npm / schema-utils / 4.8.0

schema-utils 4.8.0

Source

https://github.com/webpack/schema-utils

Tag scanned

v4.8.0

Compared with

v4.7.0 (2 signals introduced since)

Files

43 scanned, 8 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

2.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-19 18:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import src/precompile.js:150:20 new in this release

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

         if (inline && name !== "uri") {
           return `(${require(`ajv/dist/runtime/${name}`).default.toString()})`;
         }

   likely benign LLM, confidence 0.85 Dynamic require of an ajv runtime helper module, with the name interpolated into a fixed path prefix.

   Reasoning

   The require specifier is a template literal with a fixed prefix 'ajv/dist/runtime/' and a name variable constrained to known runtime helper names within ajv's own precompile code. This is a normal dynamic require pattern in a code generator and does not execute attacker-controlled content. The AST pass flags it only because the specifier is non-literal.

2. info warn → info by review dynamic-import src/precompile.js:270:22 new in this release

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     try {
       minifier = await require(WEBPACK).javascript.syntax.printer.load();
     } catch (err) {
       throw new Error(

   likely benign LLM, confidence 0.85 Optional dynamic require of a webpack-related minifier module wrapped in try/catch with an error on failure.

   Reasoning

   The require target is a WEBPACK constant (a module name such as a bundler package) used to load a minifier printer inside a try/catch with a helpful error message. This is a conventional optional-dependency loading pattern in ajv's standalone code generation and is not obfuscation or a dropper.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/webpack/schema-utils schema-utils && cd schema-utils
git checkout v4.8.0
disclude scan --severity info --diff v4.7.0 .