Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
line length 13885 characters (raw pass, confidence 0.65)
Creative Commons Attribution 4.0 International Public License By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as
dismissed
LLM, confidence 0.97
A Creative Commons Attribution 4.0 license text pasted as one long line.
Reasoning
The long line is ordinary Creative Commons license prose in a NOTICE file. Raw long-line warnings on prose carry no obfuscation signal.
-
line length 1196 characters (raw pass, confidence 0.50)
import type { BuildResponse, CleanBuildResponse, CompactSymbolReference, CompilerOptions, CompletionPreferences, ConfiguredProjectId, CreateBuildOrchestratorResponse, CreateProgramOptions as ProtocolCreateProgramOptions, CreateSnapshotParams as ProtocolCreateSnapshotParams, CreateSnapshotProgramParams as ProtocolCreate
-
line length 799 characters (raw pass, confidence 0.50)
import type { AssertsIdentifierTypePredicate, AssertsThisTypePredicate, BigIntLiteralType, BooleanLiteralType, CompletionEntry, CompletionInfo, CompletionOptions, ConditionalType, EmitOutput, EmitOutputFile, EmitResult, FormatDiagnosticsHost, FreshableType, GenericType, GetImportEditsForSymbolsOptions, IdentifierTypePr
-
line length 1423 characters (raw pass, confidence 0.50)
export type { APIImportAdderAction as ImportAdderAction, APIOptions, AssertsIdentifierTypePredicate, AssertsThisTypePredicate, BigIntLiteralType, BooleanLiteralType, ClientSocketOptions, ClientSpawnOptions, CompilerOptions, CompletionEntry, CompletionInfo, CompletionOptions, CompletionPreferences, ConditionalType, Conf
-
line length 794 characters (raw pass, confidence 0.50)
export const popcount8 = [0, 1, 1, 2, 1, 2, 2, 3, 1, 2, 2, 3, 2, 3, 3, 4, 1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5, 1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5, 2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6, 1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5, 2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6, 2, 3,
-
line length 1196 characters (raw pass, confidence 0.50)
import type { BuildResponse, CleanBuildResponse, CompactSymbolReference, CompilerOptions, CompletionPreferences, ConfiguredProjectId, CreateBuildOrchestratorResponse, CreateProgramOptions as ProtocolCreateProgramOptions, CreateSnapshotParams as ProtocolCreateSnapshotParams, CreateSnapshotProgramParams as ProtocolCreate
-
line length 799 characters (raw pass, confidence 0.50)
import type { AssertsIdentifierTypePredicate, AssertsThisTypePredicate, BigIntLiteralType, BooleanLiteralType, CompletionEntry, CompletionInfo, CompletionOptions, ConditionalType, EmitOutput, EmitOutputFile, EmitResult, FormatDiagnosticsHost, FreshableType, GenericType, GetImportEditsForSymbolsOptions, IdentifierTypePr
-
line length 1423 characters (raw pass, confidence 0.50)
export type { APIImportAdderAction as ImportAdderAction, APIOptions, AssertsIdentifierTypePredicate, AssertsThisTypePredicate, BigIntLiteralType, BooleanLiteralType, ClientSocketOptions, ClientSpawnOptions, CompilerOptions, CompletionEntry, CompletionInfo, CompletionOptions, CompletionPreferences, ConditionalType, Conf
-
line length 738 characters (raw pass, confidence 0.50)
import type { AssertionExpression, BindingElement, CaseClause, ComputedPropertyName, Decorator, DefaultClause, DoStatement, EndOfFile, EntityName, EnumMember, Expression, ExpressionStatement, ForInStatement, ForOfStatement, ForStatement, Identifier, IfStatement, JsxAttribute, JsxExpression, JsxSpreadAttribute, KeywordS
-
line length 1944 characters (raw pass, confidence 0.50)
export type PunctuationSyntaxKind = SyntaxKind.OpenBraceToken | SyntaxKind.CloseBraceToken | SyntaxKind.OpenParenToken | SyntaxKind.CloseParenToken | SyntaxKind.OpenBracketToken | SyntaxKind.CloseBracketToken | SyntaxKind.DotToken | SyntaxKind.DotDotDotToken | SyntaxKind.SemicolonToken | SyntaxKind.CommaToken | SyntaxK
-
line length 2323 characters (raw pass, confidence 0.65)
export type KeywordSyntaxKind = SyntaxKind.BreakKeyword | SyntaxKind.CaseKeyword | SyntaxKind.CatchKeyword | SyntaxKind.ClassKeyword | SyntaxKind.ConstKeyword | SyntaxKind.ContinueKeyword | SyntaxKind.DebuggerKeyword | SyntaxKind.DefaultKeyword | SyntaxKind.DeleteKeyword | SyntaxKind.DoKeyword | SyntaxKind.ElseKeyword
dismissed
LLM, confidence 0.97
A generated TypeScript type union of keyword SyntaxKind members.
Reasoning
This is a generated TypeScript declaration file that lists SyntaxKind union members on one line. Long lines are normal for generated type unions and show no malicious content.
-
line length 4865 characters (raw pass, confidence 0.65)
export type TokenSyntaxKind = SyntaxKind.Unknown | SyntaxKind.EndOfFile | SyntaxKind.SingleLineCommentTrivia | SyntaxKind.MultiLineCommentTrivia | SyntaxKind.NewLineTrivia | SyntaxKind.WhitespaceTrivia | SyntaxKind.ConflictMarkerTrivia | SyntaxKind.NonTextFileMarkerTrivia | SyntaxKind.NumericLiteral | SyntaxKind.BigInt
dismissed
LLM, confidence 0.97
A generated TypeScript union of token SyntaxKind members.
Reasoning
Same as the other generated declaration file: a long union of SyntaxKind members from the TypeScript compiler's generated typings. Benign.
-
line length 587 characters (raw pass, confidence 0.50)
export type CompoundAssignmentOperator = SyntaxKind.PlusEqualsToken | SyntaxKind.MinusEqualsToken | SyntaxKind.AsteriskAsteriskEqualsToken | SyntaxKind.AsteriskEqualsToken | SyntaxKind.SlashEqualsToken | SyntaxKind.PercentEqualsToken | SyntaxKind.AmpersandEqualsToken | SyntaxKind.BarEqualsToken | SyntaxKind.CaretEquals
-
line length 4589 characters (raw pass, confidence 0.65)
import type { ArrayBindingPattern, ArrayLiteralExpression, ArrayTypeNode, ArrowFunction, AsExpression, AssertsKeyword, AsteriskToken, AwaitExpression, AwaitKeyword, BigIntLiteral, BinaryExpression, BinaryOperatorToken, BindingElement, BindingName, Block, BreakStatement, CallExpression, CallSignatureDeclaration, CaseBlo
dismissed
LLM, confidence 0.97
A generated import type list of AST node types.
Reasoning
A generated import type statement importing many AST node types. Long import lists in generated d.ts files are routine and benign.
-
line length 6098 characters (raw pass, confidence 0.65)
import type { AbstractKeyword, AccessExpression, AccessorDeclaration, AccessorKeyword, AdditiveOperator, AdditiveOperatorOrHigher, AnyImportSyntax, ArrayBindingElement, ArrayBindingPattern, ArrayDestructuringAssignment, ArrayLiteralExpression, ArrayTypeNode, ArrowFunction, AsExpression, AssertionExpression, AssertKeywo
dismissed
LLM, confidence 0.97
A generated import type list of syntax node types.
Reasoning
A generated type import list of syntax types from the TypeScript toolchain. Benign generated output.
-
line length 601 characters (raw pass, confidence 0.50)
return kind === SyntaxKind.AbstractKeyword || kind === SyntaxKind.AccessorKeyword || kind === SyntaxKind.AsyncKeyword || kind === SyntaxKind.ConstKeyword || kind === SyntaxKind.DeclareKeyword || kind === SyntaxKind.DefaultKeyword || kind === SyntaxKind.ExportKeyword || kind === SyntaxKind.InKeyword || kind === Synt
-
line length 507 characters (raw pass, confidence 0.50)
return kind === SyntaxKind.CallSignature || kind === SyntaxKind.ConstructSignature || kind === SyntaxKind.MethodSignature || kind === SyntaxKind.IndexSignature || kind === SyntaxKind.FunctionType || kind === SyntaxKind.ConstructorType || kind === SyntaxKind.FunctionDeclaration || kind === SyntaxKind.MethodDeclarati
-
line length 573 characters (raw pass, confidence 0.50)
export type JSDocTokenKind = SyntaxKind.EndOfFile | SyntaxKind.WhitespaceTrivia | SyntaxKind.AtToken | SyntaxKind.NewLineTrivia | SyntaxKind.AsteriskToken | SyntaxKind.OpenBraceToken | SyntaxKind.CloseBraceToken | SyntaxKind.LessThanToken | SyntaxKind.GreaterThanToken | SyntaxKind.OpenBracketToken | SyntaxKind.CloseBra
-
line length 8907 characters (raw pass, confidence 0.65)
const unicodeESNextIdentifierStart = [65, 90, 97, 122, 170, 170, 181, 181, 186, 186, 192, 214, 216, 246, 248, 705, 710, 721, 736, 740, 748, 748, 750, 750, 880, 884, 886, 887, 890, 893, 895, 895, 902, 902, 904, 906, 908, 908, 910, 929, 931, 1013, 1015, 1153, 1162, 1327, 1329, 1366, 1369, 1369, 1376, 1416, 1488, 1514, 15
dismissed
LLM, confidence 0.95
A large numeric table of Unicode ESNext identifier-start code points.
Reasoning
The line is a large numeric array of Unicode identifier-start code point ranges, the standard lookup table a TypeScript-style scanner needs. Numeric tables are a known false-positive pattern for the raw pass.
-
line length 10366 characters (raw pass, confidence 0.65)
const unicodeESNextIdentifierPart = [48, 57, 65, 90, 95, 95, 97, 122, 170, 170, 181, 181, 183, 183, 186, 186, 192, 214, 216, 246, 248, 705, 710, 721, 736, 740, 748, 748, 750, 750, 768, 884, 886, 887, 890, 893, 895, 895, 902, 906, 908, 908, 910, 929, 931, 1013, 1015, 1153, 1155, 1159, 1162, 1327, 1329, 1366, 1369, 1369,
dismissed
LLM, confidence 0.95
A large numeric table of Unicode ESNext identifier-part code points.
Reasoning
This is the companion Unicode identifier-part code point table used by the scanner. It is legitimate lookup data, not an encoded payload.
-
line length 4211 characters (raw pass, confidence 0.65)
import { createNodeArray, updateArrayBindingPattern, updateArrayLiteralExpression, updateArrayTypeNode, updateArrowFunction, updateAsExpression, updateAwaitExpression, updateBinaryExpression, updateBindingElement, updateBlock, updateBreakStatement, updateCallExpression, updateCallSignatureDeclaration, updateCaseBlock,
dismissed
LLM, confidence 0.95
A generated import of many AST factory update functions.
Reasoning
A generated import statement pulling many update/create factory functions from a module. Long import lines in generated code are benign.
-
line length 1138 characters (raw pass, confidence 0.50)
import { isAssertsKeyword, isAsteriskToken, isAwaitKeyword, isBinaryOperatorToken, isBindingName, isBlock, isCaseBlock, isCatchClause, isColonToken, isConciseBody, isDotDotDotToken, isEndOfFile, isEntityName, isEqualsGreaterThanToken, isEqualsToken, isExclamationToken, isExpression, isExpressionWithTypeArguments, isFor
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const modulePath = require.resolve(`${manifest.name}/${exportPath.slice("typescript/".length)}`);
return import(__rewriteRelativeImportExtension(pathToFileURL(modulePath).href));
}
return { importModule };
likely benign
LLM, confidence 0.75
A VS Code extension module loader that dynamically imports a TypeScript plugin resolved from its manifest exports.
Reasoning
The import specifier is computed from require.resolve of a path derived from the package's own manifest exports, prefixed with a fixed typescript/ path and then converted to a file URL. This is a plugin loader resolving modules inside its declared package, which is a legitimate dynamic import pattern. The residual doubt is that the specifier is non-literal, though the snippet shows it is confined to resolved local package paths and has no decoding or network behavior.
-
identifier `a𐐀b` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
* offset. Prior to 3.17 the offsets were always based on a UTF-16 string
* representation. So a string of the form `a𐐀b` the character offset of the
* character `a` is 0, the character offset of `𐐀` is 1 and the character
* offset of b is 3 since `𐐀` is represented using two code units in UTF-16.
-
line length 523 characters (raw pass, confidence 0.50)
import { Message, MessageSignature, RequestMessage, RequestType, RequestType0, RequestType1, RequestType2, RequestType3, RequestType4, RequestType5, RequestType6, RequestType7, RequestType8, RequestType9, ResponseError, ErrorCodes, NotificationMessage, NotificationType, NotificationType0, NotificationType1, Notificatio
-
line length 1074 characters (raw pass, confidence 0.50)
import { Logger, ConnectionStrategy, ConnectionOptions, MessageConnection, NullLogger, createMessageConnection, ProgressToken, ProgressType, RequestParam, HandlerResult, StarRequestHandler, GenericRequestHandler, RequestHandler0, RequestHandler, RequestHandler1, RequestHandler2, RequestHandler3, RequestHandler4, Reques
-
line length 2105 characters (raw pass, confidence 0.65)
export { RAL, Message, MessageSignature, RequestMessage, RequestType, RequestType0, RequestType1, RequestType2, RequestType3, RequestType4, RequestType5, RequestType6, RequestType7, RequestType8, RequestType9, ResponseError, ErrorCodes, NotificationMessage, NotificationType, NotificationType0, NotificationType1, Notifi
dismissed
LLM, confidence 0.97
A vendored TypeScript export list of JSON-RPC types.
Reasoning
A vendored re-export statement of JSON-RPC type names in a declaration file. Long export lists are normal and show no malicious behavior.
-
line length 1299 characters (raw pass, confidence 0.50)
exports.ProgressType = exports.ProgressToken = exports.createMessageConnection = exports.NullLogger = exports.ConnectionOptions = exports.ConnectionStrategy = exports.AbstractMessageBuffer = exports.WriteableStreamMessageWriter = exports.AbstractMessageWriter = exports.MessageWriter = exports.ReadableStreamMessageReade
-
line length 548 characters (raw pass, confidence 0.50)
exports.ConnectionOptions = exports.MessageStrategy = exports.CancellationStrategy = exports.CancellationSenderStrategy = exports.CancellationReceiverStrategy = exports.RequestCancellationReceiverStrategy = exports.IdCancellationReceiverStrategy = exports.ConnectionStrategy = exports.ConnectionError = exports.Connectio
-
line length 694 characters (raw pass, confidence 0.50)
exports.Message = exports.NotificationType9 = exports.NotificationType8 = exports.NotificationType7 = exports.NotificationType6 = exports.NotificationType5 = exports.NotificationType4 = exports.NotificationType3 = exports.NotificationType2 = exports.NotificationType1 = exports.NotificationType0 = exports.NotificationTy
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io