undici-types 8.11.2

Source: https://github.com/nodejs/undici
Tag scanned: v8.11.2
Compared with: v8.11.1 (0 signals introduced since)
Files: 777 scanned, 17 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 44 info
Scan time: 24.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 40 of 40 warn and critical signals; 40 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:07

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line README.md:3:1

line length 521 characters (raw pass, confidence 0.50)

[![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h

info long-line docs/docs/index.md:5:1

line length 521 characters (raw pass, confidence 0.50)

[![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h

info long-line lib/llhttp/constants.js:3:1

line length 636 characters (raw pass, confidence 0.50)

exports.SPECIAL_HEADERS = exports.MINOR = exports.MAJOR = exports.HTAB_SP_VCHAR_OBS_TEXT = exports.QUOTED_STRING = exports.CONNECTION_TOKEN_CHARS = exports.HEADER_CHARS = exports.TOKEN = exports.HEX = exports.URL_CHAR = exports.USERINFO_CHARS = exports.MARK = exports.ALPHANUM = exports.NUM = exports.HEX_MAP = exports.N

info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:171:1

base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
```
likely benign LLM, confidence 0.92 Base64-encoded PNG image embedded as a test fixture for multipart parsing.
Reasoning
Raw-pass base64 signal on an embedded PNG image literal inside a busboy test file. Image fixtures for multipart upload tests are expected, and the raw pass has a high false-positive rate for blobs like this.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:188:1

base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
```
likely benign LLM, confidence 0.92 Another base64-encoded PNG test fixture in the busboy parser test suite.
Reasoning
Same embedded base64 PNG test-fixture pattern as the other findings in this file. No execution, decoding into code, or dropper behaviour is visible.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:254:1

base64-like blob (1044 bytes over 14 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKfSURBVDjLpZPrS1NhHMf9O3bOdmwDCWRE
IYKEUHsVJBI7mg3FvCxL09290jZj2EyLMnJexkgpLbPUanNOberU5taUMnHZUULMvelCtWF0sW/n
```
likely benign LLM, confidence 0.92 Base64 PNG blob used as multipart test input.
Reasoning
Base64 PNG data inside a template literal in a test file, consistent with multipart upload test inputs. Nothing decodes or executes it.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:275:1

base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLpZPrS5NhGIf9W7YvBYOkhlko
qCklWChv2WyKik7blnNris72bi6dus0DLZ0TDxW1odtopDs4D8MDZuLU0kXq61CijSIIasOvv94V
```
likely benign LLM, confidence 0.92 Base64 PNG image inside a busboy test template literal.
Reasoning
Base64 PNG content in a test fixture, the same pattern as the neighbouring findings. Raw-pass blob detection on image data is a known false-positive source.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:336:1

base64-like blob (776 bytes over 11 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHYSURBVDjLlVLPS1RxHJynpVu7KEn0Vt+2
l6IO5qGCIsIwCPwD6hTUaSk6REoUHeoQ0qVAMrp0COpY0SUIPVRgSl7ScCUTst6zIoqg0y7lvpnP
```
likely benign LLM, confidence 0.92 Base64 image data in a multipart test body.
Reasoning
Base64 image bytes appear inside a multipart body string in a parser test. This is test data, not a payload.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:354:1

base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLhZNNSFRRFIC/N++9eWMzhkl/
ZJqFMQMRFvTvImkXSdKiVRAURBRRW1eZA9EqaNOiFlZEtQxKyrJwUS0K+qEQzaTE/AtLHR3Hmffu
```
likely benign LLM, confidence 0.92 Base64 PNG test fixture for multipart parsing.
Reasoning
Base64 PNG fixture in a parser test file. Nothing in the snippet decodes or executes the data.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:376:1

base64-like blob (3212 bytes over 43 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
        `
LS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5amRTRmhjQVJrOGZ5R055Ng0KQ29udGVudC1EaXNwb3Np
dGlvbjogZm9ybS1kYXRhOyBuYW1lPSJmaWxlMSI7IGZpbGVuYW1lPSJndGstYXBwbHkucG5nIg0K
Q29udGVudC1UeXBlOiBpbWFnZS9wbmcNCg0KiVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACN
```
likely benign LLM, confidence 0.90 Multipart form body fixture with base64 file content.
Reasoning
Snippet shows a multipart boundary and headers, base64-encoded in part, with an embedded PNG. This is a realistic multipart test case, and the raw-pass blob has no execution path.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:427:1

base64-like blob (1336 bytes over 18 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAANnSURB
VDiNldJ9aJVVHAfw7znPuS/PvW4405WbLWfbsBuNbramq5Tp7mLqIFPXINlwpAitaCAPjWKgBdXz
```
likely benign LLM, confidence 0.92 Base64-encoded PNG image test fixture.
Reasoning
Base64 PNG fixture data inside a busboy test. Routine test content with no decoding or execution around it.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:452:1

base64-like blob (1272 bytes over 17 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAM1SURB
VDiNrZTPaxtHFMc/M7uzs7KobckyDjQxtoPbnlJyMBRKgsGFHkwvvfbuU/+BQCilBHrof+BT7zmV
```
likely benign LLM, confidence 0.92 Base64 PNG content in a busboy test fixture.
Reasoning
Base64 PNG data in a parser test case, matching the other fixture findings in the file. No suspicious execution context.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:478:1

base64-like blob (2400 bytes over 32 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
        `
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS03ZDkxYjAzYTIwMTI4DQpDb250ZW50LURpc3Bv
c2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9ImZpbGUxIjsgZmlsZW5hbWU9IkM6XFB5dGhvbjI1XHd6
dGVzdFx3ZXJremV1Zy1tYWluXHRlc3RzXG11bHRpcGFydFxmaXJlZm94My0ycG5nMXR4dFxmaWxl
```
likely benign LLM, confidence 0.90 Base64-encoded multipart body fixture with a filename header.
Reasoning
The base64 decodes to multipart headers including a Windows-style filename, which is typical of an upload-parsing test covering path handling. It is test data inside a parser test, not an executable payload.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:518:1

base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
```
likely benign LLM, confidence 0.95 Base64-encoded PNG image embedded as test fixture data for the busboy parser tests.
Reasoning
The blob starts with the PNG signature base64 (iVBORw0KGgo) and is a test fixture for multipart file uploads in a busboy test. Raw pass base64 heuristic on embedded image data in a test file.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:535:1

base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
```
likely benign LLM, confidence 0.95 Another base64-encoded PNG test fixture in the busboy parser tests.
Reasoning
Continuation of the same embedded base64 PNG test fixture (iVBORw0KGgo header, then image data) in busboy test-parser.js.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:25:17

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 A base64 SRI digest constant used in a fetch integrity test.
Reasoning
The value is a SHA-256 Subresource Integrity hash of 'Hello world!' used in a fetch integrity test. Expected for this file's purpose.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:63:17

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Repeated base64 SRI digest constant in the fetch integrity tests.
Reasoning
Same SRI hash constant for the test body, repeated in another test case of the integrity test file.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:94:17

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Repeated base64 SRI digest constant in the fetch integrity tests.
Reasoning
Same SRI digest constant reused in a further integrity test case; legitimate test data.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:110:17

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.96 Base64 sha384 integrity digest constant in a fetch test.
Reasoning
A sha384 SRI digest string used for integrity verification testing of fetch; standard hash literal.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:126:24

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha384-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
```
likely benign LLM, confidence 0.96 Intentionally incorrect base64 integrity value used to test fetch rejection.
Reasoning
Deliberately wrong sha384 integrity value passed to fetch to assert rejection; a normal negative test case.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:132:17

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.96 Base64 sha512 integrity digest constant in a fetch test.
Reasoning
A sha512 SRI digest constant used in the integrity test file; standard hash literal.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:148:24

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha512-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
```
likely benign LLM, confidence 0.96 Intentionally incorrect base64 sha512 integrity value in a fetch rejection test.
Reasoning
Intentionally mismatched sha512 integrity value used to assert fetch rejects; normal negative test.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:154:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.96 Base64 sha384 integrity digest constant in a fetch test.
Reasoning
A sha384 digest constant for integrity testing, identical to other test fixtures in this file.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:244:19

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'ä'
```
likely benign LLM, confidence 0.93 Base64 sha256 digest constant with a placeholder value in a fetch integrity test.
Reasoning
The sha256 constant is a standard SRI digest; the adjacent sha384 'ä' is an odd non-ASCII placeholder, which is worth noting but does not indicate malicious obfuscation in a test file.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:265:19

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Test fixture containing precomputed SHA digests of a known string.
Reasoning
The raw base64 finding is on SHA-256/384/512 digest strings of 'Hello world!' used as Subresource Integrity test vectors inside a test file. These are expected hash values, not obfuscated payloads.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:266:19

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Precomputed hash values used as integrity test fixtures.
Reasoning
Same SHA-256/384/512 test vectors for 'Hello world!' in a Subresource Integrity test; base64 digest strings are expected here.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:267:19

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Precomputed SHA-384 digest used as a test value.
Reasoning
The flagged 88-byte string is a SHA-384 digest test vector in an integrity test file; benign fixture data.
info ~~critical~~ → info by review proxy-global-hijack test/install.js:13:27

`new Proxy(globalThis, ...)` interposes on a global object — every property read goes through the handler (ast pass, confidence 0.90)
```
  // and no other properties are added to globalThis by undici.install().
  const proxyGlobalThis = new Proxy(globalThis, {
    set (target, prop, value) {
      if (exportsToCheck.has(prop)) {
```
likely benign LLM, confidence 0.85 Test-only Proxy over globalThis used to detect unexpected global property writes.
Reasoning
This is undici's test verifying that installing globals does not add unexpected properties to globalThis. The Proxy wraps globalThis only inside a test to detect property sets, so it is a legitimate testing technique rather than a hijack in shipped code.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:12:20

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Expected SHA-256 digest constant in a test.
Reasoning
Hash values for 'Hello world!' are explicitly labeled as generated expected outputs in an SRI test; not obfuscation.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:13:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Expected SHA-384 digest constant in a test.
Reasoning
Expected SHA-384 test vector in an SRI test fixture file; benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:14:20

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('valid sha256', { skip }, (t) => {
```
likely benign LLM, confidence 0.97 Expected SHA-512 digest constant in a test.
Reasoning
Expected SHA-512 test vector in an SRI test fixture file; benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:15:26

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  test('identical strings, actualValue has one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
```
likely benign LLM, confidence 0.96 Base64 test strings for validating a string-matching helper.
Reasoning
Base64 strings differing only by padding are used to test a case-sensitive comparison function in an SRI test. Test data, not malicious.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:22:28

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.96 Base64 test strings for validating a string-matching helper.
Reasoning
Same padding-variant base64 test pair for case-sensitive matching in SRI tests; benign fixture.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:28:28

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.96 Base64 test strings for validating a string-matching helper.
Reasoning
Base64 test values with varied padding for a case-sensitive comparison test; benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:33:26

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  test('identical strings, both have one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
```
likely benign LLM, confidence 0.95 Base64 SHA hash string used as a test fixture for case-sensitive matching.
Reasoning
Raw-pass base64 heuristic fired on a literal SRI-style digest used as test input in a subresource-integrity test suite. Test fixtures of this kind are expected; no execution or obfuscation involved.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:34:28

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.95 Duplicate base64 digest fixture in the same SRI test.
Reasoning
Same identical base64 digest literal repeated in the test file; benign test data for comparing integrity strings.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:39:26

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
  test('identical strings, both have two padding chars', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
```
likely benign LLM, confidence 0.95 Padded base64 digest fixture for a two-padding-char test case.
Reasoning
Base64 digest with padding used as expected/actual test input for SRI matching; benign test fixture.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:40:28

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.95 Duplicate padded base64 digest fixture in the SRI test.
Reasoning
Repeated padded base64 fixture within the same test; no malicious indicators.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:45:26

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
  test('identical strings, expectedValue has invalid third padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
```
likely benign LLM, confidence 0.95 Malformed base64 digest used as negative test input for padding validation.
Reasoning
Deliberately malformed base64 padding used to test rejection of invalid input in an SRI comparison; this is intentional negative-test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:46:28

base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
  })
```
likely benign LLM, confidence 0.95 Duplicate malformed base64 fixture in the negative SRI test.
Reasoning
Same malformed-padding negative fixture repeated; benign test code.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:12:20

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.95 Precomputed SHA-256 base64 hash constant for parse-metadata tests.
Reasoning
Hash constants with a comment stating they were generated for a known string 'Hello world!'; typical test expectations for SRI metadata parsing.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:13:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.95 Precomputed base64 hash constants for SRI metadata parsing tests.
Reasoning
Documented SHA-384 and SHA-512 test vectors in a parser test file; no execution or concealment.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:14:20

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('should parse valid metadata with option', { skip }, (t) => {
```
likely benign LLM, confidence 0.95 Base64 SHA-384 digest literal used in metadata parsing test.
Reasoning
Base64 hash literal in a test for parsing integrity metadata; the entropy heuristic fires on expected digest data.

info long-line types/index.d.ts:48:1

line length 512 characters (raw pass, confidence 0.50)

export { Dispatcher, BalancedPool, RoundRobinPool, Pool, Client, buildConnector, errors, Agent, Dispatcher1Wrapper, request, stream, pipeline, connect, upgrade, setGlobalDispatcher, getGlobalDispatcher, setGlobalOrigin, getGlobalOrigin, interceptors, cacheStores, MockClient, MockPool, MockAgent, SnapshotAgent, MockCall

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodejs/undici undici && cd undici
git checkout v8.11.2
disclude scan --severity info --diff v8.11.1 .