Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', dep.value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', fromMain1AndDynamic.value1, fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = fromMain1AndDynamic.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', fromMain1And2.value2, fromMain1And2.value3);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = fromMain1And2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep1.value1, dep2.value2, something);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value1 = dep1.value1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', value1, dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main2', dep2.value2);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.value2 = dep2.value2;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('shared', value1);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('a', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
console.log('main', value);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main', value);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.value = value;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = Promise.all([new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-d'], resolve, reject); })]).then(() => {
assert.strictEqual(globalThis.xLoaded, true);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = Promise.all([new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-d'], resolve, reject); })]).then(() => {
assert.strictEqual(globalThis.xLoaded, true);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-m'], resolve, reject); }).then(m => console.log(m, DEP));
exports.DEP = DEP;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(n => console.log(n.a));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.mB; }).then(m => console.log(m.MB, m.OTHER, X));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.mB; }).then(n => console.log(n.b, manual.a));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.all([new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.all([new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.all([new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }), new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); })]).then(
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({DYNAMIC_USED_BY_A}) => console.log(DYNAMIC_USED_BY_A));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual1; }).then((m) => m.manual1),
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
await new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.manual2; }).then((m) => m.manual2),
);
};
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-x'], resolve, reject); }).then(n => console.log(n.x, manual.m));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-manual'], resolve, reject); }).then(function (n) { return n.x; }).then(n => console.log(n.x, manual.m));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['./external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['../generated-dynamic'], resolve, reject); }).then(result => console.log(result));
new Promise(function (resolve, reject) { require(['../external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(result => console.log(result));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
console.log('dynamic2');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
console.log('dynamic3');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic5'], resolve, reject); });
console.log('dynamic4');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); }).then(({a}) => console.log(a));
new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); }).then(({b}) => console.log(b));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
exports.shared = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic4'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(shared);
new Promise(function (resolve, reject) { require(['./generated-dynamic3'], resolve, reject); });
const unused = 42;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const unused = 'unused';
const dynamic = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
globalThis.sharedStatic = shared;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log(result.default));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
return _default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(lib__namespace);
new Promise(function (resolve, reject) { require(['./lib'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
exports.lib = lib__namespace;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-included'], resolve, reject); }).then(result => console.log(result));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./default'], resolve, reject); }).then(result => console.log(result.default));
new Promise(function (resolve, reject) { require(['./named'], resolve, reject); }).then(result => console.log(result.value));
exports.default = _default.default;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-foo'], resolve, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra = { with: { type: 'json' } };
import(specifier, extra);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./chain-2.js');
import(somethingElse);
import('external-module');
import('./imports-external.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('./imported-via-special-handler.js');
import(someVariable);
import(someResolvedVariable);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(someVariable);
import(someResolvedVariable);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('existing');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
new Promise(function (resolve, reject) { require(['./direct-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-relative-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['direct-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-indirect-absolute-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('dynamic-direct-external' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['to-dynamic-indirect-external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
Promise.resolve().then(function () { return existing; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
Promise.resolve().then(function () { return existing; });
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('my' + 'replacement');
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('to-dynamic-indirect-external');
Promise.resolve().then(function () { return existing; });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
Promise.resolve().then(function () { return existing; });
import('my' + 'replacement');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-direct-external' + unknown);
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-external' + unknown);
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('dynamic-indirect-existing' + unknown);
import('dynamic-replaced' + unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
assetString = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt').href : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const assetObject = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/test-r6af3lUh.txt') : new URL('assets/test-r6af3lUh.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./nested/chunk2'], resolve, reject); }).then(result => console.log(result, chunk$1, chunk, asset$1, asset));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const asset = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.bas
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const chunk = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/nested/chunk.js').href : new URL('nested/chunk.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy = new Promise(function (resolve, reject) { require(['./generated-lazy'], resolve, reject); });
exports.lazy = lazy;
-
line length 3070 characters (raw pass, confidence 0.65)
v272; exports({ v1: v1, v2: v2, v3: v3, v4: v4, v5: v5, v6: v6, v7: v7, v8: v8, v9: v9, v10: v10, v11: v11, v12: v12, v13: v13, v14: v14, v15: v15, v16: v16, v17: v17, v18: v18, v19: v19, v20: v20, v21: v21, v22: v22, v23: v23, v24: v24, v25: v25, v26: v26, v27: v27, v28: v28, v29: v29, v30: v30, v31: v31, v32: v32
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy1 = new Promise(function (resolve, reject) { require(['./generated-foo_20bar'], resolve, reject); });
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy2 = new Promise(function (resolve, reject) { require(['./generated-foo_bar'], resolve, reject); });
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const lazy3 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81_82bar'], resolve, reject); });
const lazy4 = new Promise(function (resolve, reject) { require(['./generated-foo_E3_81bar'], resolve, reject); });
exports.lazy1 = lazy1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-first'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.b; });
new Promise(function (resolve, reject) { require(['./generated-second'], resolve, reject); }).then(function (n) { return n.c; });
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const component = new Promise(function (resolve, reject) { require(['./generated-component'], resolve, reject); }).then(function (n) { return n.component; });
exports.component = component;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(function (n) { return n.dep; }).then(({ foo, bar, baz }) => console.log(foo, bar, baz));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset3 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.base
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-unresolved-B7Qh6_pN.txt').href : new URL('assets/asset-unresolved-B7Qh6_pN.txt', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SC
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 0;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
exports.default = 1;
console.log(new URL(module.uri, document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 0;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
function nested1() {
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
exports.default = 1;
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return new Promise((resolve, reject) => require([this.outputPath], m => resolve(_interopNamespaceDefault(m)), reject));
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return Promise.resolve().then(() => _interopNamespaceDefault(require(this.outputPath)));
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
getImport() {
return (function (t) { return Promise.resolve().then(function () { return _interopNamespaceDefault(require(t)); }); })(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(`My ${globalThis.unknown}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./seven'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import('./seven.js');
import('./seven.js');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`${globalThis.unknown}`);
import(`My ${globalThis.unknown}`);
import(7);
import('./seven.js');
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
logoReverse = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseUR
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo-zDlmrXar.svg').href : new URL('assets/logo-zDlmrXar.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.curren
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo_reverse\'-DbGK2oiS.svg').href : new URL('assets/logo_reverse\'-DbGK2oiS.svg', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset1 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset99 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-C1v24hPj').href : new URL('assets/asset-C1v24hPj', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-CtWoGP2A').href : new URL('assets/asset-CtWoGP2A', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/asset-8_Inlget').href : new URL('assets/asset-8_Inlget', typeof document === 'undefined' ? location.href : document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScrip
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function(c,e){require(['external'],function(m){c(_interopNamespaceCompat(m))},e)}).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((c,e)=>require(['external'],m=>c(_interopNamespaceCompat(m)),e)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceCompat(m)); }, reject); }).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['external'], m => resolve(_interopNamespaceCompat(m)), reject)).then(console.log);
console.log(defaultCompat__namespace.default);
console.log(externalAuto__default.default);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra1 = { with: { type: 'json' } };
import(specifier1, extra1);
const extra2 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra2 = { with: { type: 'json' } };
import(specifier2, { with: extra2.with });
const extra3 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra5 = { with: { type: 'json' } };
import(specifier5, extra5);
const extra6 = { with: { type: 'json' } };
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const extra6 = { with: { type: 'json' } };
import(specifier6, { with: extra6.with });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: "special" } });
import(globalThis.unknown, { assert: { type: "special" } });
import('resolvedString', { assert: { type: "special" } });
import('resolved-id', { assert: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(globalThis.unknown);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })('resolvedString');
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-id'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['resolved-different'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
new Promise(function (resolve, reject) { require(['unresolved'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: "special" } });
import(globalThis.unknown, { with: { type: "special" } });
import('resolvedString', { with: { type: "special" } });
import('resolved-id', { with: { type: "special" } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { assert: { type: 'special' } });
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { assert: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { assert: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { assert: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('a', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special', extra: 'value' } });
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import('b');
import(`external-${globalThis.unknown}`);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(join('a', 'b'));
console.log(join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(external.join('a', 'b'));
console.log(external.join);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(pathJoin('a', 'b'));
console.log(pathJoin);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-auto'], function (m) { resolve(_interopNamespace(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-default'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-defaultOnly'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['external-esModule'], resolve, reject); }).then(console.log);
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external1).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespace(m)); }, reject); }); })(globalThis.external2).then(console.log);
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external1).then(console.log);
(function (t) { return Promise.resolve().then(function () { return _interopNamespace(require(t)); }); })(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
})(externalauto, externaldefault, externaldefaultOnly, externalesModule);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
}));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external-esModule').then(console.log);
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(globalThis.external1).then(console.log);
import(globalThis.external2).then(console.log);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
eeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m){c(_interopNamespaceDefault(m))},e)});exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Obj
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const dynamic = new Promise(function (resolve, reject) { require(['external3'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.external1 = external1.external1;
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['https://unpkg.com/foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }).then(({ default: foo }) => assert.equal(foo, 42));
}));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const someDynamicImport = () => new Promise(function (resolve, reject) { require(['external'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
exports.someDynamicImport = someDynamicImport;
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)));
console.log(undefined);
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log(undefined);
console.log(({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cjs.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
'undefined' && typeof location === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : typeof document === 'undefined' ? location.href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('umd.js', document.baseURI).href)) }));
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return code === undefined
? require(importee)
: (exportsMap[outputId] = requireWithContext(
code,
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external');
import(globalThis.unknown);
import('resolvedString');
import('resolved-id');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import('external', { with: { type: 'special' } });
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(globalThis.unknown, { with: { type: 'special' } });
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
import(`external-${globalThis.unknown}`, { with: { type: 'special' } });
import('external' + globalThis.unknown, { with: { type: 'special' } });
import('external-resolved', { with: { type: 'special' } });
import('unresolved', { with: { type: 'special' } });
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
export default import('x/' + 'y');
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
getImport() {
return import(this.outputPath);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'other') return 17;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
if (id === 'external') return 42;
return require(id);
}
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
}
return require(name);
}
},
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
export const path = import('path');
export const pathAgain = import(thePath);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import.source(dynamic).then(console.log)
-
base64-like blob (184 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
module.exports = main;
`
);
-
U+FEFF ZERO WIDTH NO-BREAK SPACE (BOM) in source (raw pass, confidence 0.75)
⟨U+FEFF⟩⟨U+FEFF⟩export const msg = 'foo';
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const configFile = path.join(directory, '_config.js');
const config = require(configFile);
if (!config || !config.description) {
throw new Error(`Found invalid config without description: ${configFile}`);
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
delete require.cache[resolved];
return require(resolved);
}
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-6Pt_L0T6'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-Bx2VuOb-'], resolve, reject); });
dismissed
LLM, confidence 0.90
AMD dynamic requires of hashed chunk filenames in a sourcemap test expectation.
Reasoning
The require specifiers are literal chunk file names generated by the bundler's file-name function. Not a dynamic or attacker-controlled path.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./dynamic-6Pt_L0T6'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./dynamic-hashed-Bx2VuOb-'], resolve, reject); });
}));
dismissed
LLM, confidence 0.90
AMD dynamic require of a hashed chunk in a Rollup test expectation.
Reasoning
Duplicate of the same literal-path AMD require pattern in a generated test output file.
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
line length 593 characters (raw pass, confidence 0.50)
run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function () { run(function (
-
line length 1489 characters (raw pass, confidence 0.50)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
-
line length 2244 characters (raw pass, confidence 0.65)
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
dismissed
LLM, confidence 0.97
Long line of sponsor avatar links in the Rollup README.
Reasoning
A raw long-line warning on a markdown badge/sponsor HTML block. Raw findings have a high false-positive rate and this is ordinary README markup.
-
file mixes tab and space indentation (17 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function generateBanner(commitHash: string, version: string): string {
const date = new Date(
env.SOURCE_DATE_EPOCH ? 1000 * +env.SOURCE_DATE_EPOCH : Date.now()
).toUTCString();
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
plugin = new Function('return ' + pluginText);
} else {
const match = pluginText.match(/^([\w./:@\\^{|}-]+)(=(.*))?$/);
likely benign
LLM, confidence 0.85
new Function on the --plugin CLI argument to evaluate an inline plugin object.
Reasoning
Builds a function from the text of a user-supplied --plugin CLI argument. This is a build tool evaluating its own operator's inline plugin option, not attacker-controlled input in a package, so it reads as a legitimate feature.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
pluginText = match[1];
pluginArgument = new Function('return ' + match[3])();
} else {
throw new Error(`Invalid --plugin argument format: ${JSON.stringify(pluginText)}`);
likely benign
LLM, confidence 0.85
new Function evaluating the plugin argument from the --plugin CLI option.
Reasoning
Same pattern: evaluates the argument part of a user-typed --plugin option. It is a CLI convenience feature for a local developer, not a hidden payload.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
return require(pluginPath);
} catch {
return import(pluginPath);
likely benign
LLM, confidence 0.88
require/import of a user-specified plugin path.
Reasoning
Loads a plugin module by a path the user names on the command line, falling back to dynamic import. This is standard plugin loading in a bundler.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
} catch {
return import(pluginPath);
}
}
likely benign
LLM, confidence 0.88
Dynamic import of a user-specified plugin path.
Reasoning
The import fallback of the same plugin loader, using the user-supplied plugin path. Expected behaviour for a bundler.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
}
return (await import(fileUrl.href)).default;
} catch (error_: any) {
if (cannotLoadEsm) {
likely benign
LLM, confidence 0.88
Dynamic import of the rollup config file URL.
Reasoning
Imports the project's rollup config file by its file URL, the core purpose of loading a config. Non-literal specifiers are inherent here.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
try {
return (await import(pathToFileURL(bundledFileName).href)).default;
} finally {
unlink(bundledFileName).catch(error => console.warn(error?.message || error));
likely benign
LLM, confidence 0.88
Dynamic import of a bundled temporary config file.
Reasoning
Imports a temporarily bundled config file and deletes it afterwards. This is the standard bundle-config-then-import flow.
-
line length 1014 characters (raw pass, confidence 0.50)
ES modules export _live bindings_, not values, so values can be changed after they are initially imported as per [this demo](../repl/index.md?shareable=JTdCJTIyZXhhbXBsZSUyMiUzQW51bGwlMkMlMjJtb2R1bGVzJTIyJTNBJTVCJTdCJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMCU3QiUyMGNvdW50JTJDJTIwaW5jcmVtZW50JTIwJTdEJTIwZnJvbSUyMCcuJTJGaW5jcmVt
-
line length 881 characters (raw pass, confidence 0.50)
By default, when creating multiple chunks, imports of dependencies of entry chunks will be added as empty imports to the entry chunks themselves. [Example](../repl/index.md?shareable=JTdCJTIybW9kdWxlcyUyMiUzQSU1QiU3QiUyMm5hbWUlMjIlM0ElMjJtYWluLmpzJTIyJTJDJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMHZhbHVlJTIwZnJvbSUyMCcuJTJGb3RoZ
-
line length 922 characters (raw pass, confidence 0.50)
Even though Rollup will usually try to maintain exact module execution order when bundling, there are two situations when this is not always the case: code-splitting and external dependencies. The problem is most obvious with external dependencies, see the following [example](../repl/index.md?shareable=JTdCJTIybW9kdWxl
-
line length 1258 characters (raw pass, confidence 0.50)
with the execution order `external` → `polyfill.js` → `main.js`. This is not a problem caused by Rollup putting the `import` at the top of the bundle—imports are always executed first, no matter where they are located in the file. This problem can be solved by creating more chunks: If `polyfill.js` ends up in a d
-
`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
if (query.shareable) {
const rawJson = atob(query.shareable.replace(/_/g, '/').replace(/-/g, '+'));
const json = rawJson[0] === '%' ? decodeURIComponent(rawJson) : rawJson;
const {
likely benign
LLM, confidence 0.85
atob decoding of a shareable query parameter in the docs REPL.
Reasoning
Base64-decodes a shareable REPL URL parameter and then parses it as JSON or a URI-encoded string. It is data decoding for a docs page, not code execution.
-
`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
parameters.shareable = btoa(json).replace(/\//g, '_').replace(/\+/g, '-');
const queryString = Object.keys(parameters)
.map(key => `${key}=${parameters[key]}`)
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
try {
return require(id);
} catch (error) {
if (
likely benign
LLM, confidence 0.85
require of a native module identifier with error handling.
Reasoning
Requires a native binding inside a try/catch with fallback, a common loader pattern for optional native modules in the package entry.
-
file mixes tab and space indentation (1042 tab-indented and 17 space-indented lines) (raw pass, confidence 0.40)
export type AstNodeName =
| 'PanicError'
| 'ParseError'
| 'ArrayExpression'
-
command name is a variable (`$LLVM_PROFDATA`) and `LLVM_PROFDATA` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_PROFDATA="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-profdata"
"$LLVM_PROFDATA" merge -sparse coverage/profraw/*.profraw -o coverage/rust.profdata
NODE_FILE="$(ls dist/rollup.*.node)"
likely benign
LLM, confidence 0.88
Variable command set from rustc sysroot to run llvm-profdata.
Reasoning
The llvm-profdata path is derived from rustc's sysroot and host triple, a standard build-time tool lookup in a repo coverage script. No external input or encoded payload is involved.
-
command name is a variable (`$LLVM_COV`) and `LLVM_COV` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
LLVM_COV="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | sed -n 's/host: //p')/bin/llvm-cov"
"$LLVM_COV" export \
-instr-profile=coverage/rust.profdata \
-object "$NODE_FILE" \
likely benign
LLM, confidence 0.88
Variable command set from rustc sysroot to run llvm-cov.
Reasoning
Same construction for llvm-cov, derived from the local Rust toolchain. Routine coverage tooling.
-
file mixes tab and space indentation (81 tab-indented and 45 space-indented lines) (raw pass, confidence 0.40)
const astMacrosFile = new URL(
'../rust/parse_ast/src/convert_ast/converter/ast_macros.rs',
import.meta.url
);
-
file mixes tab and space indentation (151 tab-indented and 38 space-indented lines) (raw pass, confidence 0.40)
interface AstTypeDescription {
fields: FieldDescription[];
flags?: string[];
index: number;
-
file mixes tab and space indentation (71 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
function getFieldType(field: FieldDescription, node: NodeDescription): string {
switch (field.type) {
case 'Node': {
const baseType = field.nodeTypes.join(' | ');
-
file mixes tab and space indentation (155 tab-indented and 37 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node, originalNode }) => {
const definitions: string[] = [];
let offset = 0;
let needsBuffer = false;
-
file mixes tab and space indentation (115 tab-indented and 36 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node }) => {
const definitions: string[] = [];
let offset = 2;
if (node.flags) {
-
file mixes tab and space indentation (119 tab-indented and 37 space-indented lines) (raw pass, confidence 0.40)
const jsConverters = astNodeNamesWithFieldOrder.map(({ name, fields, node }) => {
const definitions: string[] = [];
let offset = 2;
if (node.flags) {
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
for (const [name, node] of Object.entries(AST_NODES)) {
const astType = node.astType || name;
const keySet = (childNodeKeysByAstType[astType] ||= new Set());
for (const { name: fieldName, type: fieldType } of (node.hasSameFieldsAs
-
file mixes tab and space indentation (6 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
for (const [index, { name, node }] of astNodeNamesWithFieldOrder.entries()) {
const astType = node.astType || name;
const ids = (nodeIdsByAstType[astType] ||= []);
ids.push(index);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
process.chdir(workspace.repoPath);
await import(workspace.scriptPath('prepublish.ts'));
}
likely benign
LLM, confidence 0.90
Test dynamically imports the prepublish script from its workspace path.
Reasoning
A test importing a sibling repo script by path within the test workspace. Expected test scaffolding.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
process.chdir(workspace.repoPath);
const { default: publishWasmNodePackage } = await import(
workspace.scriptPath('publish-wasm-node-package.ts')
);
likely benign
LLM, confidence 0.90
Test dynamically imports the publish-wasm-node-package script.
Reasoning
A test importing a repo publish script by path from the workspace. Ordinary test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1');
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
likely benign
LLM, confidence 0.90
AMD require of local generated test modules in an expected-output fixture.
Reasoning
This is an expected-output fixture for a chunking test that uses AMD-style require with local module ids. It is generated test data, not a runtime threat.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-main4.dynamic'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-main5'], resolve, reject); });
}));
likely benign
LLM, confidence 0.93
Bundler-generated AMD dynamic-import wrapper inside a chunking test fixture.
Reasoning
This is an expected-output file from a bundler test fixture. The AMD-style require with a computed-array specifier is the standard form a bundler emits for a dynamic import chunk. Nothing here is malicious.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(libs.value2);
console.log(new Promise(function (resolve, reject) { require(['./generated-lib1'], resolve, reject); }).then(function (n) { return n.lib3; }).then(m => m.value3));
}));
likely benign
LLM, confidence 0.93
Bundler-generated AMD dynamic import of a chunk with a promise chain on its exports.
Reasoning
Expected output of a bundler test. The require wraps a dynamic import of a sibling chunk and then reads exports from it, which is ordinary code-splitting output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.94
Bundler-generated AMD loader for a lazily loaded chunk.
Reasoning
Expected bundler output in a test fixture. The AMD dynamic require is standard for code-split chunks.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./chunks/generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.94
Bundler-generated AMD loader for a chunk in a nested output path.
Reasoning
Expected bundler output in a test fixture. The specifier is a relative chunk path, consistent with standard AMD code-splitting.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function getA() {
return new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
}
likely benign
LLM, confidence 0.94
Bundler-generated AMD loader for a lazily loaded chunk.
Reasoning
Expected bundler output in a test fixture. The non-literal flag comes from the AMD dynamic-import wrapper, which is normal for code-split chunks.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/logo2.svg').href : new URL('logo2.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
{
likely benign
LLM, confidence 0.85
Bundler-generated CJS branch that loads Node's url module to resolve an asset path.
Reasoning
Expected output of a bundler test. The require('u' + 'rl') concatenation is a bundler artifact used to avoid bundling the Node url module in a browser-or-node conditional. It reads like a deliberate build pattern, not an attack, but the split string is what a hiding technique would look like, so confidence is a bit lower.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
likely benign
LLM, confidence 0.94
Bundler-generated arrow-function AMD loader for chunk A.
Reasoning
Expected bundler output in a test fixture. The arrow-wrapped AMD require is standard for lazy-loading chunks.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const importA = () => new Promise(function (resolve, reject) { require(['./generated-a'], resolve, reject); });
const importB = () => new Promise(function (resolve, reject) { require(['./generated-b'], resolve, reject); });
console.log(importA, importB);
likely benign
LLM, confidence 0.94
Bundler-generated arrow-function AMD loader for chunk B.
Reasoning
Expected bundler output in a test fixture. The arrow-wrapped AMD require is standard for lazy-loading chunks.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.94
Bundler-generated AMD dynamic import of a hashed chunk.
Reasoning
Expected bundler output in a deprecated test fixture. The AMD require loads a hashed chunk, which is ordinary code-splitting.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dep1');
new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); });
}));
likely benign
LLM, confidence 0.94
Bundler-generated AMD chained dynamic import of the next chunk.
Reasoning
Expected bundler output in a test fixture. The AMD require chains one chunk to the next, which is normal for chained dynamic imports.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); });
}));
likely benign
LLM, confidence 0.94
Bundler-generated AMD dynamic import of a dependency chunk.
Reasoning
Expected bundler output in a test fixture. The AMD require loads a dependency chunk, which is normal for chained dynamic imports.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
function dynamic (num) {
return new Promise(function (resolve, reject) { require(['./generated-dep2'], resolve, reject); })
.then(dep2 => {
return dep2.mult(num);
likely benign
LLM, confidence 0.94
Bundler-generated function that lazily loads a chunk and calls a method on it.
Reasoning
Expected bundler output in a test fixture. The function wraps an AMD dynamic import and chains a method call on the result, which is ordinary lazy-loading code.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import (
'./foo.js');
likely benign
LLM, confidence 0.90
Rollup-style test fixture for dynamic import with comments around the specifier.
Reasoning
This is a bundler test sample checking that comments inside an import() call do not break chunk naming. The specifier is a string literal with a webpackChunkName comment, and the code is ordinary dynamic import syntax with no obfuscation or execution of untrusted data.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(function (t) { return new Promise(function (resolve, reject) { require([t], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); }); })(dep);
}));
likely benign
LLM, confidence 0.90
Bundler-generated AMD require wrapper for a dynamic import with a variable specifier.
Reasoning
This is generated AMD output from a bundler test. The require() call with a variable specifier is the standard lowering of a dynamic import(dep) under AMD format, and the surrounding code only wraps the result in a Promise and namespace helper.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
likely benign
LLM, confidence 0.90
Test expectation file containing a dynamic import with a variable specifier.
Reasoning
This is expected output from a bundler test fixture. The bare import(dep) comes from a dynamic-import test case that deliberately uses a non-literal specifier, and nothing here decodes or runs hidden payloads.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
likely benign
LLM, confidence 0.90
Test expectation file with a dynamic import of a variable module.
Reasoning
This is an ES-format expected-output fixture from a bundler test suite. The import(dep) is the intended output of a dynamic import test and matches the source sample.
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
import(dep);
likely benign
LLM, confidence 0.90
Test source file using import(dep) with a variable specifier.
Reasoning
This is the source of a bundler chunking test that exercises dynamic import with a runtime-computed specifier. The pattern is a legitimate feature under test, not obfuscation or a dropper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./foo'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
}));
likely benign
LLM, confidence 0.90
Generated AMD require wrapper for a dynamic import of an external module.
Reasoning
This is generated AMD test output in which a dynamic import of an external module is lowered to require(['./foo'], ...). The specifier is a literal inside the test expectation, and the code is standard bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(function (n) { return n.dynamic$1; }).then(({dynamic}) => console.log('main1', dynamic));
}));
likely benign
LLM, confidence 0.90
Generated AMD require call loading a split chunk in a test fixture.
Reasoning
This is AMD expected output from a facade-chunk test. The require call loads a generated chunk and resolves a promise, which is routine module loading with no decoding or shell execution.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(dep2);
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); });
exports.dep2 = dep2;
likely benign
LLM, confidence 0.90
Generated AMD require loading a dynamic chunk in a manual-chunk test.
Reasoning
This is AMD expected output from a manual-chunk test. The require() of a generated chunk is the normal lowering of a dynamic import in the bundler's test suite.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const inlined = Promise.resolve().then(function () { return inlined$2; });
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.inlined = inlined;
likely benign
LLM, confidence 0.90
Generated AMD require of a separate chunk in an inline-colouring test.
Reasoning
This is bundler expected output for an inline-chunk colouring test. The require of a generated separate chunk is ordinary module loading and matches the source intent.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const separate = new Promise(function (resolve, reject) { require(['./generated-separate'], resolve, reject); });
exports.separate = separate;
likely benign
LLM, confidence 0.90
Generated AMD require of a separate chunk in a second entry of an inline-colouring test.
Reasoning
This is bundler expected output for the same inline-colouring test. The require call loads a generated chunk and exports its promise, with no suspicious behaviour.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
async function test() {
const dep = await new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); });
console.log(dep.obj.a.a.a);
}
likely benign
LLM, confidence 0.90
Generated AMD require awaited in a tree-shaking test fixture.
Reasoning
This is AMD expected output from a tree-shaking test. The awaited require of a generated dependency is standard lowering of an async dynamic import, and the logged property access is harmless.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep'], resolve, reject); }).then(({ obj }) => {
console.log(obj.a);
});
likely benign
LLM, confidence 0.90
Generated AMD require with a then-chain in a tree-shaking test fixture.
Reasoning
This is AMD expected output from a tree-shaking test using a .then() chain. The require loads a generated dependency and destructures a property, which is routine bundler output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
likely benign
LLM, confidence 0.90
Generated AMD require for the entry chunk in a default-only import test.
Reasoning
This is AMD expected output from a test covering default-only namespace imports. Both require calls load known local chunks and are the standard lowering of dynamic imports.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
var main = Promise.all([new Promise(function (resolve, reject) { require(['./entry'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }), new Promise(function (resolve, reject) { require(['./generated-other'], resolve, reject); })]);
return main;
likely benign
LLM, confidence 0.90
Generated AMD require for a second chunk in a default-only import test.
Reasoning
This is the second require call in the same AMD expected-output file from the default-only import test. It loads another generated chunk through the standard bundler pattern, so it is benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(({ value }) => console.log(value));
}));
dismissed
LLM, confidence 0.95
Generated AMD loader code that requires a fixed local chunk for a dynamic import.
Reasoning
This is Rollup's generated AMD output for a chunking test. The require call takes an array literal with a fixed relative path, so the specifier is literal and the non-literal flag is a scanner false positive. Nothing here is hostile.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(({ bar }) => console.log(bar()));
}));
dismissed
LLM, confidence 0.95
Generated AMD require of a fixed local chunk inside a test expectation file.
Reasoning
Rollup test fixture output. The AMD require uses a literal array containing a fixed chunk path, so the non-literal warning does not apply. No obfuscation or malicious behavior is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./lib'], resolve, reject); }).then(function (n) { return n.lib; }).then(console.log);
}));
dismissed
LLM, confidence 0.95
Generated AMD dynamic-import loader for a fixed module in a chunking test.
Reasoning
Expected-output fixture from Rollup's test suite. The require array holds a literal relative path, so the flag is a false positive. The surrounding code only logs a value.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module1'], resolve, reject); });
module.foo();
dismissed
LLM, confidence 0.95
Generated AMD dynamic import of a fixed local module in a namespace test.
Reasoning
Test fixture for dynamic import namespaces. The require uses a literal array of a fixed local module, and the rest of the snippet is ordinary test code calling foo.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module2'], resolve, reject); });
const module1 = module;
module1.foo();
dismissed
LLM, confidence 0.95
Generated AMD dynamic import of a fixed chunk followed by a property call.
Reasoning
Same generated Rollup fixture. The require array contains a literal path to a sibling chunk, and the code only reads and calls a property on the module namespace.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module3'], resolve, reject); });
const { foo } = module;
foo();
dismissed
LLM, confidence 0.95
Generated AMD dynamic import with destructuring of a fixed module namespace.
Reasoning
Test expectation output. The literal array require is a fixed local module, and the destructuring and call are ordinary JavaScript exercising namespace handling.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module4'], resolve, reject); });
const { foo, ...rest } = module;
dismissed
LLM, confidence 0.95
Generated AMD dynamic import followed by object rest destructuring in a test.
Reasoning
Rollup test fixture. The require specifier is a literal in an array, and the object rest destructuring is a normal language feature exercised by the test.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module5'], resolve, reject); });
readFoo({ foo: () => {} });
readFoo(module);
dismissed
LLM, confidence 0.95
Generated AMD dynamic import with helper calls in a namespace test.
Reasoning
Expected-output fixture. The require uses a literal path to a fixed module, and the code passes objects to a helper, which is typical test scaffolding.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module6'], resolve, reject); });
function b({ foo }) {
foo();
dismissed
LLM, confidence 0.95
Generated AMD dynamic import with a nested destructuring function in a test.
Reasoning
Rollup test output. The literal array require loads a fixed module, and the nested function with destructured parameters is ordinary code for testing namespace access.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module7'], resolve, reject); });
function b({ foo, ...rest }) {
dismissed
LLM, confidence 0.95
Generated AMD dynamic import with rest destructuring in a test function.
Reasoning
Test fixture. The require array holds a literal relative path, and the rest-parameter destructuring is standard JavaScript with no encoding or dynamic execution.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module8'], resolve, reject); });
function b(o1, ...rest) {
dismissed
LLM, confidence 0.95
Generated AMD dynamic import with a rest-parameter function in a test.
Reasoning
Expected-output file from a chunking test. The require is a literal array of a fixed module, and the function with rest parameters is ordinary test code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module9'], resolve, reject); });
function b({ foo = 1 }) {
dismissed
LLM, confidence 0.95
Generated AMD dynamic import with default-valued destructuring in a test.
Reasoning
Rollup fixture output. The literal require array loads a fixed chunk, and the default-valued destructuring is ordinary syntax exercised by the test.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
(async () => {
const module = await new Promise(function (resolve, reject) { require(['./generated-module10'], resolve, reject); });
(module).bar();
(global.unknown && module).foo();
dismissed
LLM, confidence 0.95
Generated AMD dynamic import followed by property calls on the module namespace in a test.
Reasoning
Test expectation output. The require uses a literal path to a fixed module, and the optional-style property access and calls are plain test code with no hidden behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./other'], resolve, reject); }).then(result =>
assert.deepEqual(result, { value: 'shared', extra: 'extra' })
);
likely benign
LLM, confidence 0.94
Bundler-generated AMD dynamic import followed by a test assertion.
Reasoning
Expected bundler output in a test fixture. The AMD require loads a shared chunk and is followed by an assertion, which fits a test of dynamic imports.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
exports.promise = promise;
likely benign
LLM, confidence 0.93
AMD-format dynamic import loader in a Rollup test fixture.
Reasoning
This is Rollup's expected AMD output for a dynamic import. The array literal ['./generated-dynamic'] is a fixed module path, and the flag is a false positive from the AST pass not recognising the array form.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.93
AMD dynamic-import loader calling require on './main'.
Reasoning
Standard AMD require with a fixed array of a relative module path, wrapped in a Promise. This is ordinary generated loader code in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.93
AMD dynamic-import loader for './main' in a chunking test fixture.
Reasoning
Same benign AMD dynamic-import pattern with a fixed relative path, in Rollup expected output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
likely benign
LLM, confidence 0.93
AMD dynamic-import loader for './generated-dynamic' in a test fixture.
Reasoning
Fixed-path AMD require array in generated Rollup test output. No dynamic specifier or payload is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); }).then(function (n) { return n.main; }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.93
AMD dynamic-import loader for './main' in a chunking test fixture.
Reasoning
Standard AMD require of a fixed relative module inside a Promise, typical of bundler output in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
const promise = new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(result => console.log('main', result, value));
var main = Object.freeze({
likely benign
LLM, confidence 0.93
AMD dynamic-import loader for './generated-dynamic' in a test fixture.
Reasoning
Benign generated AMD loader with a fixed module path. The name 'tainted' refers to the Rollup test scenario, not to malicious content.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(result => console.log('importer', result));
}));
likely benign
LLM, confidence 0.92
AMD dynamic-import loader for './main' with namespace interop.
Reasoning
Fixed-path AMD require with a normal callback that wraps the namespace. This is standard Rollup interop output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('no importer', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.85
CJS code that resolves a generated chunk URL via require('u'+'rl').pathToFileURL in a test fixture.
Reasoning
The require('u' + 'rl') split is a known Rollup technique for import.meta.url handling in CJS output, used to keep bundlers from resolving the module. Here it only calls pathToFileURL on a local chunk path, which is benign.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from maim', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib.js').href : new URL('generated-lib.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.85
CJS console log that builds a chunk URL with the split require('u'+'rl') pattern.
Reasoning
Same Rollup-generated import.meta.url pattern. The concatenated 'url' module name only obtains pathToFileURL for a local generated file, with no payload or execution of fetched content.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
console.log('from nested', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generated-lib2.js').href : new URL('generated-lib2.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.85
CJS code that resolves generated-lib2.js URL via the split require('u'+'rl') pattern.
Reasoning
Same benign Rollup import.meta.url shim, resolving a local generated-lib2.js path. It is a known output pattern, not a dropper.
-
file mixes tab and space indentation (41 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'allows adding additional chunks to be used in workers',
options: {
input: 'main',
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./chunks/nested'], resolve, reject); })
.then(result => result.getWorkerMessage())
.then(message => (document.body.innerHTML += `<h1>2: ${message.data}</h1>`));
likely benign
LLM, confidence 0.92
AMD dynamic-import loader for './chunks/nested' in a worker test fixture.
Reasoning
AMD require with a fixed array path for a nested chunk, chained to a Promise. This is ordinary generated Rollup output for a worker test.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker-proxy.js').href : new URL('worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.94
Rollup-generated CJS fallback that resolves a worker script URL via require('url').
Reasoning
This is Rollup's standard CJS output for resolving import.meta.url in a worker. The 'u'+'rl' split is Rollup's own helper for the require('url') call, and it only runs in Node where document is undefined. The path is built from __dirname and a fixed asset name, and no untrusted input reaches it. The file is a test expected-output fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
PLACEHOLDER((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker.js').href : new URL('worker.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.94
Rollup import.meta.url polyfill resolving a worker path in a Node CJS build.
Reasoning
Same Rollup import.meta.url polyfill pattern, with a fixed relative worker path joined to __dirname. It is a standard build-tool transform inside a test fixture, with no network or execution of fetched content.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.94
Rollup CJS import.meta.url fallback that builds a worker URL from a fixed path.
Reasoning
Rollup's standard CJS fallback for import.meta.url, resolving a fixed chunk path relative to __dirname for a Worker. Benign build output in a test fixture.
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
const getWorkerMessage = () => new Promise(resolve => {
const worker = new Worker(new URL('chunks/worker-proxy.js', import.meta.url).href);
worker.onmessage = resolve;
});
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
CSS.paintWorklet.addModule((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worklet.js').href : new URL('chunks/worklet.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
likely benign
LLM, confidence 0.94
Rollup CJS fallback resolving a paint worklet module URL from a fixed path.
Reasoning
Rollup's import.meta.url CJS polyfill passed to CSS.paintWorklet.addModule with a fixed chunk path. The require is a build artifact, not attacker-controlled dynamic loading.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./ext\'ernal'], function (m) { resolve(_interopNamespaceDefault(m)); }, reject); });
console.log('main', dep.value);
likely benign
LLM, confidence 0.92
AMD dynamic import of an external module in an emit-chunk fixture.
Reasoning
AMD require with a fixed array literal for an external module, plus namespace interop. Standard generated test output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./entry-deb-amd'], function (m) { resolve(_interopNamespaceDefaultOnly(m)); }, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.95
AMD dynamic import of a relative entry module.
Reasoning
Standard Rollup AMD dynamic-import output requiring a fixed relative module with a literal array. The flagged require is the AMD loader convention, not obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main');
new Promise(function (resolve, reject) { require(['./chunk-deb--Bz6x-oi-amd'], resolve, reject); }).then(console.log);
}));
likely benign
LLM, confidence 0.95
AMD-format dynamic import loading a sibling chunk module.
Reasoning
This is Rollup's AMD code-splitting output. require(['./chunk-...'], ...) is a literal-array AMD dependency load of a sibling chunk, which is the standard AMD dynamic import form. The specifier is a fixed relative chunk name.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
showImage(logo);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.showImage = showImage;
likely benign
LLM, confidence 0.95
AMD dynamic import of a nested chunk in a test fixture.
Reasoning
AMD dynamic import with a literal array naming a fixed relative chunk, as emitted by Rollup. The scanner flagged the non-literal-specifier heuristic, but the specifier here is a literal string.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo1-FquQRdV3.svg').href : new URL('assets/logo1-FquQRdV3.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.94
Rollup CJS fallback resolving an emitted asset URL.
Reasoning
Rollup's CJS import.meta.url polyfill for an emitted SVG asset, using a fixed path under __dirname. Standard build output in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/../assets/logo2-DJfvToLT.svg').href : new URL('../assets/logo2-DJfvToLT.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.94
Rollup CJS fallback resolving a nested asset URL from a fixed path.
Reasoning
Same Rollup import.meta.url CJS polyfill with a fixed relative asset path. Benign build artifact.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
renderStart = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/renderStart-B4XObdBk.txt').href : new URL('assets/renderStart-B4XObdBk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).hre
likely benign
LLM, confidence 0.94
Rollup CJS fallback resolving an emitted text asset URL.
Reasoning
Rollup's CJS import.meta.url fallback for an emitted text asset with a fixed path. The require('url') is used only in Node, and the path is not attacker-controlled.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderStartNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderStart.txt').href : new URL('renderStart.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
A generated CJS test-fixture branch that loads the url module via a split string and builds an asset URL, with a browser fallback.
Reasoning
The require call uses 'u' + 'rl' to name the built-in url module, which is an odd construction. It sits in a rollup chunking-form test fixture's expected output, and the same branch pairs it with a browser fallback using document.currentScript. This reads as generated test output from a bundler, not a payload. It is still worth a note because string-split module names are a minor evasion pattern.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const bannerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/banner.txt').href : new URL('banner.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated fixture line that resolves a banner asset URL through the url module or a browser fallback.
Reasoning
Same generated fixture pattern as the other lines in this file: a split 'u'+'rl' require with a browser URL fallback for a banner text asset. No sensitive action or encoded payload is present.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const footerNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/footer.txt').href : new URL('footer.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated fixture line resolving a footer asset URL through url or a browser fallback.
Reasoning
Same generated fixture pattern: split-string require of url plus a browser fallback, resolving a footer text asset. Nothing here executes attacker-controlled data.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const introNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/intro.txt').href : new URL('intro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated fixture line resolving an intro asset URL through url or a browser fallback.
Reasoning
Same generated fixture pattern: split-string require of url plus a browser fallback, resolving an intro text asset with no sensitive behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const outroNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/outro.txt').href : new URL('outro.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated fixture line resolving an outro asset URL through url or a browser fallback.
Reasoning
Same generated fixture pattern: split-string require of url plus a browser fallback, resolving an outro text asset with no sensitive behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const renderChunkNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/renderChunk.txt').href : new URL('renderChunk.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated fixture line resolving a renderChunk asset URL through url or a browser fallback.
Reasoning
Same generated fixture pattern: split-string require of url plus a browser fallback, resolving a renderChunk text asset with no sensitive behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const generateBundleNamed = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/generateBundle.txt').href : new URL('generateBundle.txt', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
likely benign
LLM, confidence 0.85
Generated fixture line resolving a generateBundle asset URL through url or a browser fallback.
Reasoning
Same generated fixture pattern: split-string require of url plus a browser fallback, resolving a generateBundle text asset with no sensitive behavior.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic'], resolve, reject); }).then(console.log);
}));
dismissed
LLM, confidence 0.92
AMD dynamic-import wrapper that loads a fixed local module with a literal dependency array.
Reasoning
This is AMD-format dynamic loading with a literal dependency array (['./generated-dynamic']) inside a Promise. The specifier is a fixed literal, so the non-literal flag is a false positive from the AMD require signature.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dep1'], resolve, reject); }).then(function (n) { return n.dep1; }).then(console.log);
}));
dismissed
LLM, confidence 0.92
AMD dynamic-import wrapper loading a fixed local dependency.
Reasoning
AMD require with a literal dependency array (['./generated-dep1']) inside a Promise, a standard rollup dynamic-import output. The flag misreads the AMD call form as a non-literal specifier.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise((resolve, reject) => require(['./generated-dep1'], resolve, reject)).then(n => n.dep1).then(console.log);
}));
dismissed
LLM, confidence 0.92
Arrow-function AMD dynamic-import wrapper loading a fixed local dependency.
Reasoning
Arrow-function variant of the AMD dynamic-import wrapper, with a literal dependency array (['./generated-dep1']). Benign generated code, and the flag comes from the AMD call form.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
dismissed
LLM, confidence 0.92
AMD dynamic-import in a generated dependency file that loads a fixed local module.
Reasoning
AMD require with a literal array (['./generated-dynamicDep']) inside a Promise in a rollup test fixture. The specifier is a fixed string, so this is a false positive.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
exports.value = value;
likely benign
LLM, confidence 0.93
Rollup-style AMD bundle output lazily loading a generated dependency chunk.
Reasoning
The specifier is an array literal containing a constant string, which is standard AMD dynamic loading emitted by a bundler. The scanner's non-literal flag is a false positive from the array form, and the file is a chunking test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log(value);
new Promise(function (resolve, reject) { require(['./generated-dynamicDep'], resolve, reject); });
const dep = 'dep';
likely benign
LLM, confidence 0.93
Generated AMD chunk that lazily requires a constant dependency path.
Reasoning
Same as the sibling finding: a constant single-element array in an AMD require call inside a generated test expectation, with no dynamic or hidden behaviour.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-lib'], resolve, reject); }).then(function (n) { return n.lib; });
}));
likely benign
LLM, confidence 0.93
Bundled AMD entry that lazily loads a sibling chunk and reads an export.
Reasoning
A constant array-literal AMD require of a sibling chunk, followed by ordinary use of the resolved module. This is normal bundler output in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
const url = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('0/1/nested.js', document.baseURI).href));
exports.url = url;
likely benign
LLM, confidence 0.85
Generated CJS shim that computes the module URL, using a split require of the url module.
Reasoning
The require('u' + 'rl') call is a bundler's CJS polyfill for import.meta.url, guarded by a typeof document check. The string split looks like obfuscation, but this is a known generated pattern for resolving the module's URL in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
log('main: ' + new URL(module.uri, document.baseURI).href);
new Promise(function (resolve, reject) { require(['./nested/chunk'], resolve, reject); });
exports.log = log;
likely benign
LLM, confidence 0.85
AMD bundle using import.meta.url polyfill and lazily loading a nested chunk.
Reasoning
A constant array-literal AMD require of a nested chunk, alongside a standard new URL(module.uri, document.baseURI) expression. Both are bundler output for import.meta.url handling in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
log('main: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('main.js', document.baseURI).href)));
likely benign
LLM, confidence 0.85
CJS bundle computing the module URL via a generated import.meta.url polyfill.
Reasoning
The require('u' + 'rl') call is the standard bundler CJS fallback for import.meta.url, guarded by a document-type check. It only computes a file URL and is not a dropper.
-
`require` called with a non-literal specifier (ast pass, confidence 0.80)
main.log('nested: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('nested/chunk.js', document.baseURI).href)));
likely benign
LLM, confidence 0.85
Nested CJS chunk building a URL string through the import.meta.url polyfill.
Reasoning
The same generated import.meta.url polyfill with a split url require, used to build a log string. It is a benign test expectation rather than obfuscated malicious code.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
exports.shared = shared;
likely benign
LLM, confidence 0.92
Bundled AMD module lazily loading a dynamic chunk in a chained-import test.
Reasoning
A constant array-literal AMD require of a dynamic chunk within a generated test fixture. The non-literal flag is a false positive.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
console.log('dynamic1');
likely benign
LLM, confidence 0.92
Generated AMD chunk that lazily loads another chunk to test circular imports.
Reasoning
A constant array-literal AMD require for a circular dynamic import between generated chunks. This is expected bundler output in a test fixture.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./main'], resolve, reject); });
console.log('dynamic2');
likely benign
LLM, confidence 0.92
Generated AMD chunk that lazily requires the main module to test circularity.
Reasoning
A constant array-literal AMD require of the main module for a circular-import test. Benign generated output.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.92
AMD entry that lazily loads two chunks to exercise circular dynamic imports.
Reasoning
Constant array-literal AMD requires of two generated chunks in a circular-import test. The scanner's non-literal claim is wrong for this form.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
console.log('main');
likely benign
LLM, confidence 0.92
Second lazy AMD require in the circular-imports entry, loading a fixed chunk.
Reasoning
Another constant array-literal AMD require in the same generated entry, referencing a fixed chunk path. Benign test expectation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('dynamic1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic2'], resolve, reject); });
}));
dismissed
LLM, confidence 0.93
AMD-style dynamic require of a sibling chunk with a literal path, in a Rollup chunking test fixture.
Reasoning
The flagged require call is an AMD dynamic import whose specifier is a string literal ('./generated-dynamic2') inside an array. The scanner treated it as non-literal, which is a false positive from a bundler test expectation file.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
dismissed
LLM, confidence 0.93
AMD dynamic require of a literal chunk path in a bundler test expectation.
Reasoning
Same pattern: require(['./generated-dynamic1']) with a literal string specifier in an expected-output bundle. Standard AMD lazy loading, not obfuscation.
-
`require` called with a non-literal specifier (ast pass, confidence 0.60)
console.log('main1', dep.value);
new Promise(function (resolve, reject) { require(['./generated-dynamic1'], resolve, reject); });
}));
dismissed
LLM, confidence 0.93
AMD dynamic require with a literal chunk path in a Rollup test fixture.
Reasoning
Literal-path AMD require of a sibling chunk, identical in structure to the other expected outputs. Benign bundler output.
-
18 of 35 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
18 of 32 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
16 of 30 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
24 of 38 non-conventional identifiers are single-character (63%) (token pass, confidence 0.50)
-
24 of 53 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (3 tab-indented and 35 space-indented lines) (raw pass, confidence 0.40)
var num = 2;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 49 space-indented lines) (raw pass, confidence 0.40)
var num = 1;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (4 tab-indented and 49 space-indented lines) (raw pass, confidence 0.40)
var num = 3;
console.log('referenced asset', new URL(require.toUrl('./asset-test-C4X7hChn'), document.baseURI).href);
-
file mixes tab and space indentation (7 tab-indented and 35 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function (exports, module) {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (13 tab-indented and 49 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-B9YfStri.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
file mixes tab and space indentation (13 tab-indented and 49 space-indented lines) (raw pass, confidence 0.40)
System.register(['./chunk-dep2-B9YfStri.js'], (function (exports, module) {
'use strict';
var num$1;
return {
-
line length 1540 characters (raw pass, confidence 0.50)
export { lazy, v1, v10, v100, v101, v102, v103, v104, v105, v106, v107, v108, v109, v11, v110, v111, v112, v113, v114, v115, v116, v117, v118, v119, v12, v120, v121, v122, v123, v124, v125, v126, v127, v128, v129, v13, v130, v131, v132, v133, v134, v135, v136, v137, v138, v139, v14, v140, v141, v142, v143, v144, v145,
-
file mixes tab and space indentation (8 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
spawnArgs: ['--config'],
env: { FORCE_COLOR: undefined, NO_COLOR: true },
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'displays logs',
skipIfWindows: true,
spawnArgs: ['--config'],
-
21 of 48 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
23 of 52 non-conventional identifiers are single-character (44%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (43 tab-indented and 21 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'immediately reloads the config file if a change happens while it is parsed',
spawnArgs: ['-cw'],
before() {
-
file mixes tab and space indentation (42 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'keeps watching the config file in case the config is changed to an invalid state',
spawnArgs: ['-cw'],
before() {
-
mean non-conventional identifier length 1.95 over 21 names (token pass, confidence 0.50)
-
line length 1453 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopName
-
line length 1429 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&
-
line length 629 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1342 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceCompat(e){return e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e)}function _interopName
-
line length 576 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:function(){return defaultCompat.foo}});Object.keys(defaultCompat).forEach(function(k){i
-
line length 1063 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[fu
-
line length 1948 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 1361 characters (raw pass, confidence 0.50)
define(['require','exports','externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(require,exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&
-
line length 1337 characters (raw pass, confidence 0.50)
'use strict';require('externalNoImport');var defaultCompat=require('external'),externalAuto=require('externalAuto'),externalDefault=require('externalDefault'),externalDefaultOnly=require('externalDefaultOnly');var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'d
-
line length 596 characters (raw pass, confidence 0.50)
import'externalNoImport';import*as defaultCompat from'external';import defaultCompat__default,{b,foo}from'external';export*from'external';export{foo}from'external';import externalAuto from'externalAuto';import*as externalDefault from'externalDefault';import*as externalDefaultOnly from'externalDefaultOnly';function _mer
-
line length 1250 characters (raw pass, confidence 0.50)
var bundle=(function(exports,externalNoImport,defaultCompat,externalAuto,externalDefault,externalDefaultOnly){'use strict';var _interopDefault=e=>e&&e.__esModule?e:{default:e};var _interopNamespaceCompat=e=>e&&typeof e==='object'&&'default'in e?e:_interopNamespaceDefault(e);var _interopNamespaceDefaultOnly=e=>Object.fr
-
line length 538 characters (raw pass, confidence 0.50)
console.log(externalDefaultOnly__namespace);var main=_mergeNamespaces({__proto__:null,get a(){return exports.a},foo:defaultCompat.foo},[defaultCompat__namespace]);Object.defineProperty(exports,"foo",{enumerable:true,get:()=>defaultCompat.foo});Object.keys(defaultCompat).forEach(k=>{if(k!=='default'&&!Objec
-
line length 992 characters (raw pass, confidence 0.50)
System.register('bundle',['externalNoImport','external','externalAuto','externalDefault','externalDefaultOnly'],(function(exports,module){'use strict';var _starExcludes={__proto__:null,a:1,default:1,foo:1};var b,defaultCompat,defaultCompat__default,foo,externalAuto,externalDefault,externalDefaultOnly;return{setters:[()
-
line length 1844 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('externalNoImport'),require('external'),require('externalAuto'),require('externalDefault'),require('externalDefaultOnly')):typeof define==='function'&&define.amd?define(['exports','externalNoImport','external','externalAuto','extern
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 707 characters (raw pass, confidence 0.50)
define(['exports','external'],(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,
-
line length 741 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});const foo$1=require('external');function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProp
-
line length 688 characters (raw pass, confidence 0.50)
var bundle=(function(exports,foo$1){'use strict';function _interopNamespaceCompat(e){if(e&&typeof e==='object'&&'default'in e)return e;const n=Object.create(null);if(e){for(const k in e){if(k!=='default'){const d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:()=>e[k]});}}}n
-
line length 620 characters (raw pass, confidence 0.50)
System.register('bundle',['external'],(function(exports){'use strict';const _starExcludes={__proto__:null,default:1,syntheticMissing:1};var foo__default,foo$1;return{setters:[module=>{foo__default=module.default;foo$1=module;const setter={__proto__:null};for(const name in module){if(!_starExcludes[name])setter[name]=mo
-
line length 1028 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external')):typeof define==='function'&&define.amd?define(['exports','external'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,(()=>{const current=g.bundle;const e=g.bundle={};f(e,g.external);e.noConflict=()=>{g.bundle=c
-
line length 1153 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1187 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1084 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 722 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module["function"];exports({bar:module["function"],default:module,void:module["default"]});},function(module){defaultOnly=module
-
line length 1455 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
line length 1150 characters (raw pass, confidence 0.50)
define(['module','exports','external','externalDefaultOnly','external2'],(function(module,exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNam
-
line length 1184 characters (raw pass, confidence 0.50)
'use strict';Object.defineProperty(exports,'__esModule',{value:true});var external=require('external'),defaultOnly=require('externalDefaultOnly'),someDefault=require('external2');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:nul
-
line length 574 characters (raw pass, confidence 0.50)
import {function as _function}from'external';import*as external from'external';export{external as default };export{function as bar,default as void}from'external';import*as defaultOnly from'externalDefaultOnly';import someDefault from'external2';function _mergeNamespaces(n, m){m.forEach(function(e){e&&typeof e!=='string
-
line length 1081 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external,defaultOnly,someDefault){'use strict';function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespaceDefaultOnly(e){return Object.freeze({__proto__:null,default:e})}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e)
-
line length 710 characters (raw pass, confidence 0.50)
System.register('bundle',['external','externalDefaultOnly','external2'],(function(exports,module){'use strict';var _function,defaultOnly,someDefault;return{setters:[function(module){_function=module.function;exports({bar:module.function,default:module,void:module.default});},function(module){defaultOnly=module;},functi
-
line length 1452 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external'),require('externalDefaultOnly'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external','externalDefaultOnly','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bun
-
20 of 46 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 15 space-indented lines) (raw pass, confidence 0.40)
console.log(
<div>
Hello
World
-
file mixes tab and space indentation (54 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'logs side effects',
options: {
experimentalLogSideEffects: true,
-
mean non-conventional identifier length 1.97 over 59 names (token pass, confidence 0.50)
-
24 of 46 non-conventional identifiers are single-character (52%) (token pass, confidence 0.50)
-
18 of 45 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
line length 785 characters (raw pass, confidence 0.50)
define(['require','exports','external1','external2'],(function(require,exports,external1,external2){'use strict';function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = new Promise(function(c,e){require(['external3'],function(m
-
line length 740 characters (raw pass, confidence 0.50)
'use strict';var external1=require('external1'),external2=require('external2');function _interopNamespaceDefault(e){var n=Object.create(null);if(e){for(var k in e){n[k]=e[k];}}n.default=e;return Object.freeze(n)}const dynamic = Promise.resolve().then(function(){return _interopNamespaceDefault(require('exte
-
line length 550 characters (raw pass, confidence 0.50)
var bundle=(function(exports,external1,external2){'use strict';const dynamic = import('external3');exports.external1=external1.external1;exports.dynamic=dynamic;Object.prototype.hasOwnProperty.call(external2,'__proto__')&&!Object.prototype.hasOwnProperty.call(exports,'__proto__')&&Object.defineProperty(exports,'__proto
-
line length 811 characters (raw pass, confidence 0.50)
(function(g,f){typeof exports==='object'&&typeof module!=='undefined'?f(exports,require('external1'),require('external2')):typeof define==='function'&&define.amd?define(['exports','external1','external2'],f):(g=typeof globalThis!=='undefined'?globalThis:g||self,f(g.bundle={},g.external1,g.external2));})(this,(function(
-
23 of 32 non-conventional identifiers are single-character (72%) (token pass, confidence 0.50)
-
18 of 37 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
20 of 39 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
line length 928 characters (raw pass, confidence 0.50)
while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 169870592) !== 0) || ((((_la - 34)) & ~0x1F) === 0 && ((1 << (_la - 34)) & 268573697) !== 0) || ((((_la - 72)) & ~0x1F) === 0 && ((1 << (_la - 72)) & 2151694339) !== 0) || ((((_la - 104)) & ~0x1F) === 0 && ((1 << (_la - 104)) & 536936449) !== 0) || ((((_la
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18880593) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100680481) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074311168) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1932 characters (raw pass, confidence 0.50)
if ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014219) !== 0) || ((((_la - 74)) & ~0x1F) === 0 && ((1 << (_la - 74)) & 18878481) !== 0) || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 100679969) !== 0) || ((((_la - 150
-
line length 1619 characters (raw pass, confidence 0.50)
if (!((((_la) & ~0x1F) === 0 && ((1 << _la) & 1074302976) !== 0) || ((((_la - 36)) & ~0x1F) === 0 && ((1 << (_la - 36)) & 11014211) !== 0) || _la === 74 || _la === 95 || ((((_la - 117)) & ~0x1F) === 0 && ((1 << (_la - 117)) & 16673) !== 0) || _la === 160 || _la === 170 || ((((_la - 241)) & ~0x1F) === 0
-
40 of 71 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
40 of 68 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
36 of 61 non-conventional identifiers are single-character (59%) (token pass, confidence 0.50)
-
40 of 74 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
-
32 of 67 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
40 of 95 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
32 of 60 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
{
console.log('code21');
}
keep1() ; keep2();
-
mean non-conventional identifier length 1.62 over 45 names (token pass, confidence 0.50)
-
mean non-conventional identifier length 1.74 over 92 names (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
25 of 49 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
22 of 39 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
-
25 of 55 non-conventional identifiers are single-character (45%) (token pass, confidence 0.50)
-
25 of 52 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
19 of 39 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (19 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
console.log(2); console.log(2);
-
file mixes tab and space indentation (10 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (11 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function () {
'use strict';
var a = '1\
-
file mixes tab and space indentation (15 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
System.register([], (function () {
'use strict';
return {
execute: (function () {
-
file mixes tab and space indentation (12 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
(function (factory) {
typeof define === 'function' && define.amd ? define(factory) :
factory();
})((function () { 'use strict';
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
var a = '1\
2';
var b = '1\
-
file mixes tab and space indentation (3 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
class MyClass extends ExternalElement {
constructor() {
super();
console.log('MyClassExtendsExternalClass');
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDF06 (no preceding high surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned high surrogate \uD834 (no matching low surrogate) (token pass, confidence 0.65)
var ILL_FORMED_UNICODE = fails(function () {
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
orphaned low surrogate \uDEAD (no preceding high surrogate) (token pass, confidence 0.65)
return $stringify('\uDF06\uD834') !== '"\\udf06\\ud834"'
|| $stringify('\uDEAD') !== '"\\udead"';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
return Function('return require("' + name + '")')();
} catch (error) { }
}
likely benign
LLM, confidence 0.80
core-js global lookup fallback using Function to construct a require expression.
Reasoning
This is core-js's global-object fallback, which builds a require call string from a fixed name inside a try block. The code is a known polyfill idiom and the eslint comment shows deliberate use. It is still dynamic execution, but in library output it is expected.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
validateArgumentsLength(arguments.length, 1);
var fn = isCallable(handler) ? handler : Function(handler);
var args = arraySlice(arguments, 1);
queue[++counter] = function () {
likely benign
LLM, confidence 0.80
core-js setTimeout/setInterval polyfill that wraps string handlers with Function.
Reasoning
This is the core-js timers polyfill, which passes a string handler to Function as in the legacy setTimeout contract. The construct is dynamic execution, but it matches a well-known, documented polyfill and sits in a test sample.
-
orphaned high surrogate \uD842 (no matching low surrogate) (token pass, confidence 0.65)
return '𠮷'.at(-2) !== '\uD842';
});
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
var boundArgs = validateArgumentsLength(arguments.length, 1) > firstParamIndex;
var fn = isCallable(handler) ? handler : Function(handler);
var params = boundArgs ? arraySlice(arguments, firstParamIndex) : [];
var callback = boundArgs ? function () {
likely benign
LLM, confidence 0.80
core-js timer polyfill that wraps a handler via Function in a test expectation.
Reasoning
Same core-js timers polyfill pattern as the other occurrence, converting a string handler to a Function. Legacy compatibility code, not a payload.
-
line length 1121 characters (raw pass, confidence 0.50)
var isCallable; var fnToStr = Function.prototype.toString, constructorRegex = /^\s*class /, isES6ClassFn = function isES6ClassFn(value) { try { var fnStr = fnToStr.call(value); var singleStripped = fnStr.replace(/\/\/.*\n/g, ''); var multiStripped = singleStripped.
-
file mixes tab and space indentation (23 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'synthetic named exports',
options: {
plugins: [
-
30 of 57 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
-
78 of 143 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
28 of 67 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
24 of 57 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
30 of 72 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (116 tab-indented and 6 space-indented lines) (raw pass, confidence 0.40)
function _mergeNamespaces(n, m) {
m.forEach(function (e) {
e && typeof e !== 'string' && !Array.isArray(e) && Object.keys(e).forEach(function (k) {
if (k !== 'default' && !(k in n)) {
-
file mixes tab and space indentation (2 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose')};
}
-
file mixes tab and space indentation (2 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
function process() {
using _ = {
[Symbol.dispose]: () => console.log('dispose'),
[Symbol.asyncDispose]: () => console.log('asyncDispose'),
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
try {
const function_ = new Function(contextKeys, code);
function_.apply({}, contextValues);
} catch (error) {
likely benign
LLM, confidence 0.88
Test harness constructing a Function from generated code and context values.
Reasoning
In the Rollup function-output test harness, new Function(contextKeys, code) runs generated test code with a context. Eval-like execution is the purpose of the test runner.
-
file mixes tab and space indentation (19 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'should provide json hint when importing a no export json file',
error: {
binding: 'default',
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function getFoo() {
return foo;
}
-
16 of 33 non-conventional identifiers are single-character (48%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (40 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles circular reexports',
exports(exports) {
assert.strictEqual(exports.exists, 42);
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
function Bar () {
this.inheritsFromBaz = this.isBaz;
}
-
19 of 47 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
-
17 of 31 non-conventional identifiers are single-character (55%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (12 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.finally(() => {
finallyCalled = true;
})
-
file mixes tab and space indentation (10 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
export const test = import('./dep.js')
.then(() => {
const obj = {
value: false,
-
file mixes tab and space indentation (20 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'Throw descriptive error message for used export is not defined',
error: {
binding: 'foo',
-
`eval` called with a non-literal expression (ast pass, confidence 0.75)
import 'external';
eval(this);
likely benign
LLM, confidence 0.80
Test fixture that calls eval on this as part of a plugin logging test.
Reasoning
A two-line test sample with eval(this) after an import. It looks odd, but it is a fixture for logging behavior, with no payload, network, or encoded content visible. The sample context suggests a test case.
-
file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
if (!b.fromExternal) {
throw new Error('External export not included');
}
-
36 of 58 non-conventional identifiers are single-character (62%) (token pass, confidence 0.50)
-
file mixes tab and space indentation (5 tab-indented and 4 space-indented lines) (raw pass, confidence 0.40)
export const awaitable = async (iterable) => {
for await (const value of iterable) {
}
}
-
file mixes tab and space indentation (26 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
function test1() {
return true ?
-
file mixes tab and space indentation (12 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
const switchSubmit = state => {
if (state == 1) {
assert.ok(false);
} else if (state == 0) {
-
file mixes tab and space indentation (34 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
module.exports = defineTest({
description: 'handles when a low resolution sourcemap is used to report an error',
options: {
plugins: [
-
file mixes tab and space indentation (570 tab-indented and 9 space-indented lines) (raw pass, confidence 0.40)
describe('incremental', () => {
let resolveIdCalls;
let transformCalls;
let modules;
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
globals,
likely benign
LLM, confidence 0.90
Test helper running IIFE-bundled code through the Function constructor.
Reasoning
The function is built from a list of global keys and executed with a globals object. This is a Rollup test helper that runs bundled IIFE output to check behavior.
-
file mixes tab and space indentation (490 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)
describe('misc', () => {
it('avoids modification of options or their properties', () => {
const { freeze } = Object;
return rollup.rollup(
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
assert.doesNotThrow(() => new Function(umdCode), 'UMD output should be valid JavaScript');
});
dismissed
LLM, confidence 0.90
Test assertion that validates UMD output parses via the Function constructor.
Reasoning
new Function(umdCode) is only used in an assertion to check that UMD output parses. It does not run the code beyond syntax validation, and the comment states the purpose.
-
`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
const globalKeys = Object.keys(globalsWithAssert);
const function_ = new Function(globalKeys, code);
function_.apply(
thisValue,
likely benign
LLM, confidence 0.90
Test helper executing UMD-bundled code via the Function constructor.
Reasoning
Same harness pattern as iife.js: a Function built from global keys runs UMD output with a this value in a test. Benign test infrastructure.
-
file mixes tab and space indentation (64 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
export function App() {
return <div>{'.'}</div>;
}
`;
-
file mixes tab and space indentation (70 tab-indented and 8 space-indented lines) (raw pass, confidence 0.40)
export function App() {
if (count) {
console.log(count);
}
-
base64-like blob (272 bytes, compression ratio 0.74) (in comment) (raw pass, confidence 0.36)
-
file mixes tab and space indentation (64 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
console.log(
this + 2
)
`;
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io