disclude.iotr46 7.0.0
- Source
- https://github.com/jsdom/tr46
- Tag scanned
v7.0.0- Compared with
v6.0.0(12 signals introduced since)- Files
- 13 scanned, 1 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 12 info
- Scan time
- 10.6 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 12 of 12 warn and critical signals; 12 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-14 19:29
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
const cp =likely benign Build script dynamically imports Unicode General_Category Mark code-point data for regex generation.Reasoning
This is a build-time script that generates regex tables. The dynamic import interpolates only a unicodeVersion variable into a fixed @unicode/unicode-* package path for the General_Category/Mark data. The specifier is not attacker-controlled input, and the import loads a known npm package's data module. Nothing here executes untrusted content.
-
// https://tools.ietf.org/html/rfc5893#section-1.4 L: ., R: .,likely benign Build script dynamically imports the Unicode Bidi_Class Left_To_Right code-point data.Reasoning
Same pattern as the other findings in this script: a fixed @unicode package path with a version interpolated. The surrounding RFC 5893 reference and the Bidi_Class mapping show it is building bidi-class lookup tables for IDNA/bidi regexes. This is legitimate data generation.
-
R: ., AL: .,likely benign Build script dynamically imports the Unicode Bidi_Class Right_To_Left code-point data.Reasoning
The import specifier is a fixed @unicode data path with only the Unicode version varied. Bidi_Class table generation in a build script is an ordinary pattern and does not indicate obfuscation or malicious intent.
-
AL: ., EN: .,likely benign Build script dynamically imports the Unicode Bidi_Class Arabic_Letter code-point data.Reasoning
A template-literal import of a fixed Unicode package path, with the version as the only variable. It is part of a table of bidi-class imports used to generate regexes, which is benign build tooling.
-
EN: ., ES: .,likely benign Build script dynamically imports the Unicode Bidi_Class European_Number code-point data.Reasoning
Standard Unicode data import in a generator script. The specifier is constructed from a constant package name and a version string, with no untrusted input and no execution of fetched code.
-
ES: ., ET: .,likely benign Build script dynamically imports the Unicode Bidi_Class European_Separator code-point data.Reasoning
Fixed-path dynamic import of Unicode bidi data inside a regex-generation script. The pattern is a known way to load data modules with a versioned path and carries no malicious signal.
-
ET: ., AN: .,likely benign Build script dynamically imports the Unicode Bidi_Class European_Terminator code-point data.Reasoning
The import uses a fixed @unicode package and a version variable only. It is one entry in a bidi-class lookup table generated at build time, so it is benign.
-
AN: ., CS: .,likely benign Build script dynamically imports the Unicode Bidi_Class Arabic_Number code-point data.Reasoning
Build-time generator importing Unicode Arabic_Number data via a versioned package path. The dynamic specifier is trusted and bounded, so this is a legitimate coding pattern.
-
CS: ., NSM: .,likely benign Build script dynamically imports the Unicode Bidi_Class Common_Separator code-point data.Reasoning
Fixed-path Unicode data import in a code generation script, with only a version variable interpolated. This is standard tooling and not an obfuscation or supply-chain risk.
-
NSM: ., BN: .,likely benign Build script dynamically imports the Unicode Bidi_Class Nonspacing_Mark code-point data.Reasoning
Same fixed @unicode package template used for every Bidi_Class entry. Nothing in the snippet suggests attacker-controlled specifiers or code execution beyond loading static data.
-
BN: ., ON: . };likely benign Build script dynamically imports the Unicode Bidi_Class Boundary_Neutral and Other_Neutral code-point data.Reasoning
The final entry in the bidi-class table, again a fixed Unicode data path with a version variable. The pattern is consistent with benign regex generation and the AST rule fires only because the specifier is a template literal.
-
BN: ., ON: . };likely benign Build script dynamically imports Unicode Bidi_Class data modules from the @unicode package by version.Reasoning
The dynamic import specifier is a template literal interpolating a unicode version into a fixed @unicode package path for Bidi_Class code-point data. This is a build-time script generating regexes from published Unicode data; the variable only selects a version string and the module namespace is limited to a known scoped package. No network fetch, decoding, or shell execution is present, so it reads as a legitimate code-generation pattern.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&