disclude.ionpm / tailwindcss / 0.0.0-insiders.fda34f8
tailwindcss 0.0.0-insiders.fda34f8
- Source
- https://github.com/tailwindlabs/tailwindcss
- Artifact scanned
tailwindcss-0.0.0-insiders.fda34f8.tgz- Compared with
tailwindcss-0.0.0-insiders.fda1c44.tgz(29 signals introduced since)- Files
- 29 scanned, 5 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 29 info
- Scan time
- 13.8 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 16 of 16 warn and critical signals; 16 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 23:24
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
likely benign Minified CSS.escape polyfill in a bundled chunk.
Reasoning
Raw long-line signal on a minified ES module. The snippet is a standard CSS.escape polyfill, which is a well-known browser utility. Minification explains the line length, and there is no encoded payload or dynamic execution.
-
;var k= -
"use strict";var m=; -
`);let r=[],i=r,t=!1,n=[],o=null,l="",f;function u(d=i){return d.length===1?d[0]:t?Ht(d):Dr(d)}function c(d){let m=i[i.length-1];m?.kind==="compound"?m.nodes.push(d):m&&m.kind!=="list"&&m.kind!=="combinator"?i[i.length-1]=Dr([m,d]):i.push(d)}for(let d=0;d<e.length;d++){let m=e.charCodeAt(d);switch(m){case zr:{for(l.lenlikely benign Minified CSS selector and utility processing code from a bundled CSS framework.Reasoning
Long line in a minified bundle. The code is a CSS selector parser and utility-generation logic typical of Tailwind CSS/PostCSS. It shows no decoding, eval, or network activity, and the raw pass has a high false-positive rate for line length.
-
`);let r=[],i=[],t=null,n="",o;for(let l=0;l<e.length;l++){let f=e.charCodeAt(l);switch(f){case ri:{n+=e[l]+e[l+1],l++;break}case ul:{if(n.length>0){let c=re(n);t?t.nodes.push(c):r.push(c),n=""}let u=re(e[l]);t?t.nodes.push(u):r.push(u);break}case ii:case ni:case li:case oi:case ai:case si:case ui:case ci:{if(n.length>likely benign Minified CSS selector tokenizer from a bundled library.Reasoning
Long line from minified bundling. The snippet is a character-by-character CSS selector tokenizer with switch statements over char codes, a normal parser pattern. Nothing suggests obfuscation or malicious behaviour.
-
`,r){i+=c.length;let d=i;i+=2+l.value.length+2;let m=i;l.dst=[t,d,m],i+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let o="";for(let l of e)o+=n(l,0);return t.code=o,o}function gl(e,r){let i=[];return I(e,(t,n)=>{if(r(t))return i=n.path(),i.push(t),V.Stop}),i}function gi(e,r,i,t=new Set){if(t.ha -
`);console.warn(m)}}),n.value=B(o)}),i.utilities.functional(r.slice(0,-2),n=>{let o=le(e),l=n.value,f=n.modifier,u=!1,c=!1,d=!1,m=!1,p=new Map,h=!1;if(I([o],(k,w)=>{let b=w.parent;if(b?.kind!=="rule"&&b?.kind!=="at-rule"||k.kind!=="declaration"||!k.value)return;let A=!1,C=Y(k.value);if(I(C,y=>{if(y.kind==="function"){ilikely benign Minified Tailwind-style utility registration logic in a bundle.Reasoning
Very long minified line containing Tailwind-style utility registration, CSS value handling and console warnings. This is ordinary compiled framework code, and the long-line signal reflects minification only.
-
`),o=!0;return I(Y(t),l=>{if(l.kind==="function"&&l.value==="var"){let f=l.nodes[0].value;if(!new RegExp(`var\\likely benign Minified CSS var() analysis and design-system code from a bundle.Reasoning
Minified CSS variable and function analysis code that builds RegExp patterns for var() references. This is legitimate build-tool logic, and the long line is a product of minification.
-
$`)}c.add(m);for(let h of o.get(m))for(let k of l.get(h))p.push(m),d(k,p),p.pop();f.add(m),c.delete(m),u.push(m)}}for(let m of n)d(m);for(let m of u)"nodes"in m&&I(m.nodes,p=>{if(p.kind!=="at-rule"||p.name!=="@apply")return;let h=p.params.split(/(\s+)/g),k={},w=[],b=[],A=0;for(let[y,R]of h.entries())y%2===0&&(likely benign Minified @apply resolution and dependency traversal code in a bundle.Reasoning
Minified dependency-graph and @apply handling code from a CSS toolchain. The long line is consistent with bundling and the content is ordinary build logic.
-
ransitionProperty: -
Using an object as a plugin option is currently only supported in JavaScript configuration files.`)}else return Number(y);return y});w[b.property]=C.length===1?C[0]:C}return l.push([{id:k,base:h.context.base,reference:!!h.context.reference,src:m.src},Object.keys(w).length>0?w:null]),o|=4,V.Replace([])}if(m.name==="@conlikely benign Minified plugin-option and at-rule handling code from a CSS framework bundle.Reasoning
Minified configuration and plugin handling code with user-facing error messages. The content is consistent with a CSS framework and the long line comes from minification.
-
`)){if(p.trim()!==""){let h=l.find(n.src[1]+c),k=f.find(n.dst[1]);t.mappings.push({name:null,originalPosition:{source:o,...h},generatedPosition:k})}c+=p.length,c+=1}let d=l.find(n.src[2]),m=f.find(n.dst[2]);t.mappings.push({name:null,originalPosition:{source:o,...d},generatedPosition:m})});for(let n of r.keys())t.sourclikely benign Minified source-map mapping generation code in a bundle.Reasoning
Minified source-map mapping generation code, with originalPosition and generatedPosition objects. This is standard tooling and the long line is expected from minification.
-
),r)).} -
`);let i=[],r=i,t=!1,n=[],s=null,l="",c;function u(d=r){return d.length===1?d[0]:t?Kt(d):Vr(d)}function f(d){let m=r[r.length-1];m?.kind==="compound"?m.nodes.push(d):m&&m.kind!=="list"&&m.kind!=="combinator"?r[r.length-1]=Vr([m,d]):r.push(d)}for(let d=0;d<e.length;d++){let m=e.charCodeAt(d);switch(m){case Er:{for(l.lenlikely benign Minified CSS selector parser in an ESM bundle.Reasoning
Minified ESM copy of the same CSS selector parser seen in lib.js. It is a standard parser pattern and the long line reflects minification.
-
`);let i=[],r=[],t=null,n="",s;for(let l=0;l<e.length;l++){let c=e.charCodeAt(l);switch(c){case Wr:{n+=e[l]+e[l+1],l++;break}case Ln:{if(n.length>0){let f=re(n);t?t.nodes.push(f):i.push(f),n=""}let u=re(e[l]);t?t.nodes.push(u):i.push(u);break}case Br:case Yr:case Gr:case qr:case Hr:case Zr:case Jr:case Qr:{if(n.length>likely benign Minified CSS selector tokenizer in an ESM bundle.Reasoning
Minified ESM CSS selector tokenizer with char-code switches. This is a normal parser pattern, and the long line is only a minification artifact.
-
`,i){r+=f.length;let d=r;r+=2+l.value.length+2;let m=r;l.dst=[t,d,m],r+=1}}else if(l.kind==="context"||l.kind==="at-root")return"";return u}let s="";for(let l of e)s+=n(l,0);return t.code=s,s}function Bn(e,i){let r=[];return I(e,(t,n)=>{if(i(t))return r=n.path(),r.push(t),V.Stop}),r}function ii(e,i,r,t=new Set){if(t.ha -
`);console.warn(m)}}),n.value=B(s)}),r.utilities.functional(i.slice(0,-2),n=>{let s=le(e),l=n.value,c=n.modifier,u=!1,f=!1,d=!1,m=!1,p=new Map,h=!1;if(I([s],(w,b)=>{let k=b.parent;if(k?.kind!=="rule"&&k?.kind!=="at-rule"||w.kind!=="declaration"||!w.value)return;let A=!1,C=Y(w.value);if(I(C,y=>{if(y.kind==="function"){ilikely benign Minified Tailwind-style utility registration in an ESM bundle.Reasoning
Minified ESM copy of the Tailwind-style utility registration code. It is ordinary framework logic and the long-line signal is a minification artifact.
-
`),s=!0;return I(Y(t),l=>{if(l.kind==="function"&&l.value==="var"){let c=l.nodes[0].value;if(!new RegExp(`var\\likely benign Minified Tailwind-style CSS processing code in a bundled library file.Reasoning
A 44,748-character line in a distributed .mjs bundle is ordinary minified output. The visible code is Tailwind-style CSS processing (designSystem, var() regex checks, Stop/Replace visitor returns), with no encoding, eval, or process or network calls. The long-line signal is a raw-pass formatting heuristic and does not indicate obfuscation.
-
$`)}f.add(m);for(let h of s.get(m))for(let w of l.get(h))p.push(m),d(w,p),p.pop();c.add(m),f.delete(m),u.push(m)}}for(let m of n)d(m);for(let m of u)"nodes"in m&&I(m.nodes,p=>{if(p.kind!=="at-rule"||p.name!=="@apply")return;let h=p.params.split(/(\s+)/g),w={},b=[],k=[],A=0;for(let[y,R]of h.entries())y%2===0&&(likely benign Minified CSS at-rule (@apply) dependency resolution inside a bundled build library.Reasoning
The snippet is minified CSS build logic: @apply handling, dependency graph traversal, and params splitting. It contains no dynamic execution, decoding, or shell or network activity. A long line in a minified distributed bundle is expected and is a weak raw-pass signal.
-
Using an object as a plugin option is currently only supported in JavaScript configuration files.`)}else return Number(y);return y});b[k.property]=C.length===1?C[0]:C}return l.push([{id:w,base:h.context.base,reference:!!h.context.reference,src:m.src},Object.keys(b).length>0?b:null]),s|=4,V.Replace([])}if(m.name==="@conlikely benign Minified plugin-option and config handling code from a CSS toolchain bundle.Reasoning
The snippet shows a user-facing error message about plugin options and standard config-value handling in minified CSS tooling. Nothing in it is suspicious. The long-line finding reflects bundling, not hidden behavior.
-
`)){if(p.trim()!==""){let h=l.find(n.src[1]+f),w=c.find(n.dst[1]);t.mappings.push({name:null,originalPosition:{source:s,...h},generatedPosition:w})}f+=p.length,f+=1}let d=l.find(n.src[2]),m=c.find(n.dst[2]);t.mappings.push({name:null,originalPosition:{source:s,...d},generatedPosition:m})});for(let n of i.keys())t.sourclikely benign Minified source-map mapping generation code in a bundled build library.Reasoning
The snippet is source-map mapping generation (originalPosition, generatedPosition, mappings.push), a standard feature of build tools. It has no execution or exfiltration behavior. The long line is a minification artifact.
-
$`)}}))u.get(y)?.(C);for(let y of d)y(C);if(m){let y=[];for(let[P,O]of C.theme.entries()){if(O.options&2)continue;let U=o(Pe(P),O.value);U.src=O.src,y.push(U)}let R=C.theme.getKeyframes();for(let P of R)e.push(ee({theme:!0},[H([P])]));m.nodes=[ee({theme:!0},y)]}if(s|=at(e,C),s|=Ue(e,C),s|=Ce(e,C),p){let y=p;y.kind="likely benign Minified theme and plugin processing logic in a CSS framework bundle.Reasoning
The snippet is CSS build pipeline code: theme entries, keyframes, and plugin hook invocation with bitwise flag updates. It matches legitimate Tailwind-style compilation and shows no encoded payloads or dangerous calls. The long line is a bundling artifact.
-
),i)).}expor
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&