npm / type-fest / 5.10.0

type-fest 5.10.0

Source
https://github.com/sindresorhus/type-fest
Artifact scanned
type-fest-5.10.0.tgz (npm tarball · 148.2 KB · SHA-256 fa6130ea2af0…)
Compared with
type-fest-5.9.0.tgz (0 signals introduced since)
Files
220 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 42 info
Scan time
18.7 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 26 of 26 warn and critical signals; 26 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-23 13:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review encoding-base64 readme.md:391:52

    base64-like blob (139 bytes, compression ratio 0.95) (raw pass, confidence 0.60)

    
    	[Playground](https://www.typescriptlang.org/play?#code/JYWwDg9gTgLgBDAnmApnA3gBQIYGMDW2A5igFIDOEAdnNuXAEJ0o4HFmVUC+cAZlBBBwA5ElQBaXinIxhAbgCwAKFCRYCZGnQAZYFRgooPfoJHSANntmKlysWlaESFanAC8jZo-YuaAMgwLKwBhal5gIgB+AC44XX1DADpQqnCiLhsgA)
    
    	```ts
    likely benign LLM, confidence 0.93 A TypeScript Playground share link in the README whose URL fragment carries compressed example code.
    Reasoning

    The blob is the lz-string compressed code payload in a TypeScript Playground URL fragment in a markdown readme. Playground links of this kind are a standard way to share example code, and the raw pass has a high false-positive rate on base64-like strings.

  2. info long-line readme.md:417:1

    line length 883 characters (raw pass, confidence 0.50)

      [Playground](https://www.typescriptlang.org/play/?#code/JYOwLgpgTgZghgYwgAgKoGdrIN4FgBQyyAkMACYBcyIArgLYBG0A3AUcSHHRFemFKADmrQiTiCe1ekygiiAXwJtkCADZx06NJigBBAA7AAytABuwJDmXENATxAJkMCGAQALDNAAUNHQElKKUZoAEoqAAUoAHs6YEwAHk8oAD4rUWJiAHpM5AAxF3dkMDcUXywyODA4J2i6IpLkCqqGDQgAOmssnIAVBsQwGjhVZGA6fVUIbnBK4CiQZFjBNzBkVSiogGtV
  3. info warn → info by review encoding-base64 readme.md:417:54

    base64-like blob (522 bytes, compression ratio 0.78) (raw pass, confidence 0.60)

    Playground](https://www.typescriptlang.org/play/?#code/JYOwLgpgTgZghgYwgAgKoGdrIN4FgBQyyAkMACYBcyIArgLYBG0A3AUcSHHRFemFKADmrQiTiCe1ekygiiAXwJtkCADZx06NJigBBAA7AAytABuwJDmXENATxAJkMCGAQALDNAAUNHQElKKUZoAEoqAAUoAHs6YEwAHk8oAD4rUWJiAHpM5AAxF3dkMDcUXywyODA4J2i6IpLkCqqGDQgAOmssnIAVBsQwGjhVZGA6fVUIbnBK4CiQZFjBNzBkVSiogGtV4A2
    likely benign LLM, confidence 0.93 A README link to a TypeScript Playground example, with the code encoded in the URL fragment.
    Reasoning

    This is a typescriptlang.org Playground URL with a compressed code fragment in the README. The blob has no execution path or payload context and is ordinary documentation linking.

  4. info warn → info by review encoding-base64 readme.md:417:577

    base64-like blob (129 bytes, compression ratio 0.98) (raw pass, confidence 0.60)

    sEAA2l93u4kl8ALrJZIiZR2BxOGgOMCzeZuOAgMgTJKcypwLx-C1QcxIKhJc0mWNWhngwK0YJQEJpdj8Wy5mEIU4rQFURXuZWq+5PF4raPJuPte0eHQ+fxkXHpWG6GCQKBOApuITIQGNCMM2xRGgqIPIeWwKJQOqmOACadafr+rToGiFDSj-RNEfFUo6EbgaDwJB0vGz9wnhqImpRb2Es8QBlLhZwDYjuBkGQrz+kMyC6OEfjnBAACONCXGAm5aCAEDKsqHTpPIs4fMgXjQNE2aFhkxx4d+gbBqoQjWJKChKKIxbwqWZqGI2VpqtQECP
    likely benign LLM, confidence 0.93 A further compressed Playground share-link fragment in the README.
    Reasoning

    This is a second Playground URL fragment on the same README line, with the same benign share-link structure and no decoding or execution in the markdown.

  5. info warn → info by review encoding-base64 readme.md:417:707

    base64-like blob (176 bytes, compression ratio 0.91) (raw pass, confidence 0.60)

    OApuITIQGNCMM2xRGgqIPIeWwKJQOqmOACadafr+rToGiFDSj-RNEfFUo6EbgaDwJB0vGz9wnhqImpRb2Es8QBlLhZwDYjuBkGQrz+kMyC6OEfjnBAACONCXGAm5aCAEDKsqHTpPIs4fMgXjQNE2aFhkxx4d+gbBqoQjWJKChKKIxbwqWZqGI2VpqtQECPNo0BJpaSA4tCZEhhAYYRu23HMbxn7IDSUJAA)
    likely benign LLM, confidence 0.93 The tail of a TypeScript Playground URL fragment in the README.
    Reasoning

    The flagged text is the continuation of a Playground URL fragment in the README. It is compressed documentation example data, not executable or obfuscated code.

  6. info long-line readme.md:463:1

    line length 580 characters (raw pass, confidence 0.50)

    	[Playground](https://www.typescriptlang.org/play/#code/JYOwLgpgTgZghgYwgAgHIHsAmEDC6QzADmyA3gLABQyycADnanALYQBcyAzmFKEQNxUaddFDAcQAV2YAjaIMoBfKlQQAbOJ05osEAIIMAQpOBrsUMkOR1eANziRkCfISKSoD4Pg4ZseAsTIALyW1DS0DEysHADkvvoMMQA0VsKi4sgAzAAMuVaKClY2wPaOknSYDrguADwA0sgQAB6QIJjaANYQAJ7oMDp+LsQAfAAUXd0cdUnI9mo+uv6uANp1ALoAlKHhy
  7. info warn → info by review encoding-base64 readme.md:463:52

    base64-like blob (528 bytes, compression ratio 0.79) (raw pass, confidence 0.60)

    [Playground](https://www.typescriptlang.org/play/#code/JYOwLgpgTgZghgYwgAgHIHsAmEDC6QzADmyA3gLABQyycADnanALYQBcyAzmFKEQNxUaddFDAcQAV2YAjaIMoBfKlQQAbOJ05osEAIIMAQpOBrsUMkOR1eANziRkCfISKSoD4Pg4ZseAsTIALyW1DS0DEysHADkvvoMMQA0VsKi4sgAzAAMuVaKClY2wPaOknSYDrguADwA0sgQAB6QIJjaANYQAJ7oMDp+LsQAfAAUXd0cdUnI9mo+uv6uANp1ALoAlKHhyG
    likely benign LLM, confidence 0.93 A README link to a TypeScript Playground example with an encoded code fragment.
    Reasoning

    This is another typescriptlang.org Playground link whose fragment encodes example TypeScript. It is a common documentation pattern.

  8. info warn → info by review encoding-base64 readme.md:512:112

    base64-like blob (283 bytes, compression ratio 0.84) (raw pass, confidence 0.60)

    Q4SwOwFwUwJwGYEMDGNgGED21VQGJZwC2wA3gFCjXAzFJgA2A-AFzADOUckA5gNxUaIYjA4ckvGG07c+g6gF8KQkAgCuEFFDA5O6gEbEwUbLm2ESwABQIixACJIoSdgCUYAR3Vg4MACYAPGYuFvYAfACU5Ko0APRxwADKMBD+wFAAFuh2Vv7OSBlYGdmc8ABu8LHKsRyGxqY4oQT21pTCIHQMjOwA5DAAHgACxAAOjDAAdChYxL0ANLHUouKSMH0AEmAAhJhY6ozpAJ77GTCMjMCiV0ToSAb7UJPPC9WRgrEJwAAqR6MwSRQPFGUFocD
    likely benign LLM, confidence 0.93 A Playground share URL in the README carrying compressed code in its fragment.
    Reasoning

    The high-entropy blob sits inside a Playground URL fragment in a markdown document. The compression ratio and structure match lz-string output for shared code, not a payload.

  9. info long-line readme.md:544:1

    line length 610 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/AQ4UwOwVwW2AZA9gc3mAbmANsA3gKFCOAHkAzMgGkOJABEwAjKZa2kAUQCcvEu32AMQCGAF2FYBIAL4BufDRABLCKLBcywgMZgEKZOoDCiCGSXI8i4hGEwwALmABnUVxXJ57YFgzZHSVF8sT1BpBSItLGEnJz1kAy5LLy0TM2RHACUwYQATEywATwAeAITjU3MAPnkrCJMXLigtUT4AClxgGztKbyDgaX99I1TzAEokr1BRAAslJwA6FIqLAF48TtswH
  10. info warn → info by review encoding-base64 readme.md:544:56

    base64-like blob (554 bytes, compression ratio 0.79) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/AQ4UwOwVwW2AZA9gc3mAbmANsA3gKFCOAHkAzMgGkOJABEwAjKZa2kAUQCcvEu32AMQCGAF2FYBIAL4BufDRABLCKLBcywgMZgEKZOoDCiCGSXI8i4hGEwwALmABnUVxXJ57YFgzZHSVF8sT1BpBSItLGEnJz1kAy5LLy0TM2RHACUwYQATEywATwAeAITjU3MAPnkrCJMXLigtUT4AClxgGztKbyDgaX99I1TzAEokr1BRAAslJwA6FIqLAF48TtswHp9MHD
    likely benign LLM, confidence 0.93 A README link to a TypeScript Playground example with a targeted, compressed code fragment.
    Reasoning

    This is a typescript-play.js.org link with a target parameter and a compressed code fragment in a README. It is standard documentation linking with no executable context.

  11. info long-line readme.md:589:1

    line length 704 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/AQ4SwOwFwUwJwGYEMDGNgEE5TCgNugN4BQoZwOUBAXMAM5RyQDmA3KeSFABYCuAtgCMISMHloMmENh04oA9tBjQJjFuzIBfYrOAB6PcADCcGElh1gEGAHcKATwAO6ebyjB5CTNlwFwSxFR0BX5HeToYABNgBDh5fm8cfBg6AHIKG3ldA2BHOOcfFNpUygJ0pAhokr4hETFUgDpswywkggAFUwA3MFtgAF5gQgowKhhVKTYKGuFRcXo1aVZgbTIoJ3RW3
  12. info warn → info by review encoding-base64 readme.md:589:56

    base64-like blob (648 bytes, compression ratio 0.78) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/AQ4SwOwFwUwJwGYEMDGNgEE5TCgNugN4BQoZwOUBAXMAM5RyQDmA3KeSFABYCuAtgCMISMHloMmENh04oA9tBjQJjFuzIBfYrOAB6PcADCcGElh1gEGAHcKATwAO6ebyjB5CTNlwFwSxFR0BX5HeToYABNgBDh5fm8cfBg6AHIKG3ldA2BHOOcfFNpUygJ0pAhokr4hETFUgDpswywkggAFUwA3MFtgAF5gQgowKhhVKTYKGuFRcXo1aVZgbTIoJ3RW3xhOmB
    likely benign LLM, confidence 0.93 A TypeScript Playground link in the README with a compressed code payload in the fragment.
    Reasoning

    The flagged blob is a typescript-play.js.org URL fragment in a markdown file. It encodes example code for display and is not decoded or run by any code path shown.

  13. info long-line readme.md:629:1

    line length 901 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/AQ4ejYAUHsGcCWAXBMB2dgwGbAKYC2ADgDYwCeeemCaWArgE7ADGMxAhmuQHQBQoYEnJE8wALKEARnkaxEKdMAC8wAOS0kstGuAAfdQBM8ANzxlRjXQbVaWACwC0JPB0NqA3HwGgIwAJJoWozYHCxixnAsjAhStADmwESMMJYo1Fi4HMCIaPEu+MRklHj8gpqyoeHAAKJFFFTAAN4+giDYCIxwSAByHAR4AFw5SDF5Xm2gJBzdfQPD3WPxE5PAlBxdAP
  14. info warn → info by review encoding-base64 readme.md:629:56

    base64-like blob (318 bytes, compression ratio 0.83) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/AQ4ejYAUHsGcCWAXBMB2dgwGbAKYC2ADgDYwCeeemCaWArgE7ADGMxAhmuQHQBQoYEnJE8wALKEARnkaxEKdMAC8wAOS0kstGuAAfdQBM8ANzxlRjXQbVaWACwC0JPB0NqA3HwGgIwAJJoWozYHCxixnAsjAhStADmwESMMJYo1Fi4HMCIaPEu+MRklHj8gpqyoeHAAKJFFFTAAN4+giDYCIxwSAByHAR4AFw5SDF5Xm2gJBzdfQPD3WPxE5PAlBxdAPLYNQA
    likely benign LLM, confidence 0.93 A README Playground link whose fragment holds compressed example code.
    Reasoning

    This is a Playground URL in a README whose fragment is a compressed code string. It is consistent with shared example snippets.

  15. info warn → info by review encoding-base64 readme.md:629:417

    base64-like blob (155 bytes, compression ratio 0.94) (raw pass, confidence 0.60)

    LEhC9g4-0BmA4JBISXgiCkBQABpILrJ5MhUGhYcATGD6Bk4Hh-jNgABrPDkOBlXyQAAq9ngYmJpOAAHcEOCRjAXqwYODfoo6DhakUSph+Uh7GI4P0xER4Cj0OSQGwMP8tP1hgAlX7swwAHgRl2RvIANALSA08ABtAC6AD4VM1Wm0Kow0MMrYaHYJjGYLLJXZb3at1HYnC43Go-QHQDcvA6-JsmEJXARgCDgMYWAhjIYhDAU+YiMAAFIwex0ZmilMITCGF79TLAGRsAgJYAAZRwSEZGzEABFTOZUrJ5Yn+jwnWgeER6HB7AAKJrADpdXq
    likely benign LLM, confidence 0.93 A continuation of a compressed Playground share-link fragment in the README.
    Reasoning

    The blob is a continuation of the same Playground URL fragment in the README. It is documentation example data, not a dropper or hidden payload.

  16. info warn → info by review encoding-base64 readme.md:629:582

    base64-like blob (319 bytes, compression ratio 0.83) (raw pass, confidence 0.60)

    4VM1Wm0Kow0MMrYaHYJjGYLLJXZb3at1HYnC43Go-QHQDcvA6-JsmEJXARgCDgMYWAhjIYhDAU+YiMAAFIwex0ZmilMITCGF79TLAGRsAgJYAAZRwSEZGzEABFTOZUrJ5Yn+jwnWgeER6HB7AAKJrADpdXqS4ZqYultTG6azVfqHswPBbtauLY7fayQ7HIbAAAMwBuAEoYw9IBq2Ixs9h2eFMOQYPQObALQKJgggABeYhghCIpikkKRpOQRIknAsZUiIeCttECBEP8NSMCkjDDAARMGziuIYxHwYOjDCMBmDNnAuTxA6irdCOBB1Lh5D
    likely benign LLM, confidence 0.93 The trailing compressed segment of a TypeScript Playground URL in the README.
    Reasoning

    This is the final compressed segment of a Playground URL in the README. It shows the same benign share-link pattern as the other findings in this file.

  17. info long-line readme.md:672:1

    line length 638 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/JYOwLgpgTgZghgYwgAgMrQG7QMIHsQzADmyA3gFDLIAOuUYAXMiAK4A2byAPsgM5hRQJHqwC2AI2gBucgF9y5MAE9qKAEoQAjiwj8AEnBAATNtGQBeZAAooWphu26wAGmS3e93bRC8IASgsAPmRDJRlyAHoI5ABRAA8ENhYjFFYOZGVVZBgoXFFkAAM0zh5+QRBhZhYJaAKAOkjogEkQZAQ4X2QAdwALCFbaemRgXmQtFjhOMFwq9K6ULuB0lk6U+HYw
  18. info warn → info by review encoding-base64 readme.md:672:56

    base64-like blob (582 bytes, compression ratio 0.79) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/JYOwLgpgTgZghgYwgAgMrQG7QMIHsQzADmyA3gFDLIAOuUYAXMiAK4A2byAPsgM5hRQJHqwC2AI2gBucgF9y5MAE9qKAEoQAjiwj8AEnBAATNtGQBeZAAooWphu26wAGmS3e93bRC8IASgsAPmRDJRlyAHoI5ABRAA8ENhYjFFYOZGVVZBgoXFFkAAM0zh5+QRBhZhYJaAKAOkjogEkQZAQ4X2QAdwALCFbaemRgXmQtFjhOMFwq9K6ULuB0lk6U+HYwZAxJn
    dismissed LLM, confidence 0.90 Base64-like compressed code fragment inside a TypeScript Playground link in the readme.
    Reasoning

    The blob is the lz-string-compressed code fragment in a typescript-play.js.org URL, a standard way the TypeScript playground stores shared code. It is a markdown link in documentation, raw pass, with no execution or payload context.

  19. info long-line readme.md:706:1

    line length 714 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/CYUwxgNghgTiAEAzArgOzAFwJYHtXzSwEdkQBJYACgEoAueVZAWwCMQYBuAKDDwGcM8MgBF4AXngBlAJ6scESgHIRi6ty5ZUGdoihgEABXZ888AN5d48ANoiAuvUat23K6ihMQ9ATE0BzV3goPy8GZjZOLgBfLi4Aejj4AEEICBwAdz54MAALKFQQ+BxEeAAHY1NgKAwoIKy0grr4DByEUpgccpgMaXgAaxBerCzi+B9-ZulygDouFHRsU1z8kKMYE1R
  20. info warn → info by review encoding-base64 readme.md:706:56

    base64-like blob (241 bytes, compression ratio 0.87) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/CYUwxgNghgTiAEAzArgOzAFwJYHtXzSwEdkQBJYACgEoAueVZAWwCMQYBuAKDDwGcM8MgBF4AXngBlAJ6scESgHIRi6ty5ZUGdoihgEABXZ888AN5d48ANoiAuvUat23K6ihMQ9ATE0BzV3goPy8GZjZOLgBfLi4Aejj4AEEICBwAdz54MAALKFQQ+BxEeAAHY1NgKAwoIKy0grr4DByEUpgccpgMaXgAaxBerCzi+B9-ZulygDouFHRsU1z8kKMYE1RhaqgA
    dismissed LLM, confidence 0.90 Compressed code fragment in a TypeScript Playground link in the readme.
    Reasoning

    Same pattern: a TypeScript Playground share URL whose code fragment is lz-string-compressed. Documentation link, raw-pass heuristic on a URL-safe encoded string.

  21. info warn → info by review encoding-base64 readme.md:706:298

    base64-like blob (416 bytes, compression ratio 0.82) (raw pass, confidence 0.60)

    xEeAAHY1NgKAwoIKy0grr4DByEUpgccpgMaXgAaxBerCzi+B9-ZulygDouFHRsU1z8kKMYE1RhaqgAHkt4AHkWACt4EAAPbVRgLLWNgBp9gGlBs8uQa6yAUUuYPQwdgNpKM7nh7mMML4CgA+R5WABqUAgpDeVxuhxO1he0jsXGh8EoOBO9COx3BQPo2PBADckaR6IjkSA6PBqTgsMBzPsicdrEC7OJWXSQNwYvFEgAVTS9JLXODpeDpKBZFg4GCoWa8VACIJykAKiQWKy2YQOAioYikCg0OEMDyhRSy4DyxS24KhAAMjyi6gS8AAwjh5
    dismissed LLM, confidence 0.90 Continuation of a compressed TypeScript Playground code fragment in the readme.
    Reasoning

    Second blob in the same TypeScript Playground URL fragment style. Benign documentation content, and the base64-like match is a false positive from the raw pass.

  22. info long-line readme.md:750:1

    line length 556 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/C4TwDgpgBACg9gJ2AOQK4FsBGEFQLxQDOwCAlgHYDmUAPlORtrnQwDasDcAUFwPQBU-WAEMkUOADMowqAGNWwwoSgATCBIqlgpOOSjAAFsOBRSy1IQgr9cKJlSlW1mZYQA3HFH68u8xcoBlHA8EACEHJ08Aby4oKDBUTFZSWXjEFEYcAEIALihkXTR2YSSIAB54JDQsHAA+blj4xOTUsHSACkMzPKD3HHDHNQQAGjSkPMqMmoQASh7g-oihqBi4uNIpd
  23. info warn → info by review encoding-base64 readme.md:750:56

    4 rows of base64-like lines, lines 750-750 (first: base64-like blob (71 bytes, compression ratio 1.15)) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/C4TwDgpgBACg9gJ2AOQK4FsBGEFQLxQDOwCAlgHYDmUAPlORtrnQwDasDcAUFwPQBU-WAEMkUOADMowqAGNWwwoSgATCBIqlgpOOSjAAFsOBRSy1IQgr9cKJlSlW1mZYQA3HFH68u8xcoBlHA8EACEHJ08Aby4oKDBUTFZSWXjEFEYcAEIALihkXTR2YSSIAB54JDQsHAA+blj4xOTUsHSACkMzPKD3HHDHNQQAGjSkPMqMmoQASh7g-oihqBi4uNIpdraxPA
    dismissed LLM, confidence 0.90 Encoded TypeScript Playground code fragment spanning several lines of the readme.
    Reasoning

    A TypeScript Playground link with an encoded code parameter. The 'rows' grouping is only the raw heuristic matching URL-safe base64 characters in a documentation link.

  24. info long-line readme.md:788:1

    line length 523 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/GYVwdgxgLglg9mABAZwBYmMANgUwBQxgAOIUAXIgIZgCeA2gLoCUFAbnDACaIDeAUIkQB6IYgCypSlBxUATrMo1ECsJzgBbLEoipqAc0J7EMKMgDkiHLnU4wp46pwAPHMgB0fAL58+oSLARECEosLAA5ABUYG2QAHgAxJGdpVWREPDdMylk9ZApqemZEAF4APipacrw-CApEgBogkKwAYThwckQwEHUAIxxZJl4BYVEImiIZKF0oZRwiWVdbeygJmThg
  25. info warn → info by review encoding-base64 readme.md:788:56

    base64-like blob (204 bytes, compression ratio 0.87) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/GYVwdgxgLglg9mABAZwBYmMANgUwBQxgAOIUAXIgIZgCeA2gLoCUFAbnDACaIDeAUIkQB6IYgCypSlBxUATrMo1ECsJzgBbLEoipqAc0J7EMKMgDkiHLnU4wp46pwAPHMgB0fAL58+oSLARECEosLAA5ABUYG2QAHgAxJGdpVWREPDdMylk9ZApqemZEAF4APipacrw-CApEgBogkKwAYThwckQwEHUAIxxZJl4BYVEImiIZKF0oZRwiWVdbeygJmThgOYgcG
    dismissed LLM, confidence 0.90 Compressed example code in a TypeScript Playground link in the readme.
    Reasoning

    TypeScript Playground share link carrying compressed example code in the markdown documentation. No executable context; the match is a raw-pass false positive.

  26. info warn → info by review encoding-base64 readme.md:788:261

    base64-like blob (262 bytes, compression ratio 0.85) (raw pass, confidence 0.60)

    A5ABUYG2QAHgAxJGdpVWREPDdMylk9ZApqemZEAF4APipacrw-CApEgBogkKwAYThwckQwEHUAIxxZJl4BYVEImiIZKF0oZRwiWVdbeygJmThgOYgcGFYcbhqApCJsyhtpWXcR1cnEePBoeDAABVPzgbTixFeFd8uEsClADcIxGiygIFkSEOT3SmTc2VydQeRx+ZxwF2QQ34gkEwDgsnSuFmMBKiAADEDjIhYk1Qm0OlSYABqZnYka4xA1DJZHJYkGc7yCbyeRA+CAIZCzNAYbA4CIAdxg2zJwVCkWirjwMswuEaACYmCCgA)
    dismissed LLM, confidence 0.90 Second segment of a compressed TypeScript Playground code fragment in the readme.
    Reasoning

    Continuation of the same TypeScript Playground URL fragment. Benign documentation link text that the raw pass flags as base64.

  27. info long-line readme.md:816:1

    line length 763 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/MYGwhgzhAECCBOAXAlqApgWQPYBM0mgG8AoaaFRENALmgkXmQDsBzAblOmCycTV4D8teo1YdO3JiICuwRFngAKClWENmLAJRFOZRAAtkEAHQq00ALzlklNBzIBfYk+KhIMAJJTEYJsDQAwmDA+mgAPAAq0GgAHnxMODCKTGgA7tCKxllg8CwQtL4AngDaALraFgB80EWa1SRkAA6MAG5gfNAB4FABPDJyCrQR9tDNyG0dwMGhtBhgjWEiGgA00F70vv4
  28. info warn → info by review encoding-base64 readme.md:816:56

    base64-like blob (344 bytes, compression ratio 0.83) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/MYGwhgzhAECCBOAXAlqApgWQPYBM0mgG8AoaaFRENALmgkXmQDsBzAblOmCycTV4D8teo1YdO3JiICuwRFngAKClWENmLAJRFOZRAAtkEAHQq00ALzlklNBzIBfYk+KhIMAJJTEYJsDQAwmDA+mgAPAAq0GgAHnxMODCKTGgA7tCKxllg8CwQtL4AngDaALraFgB80EWa1SRkAA6MAG5gfNAB4FABPDJyCrQR9tDNyG0dwMGhtBhgjWEiGgA00F70vv4RhY3h
    dismissed LLM, confidence 0.90 Compressed example code in a TypeScript Playground link in the readme.
    Reasoning

    TypeScript Playground link with lz-string-compressed example code, a common pattern in TypeScript project documentation. Not executed by any tooling.

  29. info warn → info by review encoding-base64 readme.md:816:401

    base64-like blob (362 bytes, compression ratio 0.82) (raw pass, confidence 0.60)

    EPaDWTkhiZd7r3e8LK3llwGCMXGQWGhEOsfH5zJlsrl8p0+gw-goAAo5MAAW3BaHgEEilU0tEhmzQ212BJ0ry4SOg+kg+gBBiMximIGA0nAfAQLGk2N4EAAEgzYcYcnkLsRdDTvNEYkYUKwSdCme9WdM0MYwYhFPSIPpJdTkAAzDKxBUaZX+aAAQgsVmkCTQxuYaBw2ng4Ok8CYcotSu8pMur09iG9vuObxZnx6SN+AyUWTF8MN0CcZE4Ywm5jZHK5aB5fP4iCFIqT4oRRTKRLo6lYVNeAHpG50wOzOe1zHr9NLQ+HoABybsD4HOKXXR
    dismissed LLM, confidence 0.90 Continuation of compressed example code in a TypeScript Playground link.
    Reasoning

    Continuation of a TypeScript Playground share URL in documentation. The base64-like run is the compressed editor state, so this is benign.

  30. info long-line readme.md:864:1

    line length 938 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/MYGwhgzhAECSAmICmBlJAnAbgS2E6A3gFDTTwD2AcuQC4AW2AdgOYAUAlAFzSbnbyEAvkWFFQkGJSQB3GMVI1sNZNwg10TZgG4S0YOUY0kh1es07d+xmvQBXYDXLpWi5UlMaWAGj0GjJ6BtNdkJdBQYIADpXZGgAXmgYpB1ScOwoq38aeN9DYxoU6GFRKzVoJjUwRjwAYXJbPPRuAFkwAAcAHgAxBodsAx9GWwBbACMMAD4cxhloVraOCyYjdAAzMDxo
  31. info warn → info by review encoding-base64 readme.md:864:56

    base64-like blob (535 bytes, compression ratio 0.80) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/MYGwhgzhAECSAmICmBlJAnAbgS2E6A3gFDTTwD2AcuQC4AW2AdgOYAUAlAFzSbnbyEAvkWFFQkGJSQB3GMVI1sNZNwg10TZgG4S0YOUY0kh1es07d+xmvQBXYDXLpWi5UlMaWAGj0GjJ6BtNdkJdBQYIADpXZGgAXmgYpB1ScOwoq38aeN9DYxoU6GFRKzVoJjUwRjwAYXJbPPRuAFkwAAcAHgAxBodsAx9GWwBbACMMAD4cxhloVraOCyYjdAAzMDxoOut1e
    dismissed LLM, confidence 0.90 Compressed example code in a TypeScript Playground link in the readme.
    Reasoning

    TypeScript Playground link with compressed code in the readme. The raw-pass base64 match is a false positive on a documentation URL.

  32. info warn → info by review encoding-base64 readme.md:864:592

    base64-like blob (142 bytes, compression ratio 0.96) (raw pass, confidence 0.60)

    FddXlzKjyACp3Nq842HaDIbL6BrZBIVGhIpB1EMYSLsmjmtWW-YhAA+qegAAYLKQLQj3ZsEsdccmnGcLor2Dn8xGedHGpEIBzEzspfsfMHDNAANTQACMVaIljV5GQkRA5DYmIpVKQAgAJARO9le33BDXIyi0YuLW2nJFGLqkOvxFB0YPdBSaLZ0IwNzyPkO8-xkGgsLh8Al427a3hWAhXwwHA8EHT5PmgAB1bAQBAANJ24adKWpft72RaBUTgRBUCAj89HAM8xCTaBjggABRQx0DuHJv25P9dCkWRZVIAAiBjoFImpmjlFBgA0Npsjad
    dismissed LLM, confidence 0.90 Continuation of a compressed TypeScript Playground code fragment in the readme.
    Reasoning

    Further segment of the same Playground URL fragment. High compression ratio is consistent with lz-string output, not a hidden payload.

  33. info warn → info by review encoding-base64 readme.md:864:735

    base64-like blob (203 bytes, compression ratio 0.89) (raw pass, confidence 0.60)

    O9le33BDXIyi0YuLW2nJFGLqkOvxFB0YPdBSaLZ0IwNzyPkO8-xkGgsLh8Al427a3hWAhXwwHA8EHT5PmgAB1bAQBAANJ24adKWpft72RaBUTgRBUCAj89HAM8xCTaBjggABRQx0DuHJv25P9dCkWRZVIAAiBjoFImpmjlFBgA0NpsjadByDacgIDAEAIAAQmYpjoGYgAZSBsmGPw6DtZiiFA8CoJguDmAQmoZ2QvtUKQLdoAYmBTwgdEiCAA)
    dismissed LLM, confidence 0.90 Final segment of a compressed TypeScript Playground code fragment in the readme.
    Reasoning

    Final segment of the same TypeScript Playground URL in the readme. Benign documentation content flagged by the raw base64 heuristic.

  34. info long-line readme.md:899:1

    line length 938 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/MYGwhgzhAECSAmICmBlJAnAbgS2E6A3gFDTTwD2AcuQC4AW2AdgOYAUAlAFzSbnbyEAvkWFFQkGJSQB3GMVI1sNZNwg10TZgG4S0YOUY0kh1es07d+xmvQBXYDXLpWi5UlMaWAGj0GjJ6BtNdkJdBQYIADpXZGgAXmgYpB1ScOwoq38aeN9DYxoU6GFRKzVoJjUwRjwAYXJbPPRuAFkwAAcAHgAxBodsAx9GWwBbACMMAD4cxhloVraOCyYjdAAzMDxo
  35. info warn → info by review encoding-base64 readme.md:899:56

    base64-like blob (535 bytes, compression ratio 0.80) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/MYGwhgzhAECSAmICmBlJAnAbgS2E6A3gFDTTwD2AcuQC4AW2AdgOYAUAlAFzSbnbyEAvkWFFQkGJSQB3GMVI1sNZNwg10TZgG4S0YOUY0kh1es07d+xmvQBXYDXLpWi5UlMaWAGj0GjJ6BtNdkJdBQYIADpXZGgAXmgYpB1ScOwoq38aeN9DYxoU6GFRKzVoJjUwRjwAYXJbPPRuAFkwAAcAHgAxBodsAx9GWwBbACMMAD4cxhloVraOCyYjdAAzMDxoOut1e
    likely benign LLM, confidence 0.90 A compressed code-sharing payload embedded in a TypeScript Playground link in the readme.
    Reasoning

    The blob sits inside a typescript-play.js.org URL fragment (#code/...). That format is lz-string compression of playground source, a standard way to share code in a link. The raw pass flags it only as base64-like, and this is a documentation link in a markdown readme, not executable code.

  36. info warn → info by review encoding-base64 readme.md:899:592

    base64-like blob (142 bytes, compression ratio 0.96) (raw pass, confidence 0.60)

    FddXlzKjyACp3Nq842HaDIbL6BrZBIVGhIpB1EMYSLsmjmtWW-YhAA+qegAAYLKQLQj3ZsEsdccmnGcLor2Dn8xGedHGpEIBzEzspfsfMHDNAANTQACMVaIljV5GQkRA5DYmIpVKQAgAJARO9le33BDXIyi0YuLW2nJFGLqkOvxFB0YPdBSaLZ0IwNzyPkO8-xkGgsLh8Al427a3hWAhXwwHA8EHT5PmgAB1bAQBAANJ24adKWpft72RaBUTgRBUCAj89HAM8xCTaBjggABRQx0DuHJv25P9dCkWRZVIAAiBjoFImpmjlFBgA0Npsjad
    likely benign LLM, confidence 0.88 A further compressed-code segment from the same Playground link in the readme.
    Reasoning

    This is another fragment of the same TypeScript Playground share link on the same readme line. It has the same URL-fragment compressed-code shape and nothing in the snippet is executed or decoded by the repository itself.

  37. info warn → info by review encoding-base64 readme.md:899:735

    base64-like blob (203 bytes, compression ratio 0.89) (raw pass, confidence 0.60)

    O9le33BDXIyi0YuLW2nJFGLqkOvxFB0YPdBSaLZ0IwNzyPkO8-xkGgsLh8Al427a3hWAhXwwHA8EHT5PmgAB1bAQBAANJ24adKWpft72RaBUTgRBUCAj89HAM8xCTaBjggABRQx0DuHJv25P9dCkWRZVIAAiBjoFImpmjlFBgA0NpsjadByDacgIDAEAIAAQmYpjoGYgAZSBsmGPw6DtZiiFA8CoJguDmAQmoZ2QvtUKQLdoAYmBTwgdEiCAA)
    likely benign LLM, confidence 0.88 A compressed-code segment from the same TypeScript Playground link in the readme.
    Reasoning

    This is a continuation of the same Playground share URL, consisting of compressed playground state in a documentation link. The raw base64 signal is a false positive on a markdown link.

  38. info long-line readme.md:952:1

    line length 576 characters (raw pass, confidence 0.50)

    	[Playground](https://typescript-play.js.org/?target=6#code/JYOwLgpgTgZghgYwgAgIImAWzgG2QbwChlks4BzCAVShwC5kBnMKUcgbmKYAcIFgIjBs1YgOXMpSFMWbANoBdTiW5woFddwAW0kfKWEAvoUIB6U8gDCUCHEiNkICAHdkYAJ69kz4GC3JcPG4oAHteKDABBxCYNAxsPFBIWEQUCAAPJG4wZABySUFcgJAAEzMLXNV1ck0dIuCw6EjBADpy5AB1FAQ4EGQAV0YUP2AHDy8wEOQbUugmBLwtEIA3OcmQnEj
  39. info warn → info by review encoding-base64 readme.md:952:56

    base64-like blob (504 bytes, compression ratio 0.79) (raw pass, confidence 0.60)

    yground](https://typescript-play.js.org/?target=6#code/JYOwLgpgTgZghgYwgAgIImAWzgG2QbwChlks4BzCAVShwC5kBnMKUcgbmKYAcIFgIjBs1YgOXMpSFMWbANoBdTiW5woFddwAW0kfKWEAvoUIB6U8gDCUCHEiNkICAHdkYAJ69kz4GC3JcPG4oAHteKDABBxCYNAxsPFBIWEQUCAAPJG4wZABySUFcgJAAEzMLXNV1ck0dIuCw6EjBADpy5AB1FAQ4EGQAV0YUP2AHDy8wEOQbUugmBLwtEIA3OcmQnEjuZBgQ
    likely benign LLM, confidence 0.90 A compressed TypeScript Playground example link in the readme.
    Reasoning

    This is a TypeScript Playground link with a lz-string-style compressed code fragment after the #code/ marker. It is a documentation example link in a readme, consistent with the other blobs, and it has no executable context.

  40. info identifier-low-length source/is-equal.d.ts:1:1

    20 of 36 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)

  41. info whitespace-anomaly source/set-parameter-type.d.ts:29:1

    file mixes tab and space indentation (41 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)

    type MergeObjectToArray<TArray extends UnknownArray, TObject, TArrayCopy extends UnknownArray = TArray> =
    	// If `TObject` is an array like `[0, 1, 2]`
    	TObject extends UnknownArray
    		// If `TObject` is a variable length array, we should use `TObject`'s type as the result type.
  42. info whitespace-anomaly source/tagged.d.ts:5:1

    file mixes tab and space indentation (34 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)

    export type TagContainer<Token> = {
    	readonly [tag]: Token;
    };

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o type-fest-5.10.0.tgz https://registry.npmjs.org/type-fest/-/type-fest-5.10.0.tgz
printf '%s  %s\n' fa6130ea2af09b313a1d1636ed1bbfb62af88177a315d12043c2f728b4242acb type-fest-5.10.0.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf type-fest-5.10.0.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg