string_decoder 1.3.0

Source: https://github.com/nodejs/string_decoder
Commit scanned: 60db81e031c1 (recorded by npm)
Compared with: 6e0a9286ed44 (0 signals introduced since)
Files: 21 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 12 info
Scan time: 7.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:16

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line test/common/countdown.js:1:1

line length 564 characters (raw pass, confidence 0.50)

var _createClass = function () { function defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, des

info long-line test/common/dns.js:1:1

line length 664 characters (raw pass, confidence 0.50)

var _slicedToArray = function () { function sliceIterator(arr, i) { var _arr = []; var _n = true; var _d = false; var _e = undefined; try { for (var _i = arr[Symbol.iterator](), _s; !(_n = (_s = _i.next()).done); _n = true) { _arr.push(_s.value); if (i && _arr.length === i) break; } } catch (err) { _d = true; _e = err;

info ~~warn~~ → info by review dynamic-attribute test/common/index.js:122:21

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
  var initHandles = {};
  var _async_wrap = process.binding('async_wrap');

  process.on('exit', function () {
```
likely benign LLM, confidence 0.90 Node test helper calling process.binding('async_wrap') to access internal async-wrap bindings during test teardown.
Reasoning
This is Node.js's own test harness helper file. process.binding('async_wrap') is a deprecated but legitimate internal access used in Node's test suite to inspect async hooks. The pattern is a standard, documented-in-source use, not obfuscation or malicious behavior.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:565:13

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
exports.hasMultiLocalhost = function hasMultiLocalhost() {
  var TCP = process.binding('tcp_wrap').TCP;
  var t = new TCP();
  var ret = t.bind('127.0.0.2', 0);
```
likely benign LLM, confidence 0.90 Node test utility probing multi-localhost support via the tcp_wrap internal binding.
Reasoning
Inside hasMultiLocalhost, the code uses process.binding('tcp_wrap') to probe whether binding to 127.0.0.2 works. This is a standard Node test utility for detecting platform capability; it is legitimate internal API use in the test suite.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:752:14

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
    get: function () {
      return process.binding('config').hasIntl;
    }
  });
```
likely benign LLM, confidence 0.92 Lazy getter reading the config binding to detect Intl support for tests.
Reasoning
A getter that reads process.binding('config').hasIntl to report ICU availability is a typical feature-detection idiom in Node's test common module. No network, exec, or encoded payload is involved.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:760:14

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
    get: function () {
      return process.binding('config').hasSmallICU;
    }
  });
```
likely benign LLM, confidence 0.92 Lazy getter reading the config binding to detect small-ICU builds for tests.
Reasoning
Same pattern as the hasIntl getter: reads the config binding's hasSmallICU flag for test feature detection. Legitimate and consistent with Node's test harness.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:817:7

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
exports.skipIf32Bits = function skipIf32Bits() {
  if (process.binding('config').bits < 64) {
    exports.skip('The tested feature is not available in 32bit builds');
  }
```
likely benign LLM, confidence 0.92 Test helper reading config binding bit-width to skip tests on 32-bit builds.
Reasoning
skipIf32Bits reads the config binding's bits value to skip tests on 32-bit builds. Ordinary build-configuration check in a test helper.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:978:12

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
    if (util.isUndefined(uv)) try {
      uv = process.binding('uv');
    } catch (e) {}
    var errname = uv ? uv.errname(err) : '';
```
likely benign LLM, confidence 0.90 Optional load of the uv internal binding to resolve error names, wrapped in try/catch.
Reasoning
Guarded try/catch that loads the uv binding to map error codes to names when available. This is a common compatibility fallback in Node internals and tests, with no malicious indicators.
info unicode-surrogate test/parallel/test-string-decoder.js:71:54

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
// UTF-16LE
test('utf16le', bufferShim.from('3DD84DDC', 'hex'), '\ud83d\udc4d'); // thumbs up

// Additional UTF-8 tests
```

info unicode-surrogate test/parallel/test-string-decoder.js:107:66

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

assert.strictEqual(decoder.write(bufferShim.from('4D', 'hex')), '');
assert.strictEqual(decoder.write(bufferShim.from('DC', 'hex')), '\ud83d\udc4d');
assert.strictEqual(decoder.end(), '');

info unicode-surrogate test/parallel/test-string-decoder.js:112:36

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

assert.strictEqual(decoder.write(bufferShim.from('3DD8', 'hex')), '');
assert.strictEqual(decoder.end(), '\ud83d');

decoder = new StringDecoder('utf16le');

info unicode-surrogate test/parallel/test-string-decoder.js:117:36

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
assert.strictEqual(decoder.write(bufferShim.from('4D', 'hex')), '');
assert.strictEqual(decoder.end(), '\ud83d');

assert.throws(function () {
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodejs/string_decoder string_decoder && cd string_decoder
git checkout 60db81e031c126112039157ba9437484b1329dff
disclude scan --severity info --diff 6e0a9286ed4497badebd4ec6a9a7a4d37793aae8 .