npm / source-map-js / 1.2.2

source-map-js 1.2.2

Source

https://github.com/7rulnik/source-map-js

Tag scanned

v1.2.2

Compared with

v1.2.1 (0 signals introduced since)

Files

46 scanned, 11 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

3.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 19:38

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-execution lib/quick-sort.js:111:20

   `Function(...)` called with a non-literal body (ast pass, confidence 0.90)

     let template = SortTemplate.toString();
     let templateFn = new Function(`return ${template}`)();
     return templateFn(comparator);
   }

   likely benign LLM, confidence 0.75 Builds a sort function at runtime by re-evaluating the serialized source of an internal SortTemplate function via new Function.

   Reasoning

   The Function constructor receives a string built from SortTemplate.toString(), which is the source of a function defined in the same module. That is an internal code-generation pattern, often used to specialize a sort routine for a given comparator, not a path for attacker-controlled input. The snippet shows no network, decoding, or shell activity. The dynamic execution is real and worth a reviewer's attention, but the visible code looks like legitimate metaprogramming rather than an obfuscated dropper. The residual doubt is that the template source is not shown in full, so its contents cannot be verified.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/7rulnik/source-map-js source-map-js && cd source-map-js
git checkout v1.2.2
disclude scan --severity info --diff v1.2.1 .