npm / source-map-js / 1.2.2

source-map-js 1.2.2

Source

https://github.com/7rulnik/source-map-js

Tag scanned

v1.2.2

Compared with

v1.2.1 (0 signals introduced since)

Files

48 scanned, 9 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

4.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 16:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-execution lib/quick-sort.js:111:20

   `Function(...)` called with a non-literal body (ast pass, confidence 0.90)

     let template = SortTemplate.toString();
     let templateFn = new Function(`return ${template}`)();
     return templateFn(comparator);
   }

   likely benign LLM, confidence 0.80 A sort helper builds a specialized function by evaluating the stringified source of a local template function with new Function.

   Reasoning

   The Function constructor receives the source text of a local SortTemplate function via toString(), not data from an external or attacker-controlled source. The comparator is passed as a function value, not a string. This is a code-generation or specialization technique common in sort libraries. The dynamic execution is real, but the input is the package's own code, so it looks benign. Some doubt remains because the surrounding file is not shown.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/7rulnik/source-map-js source-map-js && cd source-map-js
git checkout v1.2.2
disclude scan --severity info --diff v1.2.1 .