string_decoder 1.3.0

Source: https://github.com/nodejs/string_decoder
Commit scanned: 60db81e031c1 (recorded by npm)
Compared with: 6e0a9286ed44 (0 signals introduced since)
Files: 21 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 12 info
Scan time: 4.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 13:02

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line test/common/countdown.js:1:1

line length 564 characters (raw pass, confidence 0.50)

var _createClass = function () { function defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, des

info long-line test/common/dns.js:1:1

line length 664 characters (raw pass, confidence 0.50)

var _slicedToArray = function () { function sliceIterator(arr, i) { var _arr = []; var _n = true; var _d = false; var _e = undefined; try { for (var _i = arr[Symbol.iterator](), _s; !(_n = (_s = _i.next()).done); _n = true) { _arr.push(_s.value); if (i && _arr.length === i) break; } } catch (err) { _d = true; _e = err;

info ~~warn~~ → info by review dynamic-attribute test/common/index.js:122:21

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
  var initHandles = {};
  var _async_wrap = process.binding('async_wrap');

  process.on('exit', function () {
```
likely benign LLM, confidence 0.90 Node core test helper reading the async_wrap internal binding to track handles on exit.
Reasoning
This is the Node.js core test harness file. process.binding('async_wrap') is a deprecated but legitimate internal access used to inspect async handles during tests. No encoding, obfuscation, or exfiltration is present.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:565:13

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
exports.hasMultiLocalhost = function hasMultiLocalhost() {
  var TCP = process.binding('tcp_wrap').TCP;
  var t = new TCP();
  var ret = t.bind('127.0.0.2', 0);
```
likely benign LLM, confidence 0.90 Node test helper using the tcp_wrap internal binding to check localhost aliasing.
Reasoning
Test helper probing multi-localhost support by binding a TCP handle to 127.0.0.2 via the tcp_wrap internal binding. Standard Node test-suite code with no malicious indicators.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:752:14

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
    get: function () {
      return process.binding('config').hasIntl;
    }
  });
```
likely benign LLM, confidence 0.92 Test helper getter reading hasIntl from the config internal binding.
Reasoning
Getter exposing the build's ICU configuration via process.binding('config'). This is a documented-style internal feature probe in Node's test common module, not obfuscation.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:760:14

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
    get: function () {
      return process.binding('config').hasSmallICU;
    }
  });
```
likely benign LLM, confidence 0.92 Test helper getter reading hasSmallICU from the config internal binding.
Reasoning
Same pattern as the hasIntl getter: reads hasSmallICU from the config binding for test skipping. Benign build-feature detection.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:817:7

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
exports.skipIf32Bits = function skipIf32Bits() {
  if (process.binding('config').bits < 64) {
    exports.skip('The tested feature is not available in 32bit builds');
  }
```
likely benign LLM, confidence 0.92 Test helper skipping 32-bit builds using the config internal binding.
Reasoning
Helper that skips tests on 32-bit builds by reading the bits value from process.binding('config'). Ordinary test-harness logic.
info ~~warn~~ → info by review dynamic-attribute test/common/index.js:978:12

`process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)
```
    if (util.isUndefined(uv)) try {
      uv = process.binding('uv');
    } catch (e) {}
    var errname = uv ? uv.errname(err) : '';
```
likely benign LLM, confidence 0.90 Test helper loading the uv internal binding to resolve errno names.
Reasoning
Lazily loads the uv binding inside a try block to map error codes to names for test error messages. Benign, with a defensive catch that is typical of Node internals code.
info unicode-surrogate test/parallel/test-string-decoder.js:71:54

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
// UTF-16LE
test('utf16le', bufferShim.from('3DD84DDC', 'hex'), '\ud83d\udc4d'); // thumbs up

// Additional UTF-8 tests
```

info unicode-surrogate test/parallel/test-string-decoder.js:107:66

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

assert.strictEqual(decoder.write(bufferShim.from('4D', 'hex')), '');
assert.strictEqual(decoder.write(bufferShim.from('DC', 'hex')), '\ud83d\udc4d');
assert.strictEqual(decoder.end(), '');

info unicode-surrogate test/parallel/test-string-decoder.js:112:36

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

assert.strictEqual(decoder.write(bufferShim.from('3DD8', 'hex')), '');
assert.strictEqual(decoder.end(), '\ud83d');

decoder = new StringDecoder('utf16le');

info unicode-surrogate test/parallel/test-string-decoder.js:117:36

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
assert.strictEqual(decoder.write(bufferShim.from('4D', 'hex')), '');
assert.strictEqual(decoder.end(), '\ud83d');

assert.throws(function () {
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/nodejs/string_decoder string_decoder && cd string_decoder
git checkout 60db81e031c126112039157ba9437484b1329dff
disclude scan --severity info --diff 6e0a9286ed4497badebd4ec6a9a7a4d37793aae8 .