undici-types 7.30.1

Source: https://github.com/nodejs/undici
Tag scanned: v7.30.1
Compared with: v7.30.0 (14 signals introduced since)
Files: 720 scanned, 25 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 57 info
Scan time: 34.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 54 of 54 warn and critical signals; 54 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 09:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:12:18 new in this release

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
const skip = runtimeFeatures.has('crypto') === false
const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

test('should ignore well-formed but unknown algorithm tokens', { skip }, (t) => {
```
dismissed LLM, confidence 0.93 A base64 SHA-256 digest constant in an SRI regression test.
Reasoning
A base64 SHA-256 digest assigned to a constant in a regression test for a subresource integrity advisory. The test uses it to check handling of unknown algorithm tokens. The value is ordinary test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:25:20 new in this release

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Base64 SRI digest constants in a test fixture.
Reasoning
These are SRI hash strings (base64 digests of 'Hello world!') in a test file for subresource integrity. Raw pass base64 heuristic is a known false-positive source here.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:26:20 new in this release

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Base64 SRI sha256 digest constant in a test fixture.
Reasoning
Same SRI hash constant block in a Node.js fetch integrity test; expected digest values, not obfuscated payloads.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:27:20 new in this release

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Base64 SRI sha384 digest constant in a test fixture.
Reasoning
SRI sha384 digest string used as a test expectation for integrity checking; legitimate test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:59:25 new in this release

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
```
likely benign LLM, confidence 0.97 Incorrect base64 SRI digest constant used as a negative test case.
Reasoning
Deliberately wrong digest values used to test that integrity mismatches are rejected; a standard security regression test pattern.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:60:25 new in this release

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
```
likely benign LLM, confidence 0.97 Incorrect base64 SRI sha384 digest in a negative test.
Reasoning
Wrong sha384 digest in the negative test fixture; benign test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:61:25 new in this release

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Incorrect base64 SRI sha512 digest in a negative test.
Reasoning
Wrong sha512 digest in the negative test fixture; benign test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:95:25 new in this release

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  await t.assert.doesNotReject(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha1024-MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  }))
})
```
likely benign LLM, confidence 0.97 Base64 SRI digest inside a fetch integrity option in a test.
Reasoning
Integrity attribute value in a fetch call inside a test; standard SRI digest string, benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:101:20 new in this release

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Base64 SRI digest constant block in a test fixture.
Reasoning
Repeated SRI digest constant block in the test file; benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:102:20 new in this release

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Base64 SRI digest constant block in a test fixture.
Reasoning
Repeated SRI sha512/sha256 digest constants; benign test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:103:20 new in this release

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
```
likely benign LLM, confidence 0.97 Base64 SRI sha384 digest constant in a test fixture.
Reasoning
Repeated SRI sha384 digest constant in the test file; benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:104:25 new in this release

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
```
likely benign LLM, confidence 0.97 Incorrect base64 SRI sha512 digest in a negative test.
Reasoning
Wrong sha512 digest used as a negative test value; benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:105:25 new in this release

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
```
likely benign LLM, confidence 0.97 Test fixture containing intentionally wrong base64 SRI hash strings.
Reasoning
These are hash digest test fixtures in a subresource-integrity test file. Base64 SRI hashes are expected here, and the raw pass flags them only because they look base64-like. No execution or decoding occurs.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:106:25 new in this release

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Test fixture containing an intentionally wrong SHA-384 base64 hash.
Reasoning
Same file and pattern: a base64 hash literal used as a wrong-hash test value in an SRI test suite. Raw-pass base64 heuristic on expected test data.

info long-line README.md:3:1

line length 521 characters (raw pass, confidence 0.50)

[![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h

info long-line docs/docs/api/api-lifecycle.md:61:1

line length 920 characters (raw pass, confidence 0.50)

The **idle** state is the initial state of a `Client` instance. While an `origin` is required for instantiating a `Client` instance, the underlying socket connection will not be established until a request is queued using [`Client.dispatch()`](/docs/docs/api/Client.md#clientdispatchoptions-handlers). By calling `Client

info long-line lib/llhttp/constants.js:3:1

line length 636 characters (raw pass, confidence 0.50)

exports.SPECIAL_HEADERS = exports.MINOR = exports.MAJOR = exports.HTAB_SP_VCHAR_OBS_TEXT = exports.QUOTED_STRING = exports.CONNECTION_TOKEN_CHARS = exports.HEADER_CHARS = exports.TOKEN = exports.HEX = exports.URL_CHAR = exports.USERINFO_CHARS = exports.MARK = exports.ALPHANUM = exports.NUM = exports.HEX_MAP = exports.N

info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:171:1

base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
```
likely benign LLM, confidence 0.93 Base64-encoded PNG image embedded as a test fixture in busboy's multipart parser tests.
Reasoning
Raw-pass base64 hit inside a test fixture. The blob decodes to a PNG header (iVBORw0KGgo), which fits a multipart upload test embedding an image. Raw findings have a high false-positive rate, and this is ordinary test data.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:188:1

base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
```
likely benign LLM, confidence 0.93 Another base64 PNG image fixture in the busboy multipart test suite.
Reasoning
Same PNG base64 fixture pattern as the other hits in this file, used as multipart test input for the busboy parser. No execution or decoding of the data into anything dangerous is visible.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:254:1

base64-like blob (1044 bytes over 14 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKfSURBVDjLpZPrS1NhHMf9O3bOdmwDCWRE
IYKEUHsVJBI7mg3FvCxL09290jZj2EyLMnJexkgpLbPUanNOberU5taUMnHZUULMvelCtWF0sW/n
```
likely benign LLM, confidence 0.93 Base64-encoded PNG test payload for busboy parser tests.
Reasoning
Base64 PNG blob (iVBORw0KGgo prefix) inside a test file for a multipart form parser. This is expected test payload data.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:275:1

base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLpZPrS5NhGIf9W7YvBYOkhlko
qCklWChv2WyKik7blnNris72bi6dus0DLZ0TDxW1odtopDs4D8MDZuLU0kXq61CijSIIasOvv94V
```
likely benign LLM, confidence 0.93 Base64 PNG fixture used as multipart upload test data.
Reasoning
Repeated PNG base64 fixture of the same kind, with no decoding or execution around it. Consistent with a legitimate parser test.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:336:1

base64-like blob (776 bytes over 11 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHYSURBVDjLlVLPS1RxHJynpVu7KEn0Vt+2
l6IO5qGCIsIwCPwD6hTUaSk6REoUHeoQ0qVAMrp0COpY0SUIPVRgSl7ScCUTst6zIoqg0y7lvpnP
```
likely benign LLM, confidence 0.93 Base64-encoded image data as a multipart test fixture.
Reasoning
Base64 blob with PNG content, located in the busboy test suite. Entropy and compression ratio are typical of compressed image data, so the flag is a false positive on a raw pass.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:354:1

base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLhZNNSFRRFIC/N++9eWMzhkl/
ZJqFMQMRFvTvImkXSdKiVRAURBRRW1eZA9EqaNOiFlZEtQxKyrJwUS0K+qEQzaTE/AtLHR3Hmffu
```
likely benign LLM, confidence 0.93 PNG base64 test fixture in busboy's parser tests.
Reasoning
Same PNG base64 test payload pattern in a parser test file. The decoded content is image data, not executable code.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:376:1

base64-like blob (3212 bytes over 43 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
        `
LS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5amRTRmhjQVJrOGZ5R055Ng0KQ29udGVudC1EaXNwb3Np
dGlvbjogZm9ybS1kYXRhOyBuYW1lPSJmaWxlMSI7IGZpbGVuYW1lPSJndGstYXBwbHkucG5nIg0K
Q29udGVudC1UeXBlOiBpbWFnZS9wbmcNCg0KiVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACN
```
likely benign LLM, confidence 0.92 Base64-encoded multipart form body with an embedded PNG file, used as a parser test fixture.
Reasoning
Snippet begins with base64 for a multipart boundary and Content-Disposition headers (LS0tLS0t is '-----', and the decoded text is form-data headers) followed by an embedded PNG. This is a multipart request body fixture for testing file uploads.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:427:1

base64-like blob (1336 bytes over 18 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAANnSURB
VDiNldJ9aJVVHAfw7znPuS/PvW4405WbLWfbsBuNbramq5Tp7mLqIFPXINlwpAitaCAPjWKgBdXz
```
likely benign LLM, confidence 0.92 Base64-encoded PNG (Inkscape-generated) used as multipart upload test data.
Reasoning
Base64 PNG blob, with the Inkscape metadata string visible in the decoded bytes. That is consistent with a real image file used as test input, so it is benign test data.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:452:1

base64-like blob (1272 bytes over 17 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAM1SURB
VDiNrZTPaxtHFMc/M7uzs7KobckyDjQxtoPbnlJyMBRKgsGFHkwvvfbuU/+BQCilBHrof+BT7zmV
```
likely benign LLM, confidence 0.92 Base64 PNG test fixture produced by Inkscape, used in busboy tests.
Reasoning
Same Inkscape-generated PNG base64 fixture as the neighboring findings, in a file-upload parser test. No malicious indicators.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:478:1

base64-like blob (2400 bytes over 32 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
        `
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS03ZDkxYjAzYTIwMTI4DQpDb250ZW50LURpc3Bv
c2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9ImZpbGUxIjsgZmlsZW5hbWU9IkM6XFB5dGhvbjI1XHd6
dGVzdFx3ZXJremV1Zy1tYWluXHRlc3RzXG11bHRpcGFydFxmaXJlZm94My0ycG5nMXR4dFxmaWxl
```
likely benign LLM, confidence 0.92 Base64-encoded multipart request capture with Windows file path metadata, used as a parser test fixture.
Reasoning
Base64 decodes to multipart boundary and Content-Disposition headers with a Windows file path (C:\Python25...) in the filename. This is a recorded real-world multipart request used as a regression fixture, not a payload.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:518:1

base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
```
likely benign LLM, confidence 0.93 Base64 PNG test fixture in busboy parser tests.
Reasoning
Duplicate of the earlier 700-byte PNG base64 fixture in the same test file. It is benign test data.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:535:1

base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
```
likely benign LLM, confidence 0.93 Base64-encoded PNG test payload for busboy multipart parsing.
Reasoning
Base64 PNG blob matching the other fixtures in this test file, used to exercise multipart file parsing. Benign.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:25:17

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
dismissed LLM, confidence 0.95 A base64 SHA-256 integrity hash literal in a fetch test.
Reasoning
The flagged value is a 44-byte base64 string used as a Subresource Integrity SHA-256 digest in a fetch integrity test. Such digests are high-entropy by nature and are expected in test fixtures. The raw pass has a high false-positive rate for this pattern.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:63:17

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
dismissed LLM, confidence 0.95 A repeated base64 SRI digest literal in a fetch integrity test.
Reasoning
The same SRI hash literal as the other integrity test cases, used to check fetch integrity verification against a known body. It is a legitimate test fixture.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:94:17

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
dismissed LLM, confidence 0.95 A base64 SRI digest of a known test body.
Reasoning
Another instance of the same known SRI digest of 'Hello world!' used as test data. No execution or concealment is involved.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:110:17

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
dismissed LLM, confidence 0.95 A base64 SHA-384 digest literal in a fetch integrity test.
Reasoning
A 64-byte base64 SHA-384 digest of the test body, expected in an integrity test covering multiple hash algorithms.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:126:24

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha384-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
```
dismissed LLM, confidence 0.93 A base64 integrity value supplied to a fetch rejection test.
Reasoning
A base64 SHA-384 integrity string passed to fetch in a rejection test. The test asserts that a mismatched hash is rejected, which is a normal correctness check.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:132:17

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
dismissed LLM, confidence 0.95 A base64 SHA-512 digest literal in a fetch integrity test.
Reasoning
An 88-byte base64 SHA-512 digest of the test body, consistent with the other multi-algorithm integrity fixtures.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:148:24

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha512-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
```
dismissed LLM, confidence 0.93 A base64 value used as a bad integrity hash in a rejection test.
Reasoning
A deliberately mismatched SHA-512-labelled integrity value used in a rejection test. This is standard negative-test data.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:154:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
dismissed LLM, confidence 0.93 A base64 SHA-384 digest literal in a fetch integrity test.
Reasoning
A SHA-384 digest literal in an integrity test. It is test data, not an encoded payload.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:244:19

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'ä'
```
likely benign LLM, confidence 0.85 A base64 SHA-256 digest among multiple hash literals in a test, next to a stray non-ASCII string.
Reasoning
The base64 flag is on a SHA-256 digest literal in a multi-hash test table. The adjacent 'ä' value in sha384 is an odd non-ASCII character that a reviewer might look at, but it sits in test data and does not form a payload or execution path.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:265:19

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
dismissed LLM, confidence 0.95 A group of base64 SRI digest literals in a test.
Reasoning
A block of SRI digests of the same test body under three algorithms. This is a fixture for checking integrity handling across algorithms.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:266:19

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
dismissed LLM, confidence 0.95 Base64 SHA-384 and SHA-512 digest literals in a test.
Reasoning
The SHA-384 and SHA-512 digests in the same test fixture block. They are expected hash values.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:267:19

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
dismissed LLM, confidence 0.95 A base64 SHA-512 digest literal in a test fixture.
Reasoning
The 88-byte SHA-512 digest in the same fixture block, consistent with a multi-algorithm integrity test.
info ~~critical~~ → info by review proxy-global-hijack test/install.js:13:27

`new Proxy(globalThis, ...)` interposes on a global object — every property read goes through the handler (ast pass, confidence 0.90)
```
  // and no other properties are added to globalThis by undici.install().
  const proxyGlobalThis = new Proxy(globalThis, {
    set (target, prop, value) {
      if (exportsToCheck.has(prop)) {
```
likely benign LLM, confidence 0.85 A Proxy on globalThis in a test that checks undici.install() does not pollute the global object.
Reasoning
The file is undici's test for install(). The Proxy wraps globalThis only to detect unexpected global property writes. The set trap checks against a list of expected exports, and the comment says no other globals are added. It is a verification harness, not a hijack, although the critical severity reflects the Proxy-on-global pattern.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:12:20

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Known SHA-256 base64 digest of a test string used in SRI tests.
Reasoning
The comment states these are hash values generated for 'Hello world!'. They are known digests used to test SRI algorithm application, a legitimate test pattern.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:13:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Known SHA-384 base64 digest used as test vector.
Reasoning
Known SHA-384 digest literal in an SRI test with a comment identifying its origin. Ordinary test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:14:20

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('valid sha256', { skip }, (t) => {
```
likely benign LLM, confidence 0.97 Known SHA-512 base64 digest used as test vector.
Reasoning
Known SHA-512 digest literal used as a test vector for SRI algorithm handling. Not executed or decoded to a payload.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:15:26

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  test('identical strings, actualValue has one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
```
likely benign LLM, confidence 0.97 Base64 string with padding used in a string-match test.
Reasoning
Base64 string literals used to test a case-sensitive string comparison with and without padding. Test data with no decoding or execution.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:22:28

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.97 Base64 string literal used in a padding-mismatch test case.
Reasoning
Padded and unpadded base64 literals used as comparison inputs in a unit test for caseSensitiveMatch.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:28:28

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.97 Base64 string with double padding used as a test value.
Reasoning
Double-padded base64 literal used as a test input for string comparison. Ordinary test fixture.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:33:26

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  test('identical strings, both have one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
```
likely benign LLM, confidence 0.97 Base64 string literal used in an identical-match test case.
Reasoning
Identical base64 literals in a test of matching strings. No malicious behavior is present.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:34:28

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.97 Base64 string literal used as the expected value in a match test.
Reasoning
Repeated padded base64 literal used as the expected value in a unit test. Benign test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:39:26

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
  test('identical strings, both have two padding chars', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
```
likely benign LLM, confidence 0.97 Double-padded base64 literal used in a matching test.
Reasoning
Double-padded base64 literal used in a matching-strings test. Benign test fixture flagged by a raw-pass heuristic.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:40:28

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.95 Base64 test fixture string used as an SRI hash value in a unit test.
Reasoning
Raw pass base64 heuristic firing on a literal test vector used to compare hash strings in a unit test; the file is a standard test for SRI case-sensitive matching, so the blob is expected test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:45:26

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
  test('identical strings, expectedValue has invalid third padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
```
likely benign LLM, confidence 0.95 Base64 test fixture with invalid padding used to check strict hash comparison.
Reasoning
Same literal test vector reused in a deliberately malformed-padding test case; the raw base64 match is a false positive on test data in a subresource-integrity library's test suite.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:46:28

base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
  })
```
likely benign LLM, confidence 0.95 Base64 test fixture used in a negative assertion for SRI matching.
Reasoning
Repeats the malformed-padding test vector in an assertion; no execution or obfuscation involved, just encoded test data in a library's test file.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:12:20

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.95 Base64-encoded SHA-256 digest used as a test vector for SRI metadata parsing.
Reasoning
Comment states these are hash values generated for 'Hello world!'; they are documented SHA-256 digests in a parser test, a legitimate pattern for SRI metadata tests.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:13:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.95 Base64-encoded SHA-384 digest used as a parser test vector.
Reasoning
SHA-384 test digest in a metadata parsing test with a comment identifying its origin; standard fixture data, no malicious indicator.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:14:20

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('should parse valid metadata with option', { skip }, (t) => {
```
likely benign LLM, confidence 0.95 Base64-encoded SHA-512 digest used as a parser test vector.
Reasoning
SHA-512 test digest in the same test fixture block for SRI parsing; legitimate test data flagged only by the raw base64 heuristic.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodejs/undici undici && cd undici
git checkout v7.30.1
disclude scan --severity info --diff v7.30.0 .