Rollup-generated AMD lazy loader in a test fixture.
Reasoning
Standard Rollup AMD dynamic import output in a test expected-results file. Nothing obfuscated or malicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./chunks/generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.93
Rollup-generated AMD lazy loader with a base-path chunk reference.
Reasoning
Standard Rollup AMD dynamic import output with a literal relative chunk path in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.93
Rollup-generated AMD lazy loader for a chunk in a test fixture.
Reasoning
Standard Rollup AMD dynamic import output in a test expected-results directory. Literal chunk path, no obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/logo2.svg').href : new URL('logo2.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
{
likely benign
LLM, confidence 0.90
Rollup-generated CJS asset URL helper with a split 'url' module require guarded by an environment check.
Reasoning
Rollup test output. The require('u' + 'rl') is a split string for a Node-only branch guarded by a typeof document check, a common bundler pattern for isomorphic code. It loads the built-in url module and is not an attack, though the string split is worth a note.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
likely benign
LLM, confidence 0.93
Rollup-generated AMD dynamic importer for chunk a.
Reasoning
Rollup-generated AMD dynamic import for a literal chunk path inside a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
console.log(importA, importB);
likely benign
LLM, confidence 0.93
Rollup-generated AMD dynamic importer for chunk b.
Reasoning
Rollup-generated AMD dynamic importer for chunk b with a literal path in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.93
Rollup-generated AMD dynamic import in a deprecated emit-file test.
Reasoning
Rollup AMD dynamic import output for a chunk in a deprecated-API test fixture. Literal path, no malicious content.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dep1');
new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); });
}));
likely benign
LLM, confidence 0.93
Rollup-generated AMD chained dynamic import in a test fixture.
Reasoning
Chained dynamic import test output from Rollup; a literal chunk reference with no encoding or execution risk.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.93
Rollup-generated AMD chained dynamic import in a test fixture.
Reasoning
Chained dynamic import test output from Rollup with a literal chunk path. No malicious indicators.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function dynamic (num) {
return new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); })
.then(dep2 => {
return dep2.mult(num);
likely benign
LLM, confidence 0.93
Rollup-generated AMD dynamic-import wrapper in a chunking test fixture.
Reasoning
Rollup-generated AMD dynamic import in a chunking test expected-output file, with a literal dependency path and a normal promise chain.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import (
'./foo.js');
dismissed
LLM, confidence 0.93
Test fixture for dynamic import with comments inside the call expression.
Reasoning
This is a rollup chunking test sample that exercises comments inside a dynamic import() call. The specifier is a string literal with comments around it, so the flag is a false positive from the non-literal check and there is no obfuscation or malicious behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(dep);
}));
dismissed
LLM, confidence 0.94
Rollup-generated AMD wrapper that lazily requires a dynamically named module.
Reasoning
This is bundler-generated AMD output in a chunking test directory. The require([t]) wrapper is the standard lowering of a dynamic import of a variable specifier, which is expected compiler output rather than a dropper or obfuscation.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
dismissed
LLM, confidence 0.94
Expected CJS-format fixture containing a dynamic import with a variable specifier.
Reasoning
This is an expected-output fixture for a rollup test of dynamic imports. The import(dep) call is an ordinary variable-specifier dynamic import in a sample bundle, with no sign of hidden or malicious intent.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
dismissed
LLM, confidence 0.94
Expected ES-format fixture with a dynamic import of a variable.
Reasoning
This is an expected-output ES module fixture from a bundler test suite. The import(dep) call is a normal dynamic import pattern used to test chunking, not an attack.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
dismissed
LLM, confidence 0.94
Test source file that performs a dynamic import of a variable.
Reasoning
This is the source sample for a rollup chunking test of dynamic imports. A variable-specifier import() is a legitimate language feature and the surrounding fixture is plainly test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
dismissed
LLM, confidence 0.93
Generated AMD code that lazily loads an external module through require.
Reasoning
This is generated AMD output from a bundler test for external dynamic imports. The require call with an array specifier is the normal compiled form of import() and matches the rest of the rollup fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic$1; }).then(({dynamic}) => console.log('main1', dynamic));
}));
dismissed
LLM, confidence 0.93
Generated AMD facade code that requires a generated dynamic chunk.
Reasoning
This is expected bundler output for a facade chunk test. The require of a generated chunk and the dynamic property access are standard lowering of an import() with a then-chain.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(dep2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.dep2 = dep2;
dismissed
LLM, confidence 0.93
Generated AMD chunk that lazily requires another generated chunk.
Reasoning
This is generated AMD output from a manual-chunk test. The require call loads a sibling generated chunk, which is ordinary bundler behavior with no obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const inlined = Promise.resolve().then(function () { return inlined$2; });
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.inlined = inlined;
dismissed
LLM, confidence 0.93
Generated AMD module that requires a separately chunked module.
Reasoning
This is bundler expected output for an inline-colouring chunking test. The require of a separate generated chunk is the normal compiled form of a dynamic import.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.separate = separate;
dismissed
LLM, confidence 0.93
Generated AMD entry that requires a separate generated chunk.
Reasoning
This is expected bundler output in a chunking test. The require call loads a generated chunk, consistent with the rest of the fixture and with no sign of malicious intent.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
async function test() {
const dep = await new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); });
console.log(dep.obj.a.a.a);
}
dismissed
LLM, confidence 0.93
Generated AMD async function that awaits a lazily required module.
Reasoning
This is expected bundler output for a tree-shaking test with await on a dynamic import. The require wrapped in a Promise is the standard AMD lowering, and the test directory confirms it is a fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(({ obj }) => {
console.log(obj.a);
});
dismissed
LLM, confidence 0.93
Generated AMD code that lazily requires a module and reads a property from it.
Reasoning
This is expected bundler output for a tree-shaking test with a then-chain on a dynamic import. The require call is the normal AMD form and is not an encoded or hidden payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
dismissed
LLM, confidence 0.93
Generated AMD code that loads two modules lazily via Promise.all.
Reasoning
This is bundler expected output for a test of default-only namespace imports. The Promise.all of two require calls is the normal compiled form of two dynamic imports, with no sign of malicious behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
dismissed
LLM, confidence 0.93
Second lazy require in the generated Promise.all of the default-only test output.
Reasoning
This is the same bundler-generated AMD output as the other finding in this file, showing the second lazy require in the Promise.all. It is a standard compiled dynamic import in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({ value }) => console.log(value));
}));
dismissed
LLM, confidence 0.93
Generated AMD loader call that dynamically loads a fixed local module in a chunking test fixture.
Reasoning
This is Rollup's generated AMD output for a dynamic import. The require call takes an array literal containing a fixed local module path, which the scanner misreads as a non-literal specifier. No obfuscation or malicious behavior is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(({ bar }) => console.log(bar()));
}));
dismissed
LLM, confidence 0.93
Generated AMD require of a fixed chunk path in a chunking test expected-output file.
Reasoning
Standard AMD dynamic-import wrapper emitted by the bundler, loading a fixed relative chunk path inside a test fixture. The array-form specifier triggers the heuristic, but the code is ordinary.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./lib'], resolve, reject); }).then(function (n) { return n.lib; }).then(console.log);
}));
dismissed
LLM, confidence 0.93
Generated AMD require loading './lib' with a constant path in a test fixture.
Reasoning
Bundler-generated AMD dynamic import of a fixed local module './lib'. The array literal is flagged as non-literal, but the path is constant and the snippet is benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module1'], resolve, reject); });
module.foo();
dismissed
LLM, confidence 0.92
Generated AMD dynamic import of './generated-module1' followed by a plain method call.
Reasoning
Same bundler-generated AMD dynamic-import pattern with a fixed module path, followed by ordinary property access in a test sample. No sign of obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module2'], resolve, reject); });
const module1 = module;
module1.foo();
dismissed
LLM, confidence 0.92
Generated AMD dynamic import of './generated-module2' with plain namespace usage.
Reasoning
Generated AMD dynamic import of a fixed local module, then ordinary namespace usage in a test fixture. The flag comes from the array-form require, not from malicious code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module3'], resolve, reject); });
const { foo } = module;
foo();
dismissed
LLM, confidence 0.92
Generated AMD dynamic import of './generated-module3' with destructuring of its exports.
Reasoning
Generated AMD dynamic import with a constant path and simple destructuring in a test fixture. Benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module4'], resolve, reject); });
const { foo, ...rest } = module;
dismissed
LLM, confidence 0.92
Generated AMD dynamic import of './generated-module4' with rest destructuring.
Reasoning
Generated AMD dynamic import with a constant path and rest destructuring, typical of a namespace test. No obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module5'], resolve, reject); });
readFoo({ foo: () => {} });
readFoo(module);
dismissed
LLM, confidence 0.92
Generated AMD dynamic import of './generated-module5' passed to ordinary helper functions.
Reasoning
Generated AMD dynamic import of a fixed module, followed by ordinary function calls in a test fixture. Benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module6'], resolve, reject); });
function b({ foo }) {
foo();
dismissed
LLM, confidence 0.92
Generated AMD dynamic import of './generated-module6' with a local destructuring helper.
Reasoning
Generated AMD dynamic import with a constant path and a nested function that destructures the module. Standard test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module7'], resolve, reject); });
function b({ foo, ...rest }) {
dismissed
LLM, confidence 0.92
Generated AMD dynamic import of './generated-module7' with a rest-destructuring helper.
Reasoning
Generated AMD dynamic import of a fixed module with rest destructuring in a helper. Ordinary test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module8'], resolve, reject); });
function b(o1, ...rest) {
dismissed
LLM, confidence 0.92
Generated AMD dynamic import of './generated-module8' with a rest-parameter helper.
Reasoning
Generated AMD dynamic import with a constant path and a rest-parameter helper. Benign test scaffolding.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module9'], resolve, reject); });
function b({ foo = 1 }) {
dismissed
LLM, confidence 0.92
Generated AMD dynamic import of './generated-module9' with a default-destructuring helper.
Reasoning
Generated AMD dynamic import of a fixed module with a default-valued destructuring helper. Ordinary test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module10'], resolve, reject); });
(module).bar();
(global.unknown && module).foo();
dismissed
LLM, confidence 0.91
Generated AMD dynamic import of './generated-module10' followed by namespace-access edge cases.
Reasoning
Generated AMD dynamic import of a fixed module. The following lines use a conditional expression on a global, which is a common test pattern for namespace edge cases. No malicious intent is shown.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./other'], resolve, reject); }).then(result =>
assert.deepEqual(result, { value: 'shared', extra: 'extra' })
);
likely benign
LLM, confidence 0.93
Rollup-generated AMD dynamic import in a dynamic-import test fixture.
Reasoning
Rollup AMD dynamic import of './other' in a test expected-output file. Standard lazy-loading pattern.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
exports.promise = promise;
likely benign
LLM, confidence 0.93
Generated AMD loader call that loads a sibling chunk module for a dynamic import.
Reasoning
This is Rollup's AMD output for a dynamic import in a chunking test fixture. The require call passes an array of relative module paths with resolve and reject callbacks, which is the standard AMD loader pattern. The specifier is a fixed local module, not attacker-controlled data.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.93
AMD-style dynamic require of a fixed relative module './main'.
Reasoning
Rollup-generated AMD test fixture. The require array contains a fixed relative path to './main' and the result is only logged, so this is ordinary dynamic module loading.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.93
Generated AMD require of fixed local module './main' with promise chaining.
Reasoning
Same Rollup AMD test output pattern. The specifier is a fixed local path and the chained promise only reads a property and logs. Nothing here is obfuscated or dynamic in a suspicious way.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
likely benign
LLM, confidence 0.93
Generated AMD require of fixed local module './generated-dynamic'.
Reasoning
Rollup-generated AMD test fixture loading a fixed sibling module './generated-dynamic'. The flagged pattern is the expected output of dynamic import transpilation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.93
Generated AMD require of fixed local module './main' in a test fixture.
Reasoning
Rollup test fixture in AMD format. The require target is a constant local path and the code is a standard promise wrapper around the module load.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
likely benign
LLM, confidence 0.93
Generated AMD require of fixed local module './generated-dynamic'.
Reasoning
Rollup AMD expected-output fixture. The specifier './generated-dynamic' is a constant, so the non-literal finding is a false positive from the AMD array-argument form.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.92
Generated AMD require of './main' with namespace interop wrapping.
Reasoning
Rollup AMD fixture with a fixed './main' specifier and a generated interop helper wrapper. This is the normal transpiled output of a dynamic import.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('no importer', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.90
CJS compatibility shim resolving a fixed generated chunk URL via require('url') or the browser URL API.
Reasoning
This is Rollup's CJS fallback for import.meta.url-style chunk URL resolution. The require('u' + 'rl') split is a common bundler pattern used to avoid bundler static analysis of the url module. The code is a browser/Node compatibility shim building a file URL for a fixed local chunk, not a payload or dropper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from maim', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.90
Same CJS URL-resolution shim for a fixed generated chunk, logging a message.
Reasoning
Same Rollup-generated URL compatibility shim, here with a console.log. The require target is the constant string 'url' after concatenation and the chunk path is fixed.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from nested', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib2.js').href : new URL('generated-lib2.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.90
Same CJS URL-resolution shim for fixed chunk generated-lib2.js.
Reasoning
Same generated URL shim for the fixed local chunk generated-lib2.js. The concatenation of 'u' and 'rl' is a bundler idiom, and the surrounding code only builds a URL for logging.
-
file mixes tab and space indentation (41 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'allows adding additional chunks to be used in workers',
options: {
input: 'main',
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./chunks/nested'], resolve, reject); })
.then(result => result.getWorkerMessage())
.then(message => (document.body.innerHTML += `<h1>2: ${message.data}</h1>`));
likely benign
LLM, confidence 0.92
Generated AMD require of fixed local chunk './chunks/nested' in a worker test.
Reasoning
Rollup AMD expected output for a worker chunk test. The require array holds a fixed local path './chunks/nested' and the chain only calls a method and updates the DOM from a message, which is ordinary test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker-proxy.js').href : new URL('worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.93
Rollup-generated CJS helper that resolves a worker URL via url.pathToFileURL in Node or new URL in browsers.
Reasoning
This is Rollup's generated CJS polyfill for import.meta.url and new URL asset resolution in a Worker. The require('u'+'rl') split is a standard Rollup idiom to avoid bundler resolution of the url module, and the file is a checked-in expected-output fixture under test/. No payload, execution of decoded data, or exfiltration is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
PLACEHOLDER((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker.js').href : new URL('worker.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.93
Rollup-generated URL resolution for a worker script inside a test fixture.
Reasoning
Same Rollup import.meta.url polyfill pattern resolving a worker path. The string concatenation is a deliberate bundler idiom, not obfuscation of malicious intent, and the file is a test expected-output fixture.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.93
Rollup-emitted Worker constructor argument resolving a proxy script path.
Reasoning
Standard Rollup-emitted worker URL construction with the require('u'+'rl') idiom, located in a test expected-output directory. Nothing indicates malicious behavior.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const getWorkerMessage = () => new Promise(resolve => {
const worker = new Worker(new URL('chunks/worker-proxy.js', import.meta.url).href);
worker.onmessage = resolve;
});
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
CSS.paintWorklet.addModule((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worklet.js').href : new URL('chunks/worklet.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.93
Rollup-generated URL resolution for a paint worklet module.
Reasoning
Rollup's import.meta.url polyfill passed to CSS.paintWorklet.addModule. It is a generated fixture in a test directory and resolves a local file path only.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./ext\'ernal'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('main', dep.value);
likely benign
LLM, confidence 0.92
Generated AMD require of a fixed external-module path in an emit-chunk test.
Reasoning
Rollup expected output for an emitted chunk test. The path './ext\'ernal' is a fixed string literal with an escaped quote, and the code only resolves a namespace. No dynamic or attacker-controlled specifier is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./entry-deb-amd'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.94
Rollup AMD dynamic import of an entry module in preserve-modules mode.
Reasoning
Standard Rollup AMD dynamic-import output for a relative module in a test expected-output fixture. No malicious indicators.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.94
Rollup AMD lazy-loading of a sibling chunk via require with a relative path.
Reasoning
Standard AMD dynamic import emitted by Rollup, requiring a relative chunk path inside a Promise. The non-literal flag is a false positive on bundler output in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
showImage(logo);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.showImage = showImage;
likely benign
LLM, confidence 0.94
Rollup AMD dynamic import of a nested chunk.
Reasoning
Rollup AMD code-splitting output lazily loading './nested/chunk' by relative path. This is ordinary bundler output in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo1-FquQRdV3.svg').href : new URL('assets/logo1-FquQRdV3.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.93
Rollup-generated URL resolution for an emitted logo asset.
Reasoning
Rollup's import.meta.url polyfill for an emitted SVG asset path, inside a test expected-output fixture. It only computes a local file URL.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/../assets/logo2-DJfvToLT.svg').href : new URL('../assets/logo2-DJfvToLT.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.93
Rollup-generated URL resolution for a nested chunk's SVG asset.
Reasoning
Same Rollup asset URL polyfill with a relative path to an SVG asset in a test fixture. No execution or network exfiltration is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
renderStart = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/renderStart-B4XObdBk.txt').href : new URL('assets/renderStart-B4XObdBk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).hre
likely benign
LLM, confidence 0.92
Rollup-generated URL resolution for a text asset in a test fixture.
Reasoning
Rollup import.meta.url polyfill assigning a text asset URL, in a checked-in test expected-output file. Pattern is standard bundler output with no malicious behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderStartNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderStart.txt').href : new URL('renderStart.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Node url.pathToFileURL call for an emitted asset path, built in a CJS bundle.
Reasoning
This is generated bundler output. The require is guarded by a typeof document check and uses the 'u'+'rl' split to load Node's url module in CJS builds. The split string is an unusual idiom, but it is a plausible way to keep a bundler from resolving the module, and nothing here reaches the network or executes fetched content.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const bannerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/banner.txt').href : new URL('banner.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Node url.pathToFileURL call for the banner asset path in a CJS bundle.
Reasoning
Same generated pattern as the other findings in this file: a document-guarded require of 'url' via string concatenation, used to build a file URL for banner.txt. It is a benign asset-path helper in a bundle test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const footerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/footer.txt').href : new URL('footer.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Node url.pathToFileURL call for the footer asset path in a CJS bundle.
Reasoning
Identical generated helper pattern for footer.txt. The concatenated 'u'+'rl' specifier is a bundler-avoidance idiom, and the code only builds a URL string for a local asset.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const introNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/intro.txt').href : new URL('intro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Node url.pathToFileURL call for the intro asset path in a CJS bundle.
Reasoning
Same generated pattern for intro.txt. It produces a file URL for a bundled asset and does not execute or fetch remote content.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const outroNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/outro.txt').href : new URL('outro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Node url.pathToFileURL call for the outro asset path in a CJS bundle.
Reasoning
Same generated pattern for outro.txt, a local asset URL built from __dirname in a bundle test output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderChunkNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderChunk.txt').href : new URL('renderChunk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Node url.pathToFileURL call for the renderChunk asset path in a CJS bundle.
Reasoning
Same generated pattern for renderChunk.txt. It builds a local file URL in a bundler expected-output fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const generateBundleNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generateBundle.txt').href : new URL('generateBundle.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.80
Node url.pathToFileURL call for the generateBundle asset path in a CJS bundle.
Reasoning
Same generated pattern for generateBundle.txt. It is benign URL construction for an emitted asset.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.92
AMD-style dynamic require of a generated chunk inside a Promise.
Reasoning
This is a standard AMD dynamic import, require(['./generated-dynamic'], resolve, reject), inside a Promise in a bundler expected-output fixture. The non-literal flag is a false positive from the scanner, since the module is a bundled relative path.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(console.log);
}));
likely benign
LLM, confidence 0.92
AMD dynamic require of a generated dependency with a then-chain that reads a field.
Reasoning
Ordinary AMD dynamic-import wrapper for './generated-dep1' in a generated-code test fixture. No suspicious behavior is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['./generated-dep1'], resolve, reject)).then(n => n.dep1).then(console.log);
}));
likely benign
LLM, confidence 0.92
Arrow-function AMD dynamic require of a generated dependency.
Reasoning
Same AMD dynamic-import pattern as the arrow-function variant of the generated-code fixture, with a relative module path and no obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
likely benign
LLM, confidence 0.92
AMD dynamic require of a generated dependency inside a Promise.
Reasoning
Standard AMD dynamic require of './generated-dynamicDep' in a bundler test fixture for implicit dependencies. The scanner's non-literal warning is a false positive here.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
exports.value = value;
likely benign
LLM, confidence 0.93
Generated AMD chunk that lazily loads a sibling chunk via a literal path in a require array.
Reasoning
This is Rollup's AMD output for a dynamic import. The require call takes an array literal containing a fixed relative chunk path, and the flag comes from the non-literal check misreading that array as a dynamic specifier. It is a generated test fixture with no sign of malicious behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
likely benign
LLM, confidence 0.93
Generated AMD chunk that lazily loads a sibling chunk via a literal path in a require array.
Reasoning
Same Rollup AMD dynamic-import pattern with a fixed chunk path inside an array literal. The finding is a false positive from the specifier check, and the fixture is an expected-output file.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-lib'], resolve, reject); }).then(function (n) { return n.lib; });
}));
likely benign
LLM, confidence 0.93
Generated AMD entry that dynamically loads a library chunk and reads one export.
Reasoning
Rollup AMD output for a dynamic import of './generated-lib' with a literal path in an array. The non-literal flag is a false positive on a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const url = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('0/1/nested.js', document.baseURI).href));
exports.url = url;
likely benign
LLM, confidence 0.80
Generated CJS code that derives import.meta.url by requiring Node's url module and falling back to document.baseURI in browsers.
Reasoning
Rollup's CJS polyfill for import.meta.url. It calls require('u'+'rl') to load Node's url module, with the string split presumably to keep bundlers from resolving it. This is a known generated pattern in a test fixture, and it resolves to a standard built-in, not a payload. The split string is a mild evasion-looking construct, so confidence is slightly lower.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
log('main: ' + new URL(module.uri, document.baseURI).href);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.log = log;
likely benign
LLM, confidence 0.93
Generated AMD entry that lazily loads a nested chunk and logs a URL.
Reasoning
Rollup AMD dynamic import with a literal chunk path in an array, flagged as non-literal. A false positive on an expected-output fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log('main: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('main.js', document.baseURI).href)));
likely benign
LLM, confidence 0.80
Generated CJS entry that computes its own URL using the url module or the browser document base.
Reasoning
Rollup's CJS import.meta.url shim that requires the built-in url module via a split string and otherwise uses document.baseURI. This is standard generated output for a test fixture, not an attack, though the split string is a minor evasion-looking element.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
main.log('nested: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('nested/chunk.js', document.baseURI).href)));
likely benign
LLM, confidence 0.80
Generated CJS nested chunk that computes its URL with the same import.meta shim.
Reasoning
The same Rollup import.meta.url shim as in the other CJS fixture, requiring the built-in url module through a split string with a document.baseURI fallback. Benign generated code with a minor evasion-looking construct.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.shared = shared;
likely benign
LLM, confidence 0.93
Generated AMD entry that lazily loads a dynamic chunk alongside a shared export.
Reasoning
Rollup AMD dynamic import of a literal chunk path in an array literal. The flag is a false positive on a generated test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
likely benign
LLM, confidence 0.93
Generated AMD chunk that dynamically loads another chunk in a circular import test.
Reasoning
Rollup AMD output for a circular dynamic import with a literal path in an array. A false positive from the non-literal check, in an expected-output fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); });
console.log('dynamic2');
likely benign
LLM, confidence 0.93
Generated AMD chunk that dynamically loads the main module in a circular import test.
Reasoning
Rollup AMD output in a circular-import test that dynamically requires the main chunk by literal path. A false positive on generated test output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.93
Generated AMD entry that dynamically loads two chunks in a circular import test.
Reasoning
Rollup AMD entry with two literal dynamic require arrays for circular chunk loading. The non-literal flag is a false positive on a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.93
Generated AMD entry that dynamically loads a second chunk in a circular import test.
Reasoning
Second dynamic require in the same generated AMD entry, again with literal chunk paths in arrays. A false positive from the specifier check on expected output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
likely benign
LLM, confidence 0.90
Generated AMD loader call for a dynamically imported chunk in a test fixture.
Reasoning
This is expected AMD output from Rollup's chunking tests. The non-literal require is the standard AMD dynamic-import shape generated by the bundler, and nothing in the snippet suggests malicious intent.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.90
Generated AMD require of a sibling chunk in a test expectation.
Reasoning
Same generated AMD dynamic-import pattern as the sibling fixtures, loading a known local chunk path inside a test expectation file.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.90
Generated AMD require of a local chunk in a test expectation file.
Reasoning
Identical generated AMD loader pattern loading a local chunk; the path is a fixed relative module name in a test expectation.
-
18 of 35 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
18 of 32 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
16 of 30 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
24 of 38 non-conventional identifiers are single-character (63%) (token pass, confidence 0.50)
-
24 of 53 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (3 tab-indented and 35 space-indented lines) (raw pass, confidence 0.40)
var num = 2;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 49 space-indented lines) (raw pass, confidence 0.40)
var num = 1;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 49 space-indented lines) (raw pass, confidence 0.40)
var num = 3;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (7 tab-indented and 35 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function (exports, module) {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (13 tab-indented and 49 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-B9YfStri.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
file mixes tab and space indentation (13 tab-indented and 49 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-B9YfStri.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
line length 1540 characters (raw pass, confidence 0.50)
export { lazy, v1, v10, v100, v101, v102, v103, v104, v105, v106, v107, v108, v109, v11, v110, v111, v112, v113, v114, v115, v116, v117, v118, v119, v12, v120, v121, v122, v123, v124, v125, v126, v127, v128, v129, v13, v130, v131, v132, v133, v134, v135, v136, v137, v138, v139, v14, v140, v141, v142, v143, v144, v145,
-
file mixes tab and space indentation (8 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
spawnArgs: ['--config'],
env: { FORCE_COLOR: undefined, NO_COLOR: true },
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'displays logs',
skipIfWindows: true,
spawnArgs: ['--config'],
-
21 of 48 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
23 of 52 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (43 tab-indented and 21 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'immediately reloads the config file if a change happens while it is parsed',
spawnArgs: ['-cw'],
before() {
-
file mixes tab and space indentation (42 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'keeps watching the config file in case the config is changed to an invalid state',
spawnArgs: ['-cw'],
before() {
-
mean non-conventional identifier length 1.95 over 21 names (token pass, confidence 0.50)
-
line length 1453 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopName
-
line length 1429 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&
-
line length 629 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1342 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e)}function _interopName
-
line length 576 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:function(){return defaultCompat.foo}});Object.keys(defaultCompat).forEach(function(k){i
-
line length 1063 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[fu
-
line length 1948 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 1361 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&
-
line length 1337 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'d
-
line length 596 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1250 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e);var _interopNamespaceDefaultOnly=e=>Object.fr
-
line length 538 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:()=>defaultCompat.foo});Object.keys(defaultCompat).forEach(k=>{if(k!=='default'&&!Objec
-
line length 992 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[()
-
line length 1844 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 1153 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1187 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1084 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 722 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module["function"];exports({bar:module["function"],default:module,void:module["default"]});},function(module){defaultOnly=module
-
line length 1455 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
line length 1150 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1184 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1081 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 710 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module.function;exports({bar:module.function,default:module,void:module.default});},function(module){defaultOnly=module;},functi
-
line length 1452 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
20 of 46 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 15 space-indented lines) (raw pass, confidence 0.40)
console.log(
<div>
Hello
World
-
file mixes tab and space indentation (54 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
options: {
experimentalLogSideEffects: true,
-
mean non-conventional identifier length 1.97 over 59 names (token pass, confidence 0.50)
-
24 of 46 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
-
18 of 45 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
line length 785 characters (raw pass, confidence 0.50)
define(['require','exports','external1','external2'],(function(require,exports,external1,external2){'use strict';function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m
-
line length 740 characters (raw pass, confidence 0.50)
'use strict';var external1=require('external1'),external2=require('external2');function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = Promise.resolve().then(function(){return _interopNamespaceDefault(require('exte
-
line length 550 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external1,external2){'use strict';const dynamic = import('external3');exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Object.defineProperty(exports,'__proto
-
line length 811 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external1'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external1','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bundle={},g.external1,g.external2));})(this,(function(
-
23 of 32 non-conventional identifiers are single-character (72%) (token pass, confidence 0.50)
-
18 of 37 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
20 of 39 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
40 of 71 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
40 of 68 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
36 of 61 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
40 of 74 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
-
32 of 67 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
40 of 95 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
32 of 60 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
{
console.log('code21');
}
keep1() ; keep2();
-
mean non-conventional identifier length 1.62 over 45 names (token pass, confidence 0.50)
-
mean non-conventional identifier length 1.74 over 92 names (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
25 of 49 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
22 of 39 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
25 of 55 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
19 of 39 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (19 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
console.log(2); console.log(2);
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (11 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function () {
'use strict';
var a = '1\
-
file mixes tab and space indentation (15 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function () {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (12 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function (factory) {
typeof define === 'function' && define.amd ? define(factory) :
factory();
})((function () { 'use strict';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (3 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
class MyClass extends ExternalElement {
constructor() {
super();
console.log('MyClassExtendsExternalClass');
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
return Function('return require("' + name + '")')();
} catch (error) { }
}
likely benign
LLM, confidence 0.80
Feature-detection fallback that builds a require call through Function inside a core-js polyfill.
Reasoning
This is core-js-style feature detection inside a try block, with an explicit eslint-disable comment. The string is built from a module name the library itself controls, so it is a known polyfill idiom rather than a payload.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
validateArgumentsLength(arguments.length, 1);
var fn = isCallable(handler) ? handler : Function(handler);
var args = arraySlice(arguments, 1);
queue[++counter] = function () {
likely benign
LLM, confidence 0.80
core-js setTimeout polyfill compiling a string handler with Function.
Reasoning
This is the standard core-js timers polyfill that converts a string handler into a function when the native API does not support it. It is a legitimate, long-known polyfill pattern, though it is still a dynamic-execution sink.
-
orphaned high surrogate \uD842 (no matching low surrogate) (token pass, confidence 0.65)
return '𠮷'.at(-2) !== '\uD842';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
var boundArgs = validateArgumentsLength(arguments.length, 1) > firstParamIndex;
var fn = isCallable(handler) ? handler : Function(handler);
var params = boundArgs ? arraySlice(arguments, firstParamIndex) : [];
var callback = boundArgs ? function () {
likely benign
LLM, confidence 0.80
Second core-js timers polyfill that compiles a string handler with Function.
Reasoning
Same core-js timers polyfill pattern as the other occurrence, converting string handlers with Function. Expected library code with no sign of hidden payload.
-
line length 1121 characters (raw pass, confidence 0.50)
var isCallable; var fnToStr = Function.prototype.toString, constructorRegex = /^\s*class /, isES6ClassFn = function isES6ClassFn(value) { try { var fnStr = fnToStr.call(value); var singleStripped = fnStr.replace(/\/\/.*\n/g, ''); var multiStripped = singleStripped.
-
file mixes tab and space indentation (23 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'synthetic named exports',
options: {
plugins: [
-
30 of 57 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
78 of 143 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
28 of 67 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
24 of 57 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
30 of 72 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (116 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
function _mergeNamespaces(n, m) {
m.forEach(function (e) {
e && typeof e !== 'string' && !Array.isArray(e) && Object.keys(e).forEach(function (k) {
if (k !== 'default' && !(k in n)) {
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose')};
}
-
file mixes tab and space indentation (2 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose'),
[Symbol.asyncDispose]: () => console.log('asyncDispose'),
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
try {
const function_ = new Function(contextKeys, code);
function_.apply({}, contextValues);
} catch (error) {
likely benign
LLM, confidence 0.85
Test harness constructing a Function from generated code and context keys.
Reasoning
This is a test harness that evaluates generated function code with explicit parameter names and values. Its purpose is running Rollup's output in tests, not hiding code from a reviewer.
-
file mixes tab and space indentation (19 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'should provide json hint when importing a no export json file',
error: {
binding: 'default',
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function getFoo() {
return foo;
}
-
16 of 33 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (40 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles circular reexports',
exports(exports) {
assert.strictEqual(exports.exists, 42);
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function Bar () {
this.inheritsFromBaz = this.isBaz;
}
-
19 of 47 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
17 of 31 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (12 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.finally(() => {
finallyCalled = true;
})
-
file mixes tab and space indentation (10 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.then(() => {
const obj = {
value: false,
-
file mixes tab and space indentation (20 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'Throw descriptive error message for used export is not defined',
error: {
binding: 'foo',
-
`eval` called with a non-literal expression (ast pass, confidence 0.75)
import 'external';
eval(this);
likely benign
LLM, confidence 0.80
Test fixture calling eval on the module's this value.
Reasoning
A bare eval(this) is unusual and worth noting, but this is a tiny test fixture for log handling in plugins. It has no network, shell, or encoded-payload behaviour, so it looks like a deliberate test edge case.
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
if (!b.fromExternal) {
throw new Error('External export not included');
}
-
36 of 58 non-conventional identifiers are single-character (62%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (5 tab-indented and 4 space-indented lines) (raw pass, confidence 0.40)
export const awaitable = async (iterable) => {
for await (const value of iterable) {
}
}
-
file mixes tab and space indentation (26 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
function test1() {
return true ?
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
const switchSubmit = state => {
if (state == 1) {
assert.ok(false);
} else if (state == 0) {
-
file mixes tab and space indentation (34 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles when a low resolution sourcemap is used to report an error',
options: {
plugins: [
-
file mixes tab and space indentation (570 tab-indented and 9 space-indented lines) (raw pass, confidence 0.40)
describe('incremental', () => {
let resolveIdCalls;
let transformCalls;
let modules;
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
globals,
likely benign
LLM, confidence 0.85
Test helper evaluating bundled IIFE code with injected globals.
Reasoning
This is a test helper that runs bundled code with a set of global names via Function. The inputs are test globals and the code under test, which is the expected pattern for a bundler test.
-
file mixes tab and space indentation (490 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
describe('misc', () => {
it('avoids modification of options or their properties', () => {
const { freeze } = Object;
return rollup.rollup(
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
assert.doesNotThrow(() => new Function(umdCode), 'UMD output should be valid JavaScript');
});
likely benign
LLM, confidence 0.90
Test assertion that wraps UMD output in new Function to verify it parses.
Reasoning
The Function call only checks that UMD output parses, and the comment says so. It is a syntax-validation assertion in a test, not an execution of untrusted input.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
thisValue,
likely benign
LLM, confidence 0.85
Test helper evaluating UMD bundle code with injected globals.
Reasoning
This is the same test-harness pattern as iife.js: it runs generated UMD code with known globals and a fixed this value inside a bundler test.
-
file mixes tab and space indentation (64 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
export function App() {
return <div>{'.'}</div>;
}
`;
-
file mixes tab and space indentation (70 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
export function App() {
if (count) {
console.log(count);
}
-
base64-like blob (272 bytes, compression ratio 0.74) (in comment) (raw pass, confidence 0.36)
-
file mixes tab and space indentation (64 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
console.log(
this + 2
)
`;
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io