disclude.io

npm / undici-types / 8.12.1

undici-types 8.12.1

Source
https://github.com/nodejs/undici
Tag scanned
v8.12.1
Compared with
v8.12.0 (0 signals introduced since)
Files
828 scanned, 25 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 47 info
Scan time
27.6 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 40 of 40 warn and critical signals; 40 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-15 05:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info long-line README.md:3:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  2. info proc-macro-presence deps/milo/macros/README.md:10:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn new_macro(input: TokenStream) -> TokenStream {
  TokenStream::new( /* ... */)
  3. info proc-macro-presence deps/milo/macros/README.md:23:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn char(input: TokenStream) -> TokenStream {
  let character = parse_macro_input!(input as LitChar);
  4. info proc-macro-presence deps/milo/macros/src/lib.rs:11:1

    proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    
#[proc_macro]
pub fn generate(_: TokenStream) -> TokenStream { generators::generate() }
  5. info long-line docs/docs/index.md:5:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  6. info long-line lib/llhttp/constants.js:3:1

    line length 636 characters (raw pass, confidence 0.50)

    exports.SPECIAL_HEADERS = exports.MINOR = exports.MAJOR = exports.HTAB_SP_VCHAR_OBS_TEXT = exports.QUOTED_STRING = exports.CONNECTION_TOKEN_CHARS = exports.HEADER_CHARS = exports.TOKEN = exports.HEX = exports.URL_CHAR = exports.USERINFO_CHARS = exports.MARK = exports.ALPHANUM = exports.NUM = exports.HEX_MAP = exports.N
  7. info warn → info by review encoding-base64 test/busboy/test-parser.js:171:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.94 Base64-encoded PNG image embedded as a multipart upload fixture in a test.
    Reasoning

    Raw-pass base64 finding in a busboy multipart parser test file. The blob decodes to PNG image data (the iVBORw0KGgo header) embedded as a test upload fixture. Test fixtures routinely embed binary payloads this way, and the raw pass has a high false-positive rate.

  8. info warn → info by review encoding-base64 test/busboy/test-parser.js:188:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.94 Base64 PNG fixture inside a multipart test body.
    Reasoning

    Same file and pattern as the other findings: a base64 PNG payload (iVBORw0KGgo header) inside a template literal used as multipart test input for the busboy parser. No execution or decoding into code, so it looks like ordinary test data.

  9. info warn → info by review encoding-base64 test/busboy/test-parser.js:254:1

    base64-like blob (1044 bytes over 14 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKfSURBVDjLpZPrS1NhHMf9O3bOdmwDCWRE
IYKEUHsVJBI7mg3FvCxL09290jZj2EyLMnJexkgpLbPUanNOberU5taUMnHZUULMvelCtWF0sW/n
    likely benign LLM, confidence 0.94 Base64 PNG blob used as test upload content.
    Reasoning

    Base64 PNG image data (iVBORw0KGgo header) in a template literal of a busboy test file. This is a sample file upload used to exercise the parser, consistent with a legitimate test fixture.

  10. info warn → info by review encoding-base64 test/busboy/test-parser.js:275:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLpZPrS5NhGIf9W7YvBYOkhlko
qCklWChv2WyKik7blnNris72bi6dus0DLZ0TDxW1odtopDs4D8MDZuLU0kXq61CijSIIasOvv94V
    likely benign LLM, confidence 0.94 Embedded PNG in a multipart test fixture.
    Reasoning

    Base64 PNG payload in a multipart body within a busboy test. The content is image data with multipart headers in the surrounding text, and nothing in the snippet decodes into executable code.

  11. info warn → info by review encoding-base64 test/busboy/test-parser.js:336:1

    base64-like blob (776 bytes over 11 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHYSURBVDjLlVLPS1RxHJynpVu7KEn0Vt+2
l6IO5qGCIsIwCPwD6hTUaSk6REoUHeoQ0qVAMrp0COpY0SUIPVRgSl7ScCUTst6zIoqg0y7lvpnP
    likely benign LLM, confidence 0.94 Base64 image fixture for upload parsing tests.
    Reasoning

    Base64 PNG image data inside a test template literal for the busboy multipart parser. This is expected test input for file-upload parsing, not obfuscation.

  12. info warn → info by review encoding-base64 test/busboy/test-parser.js:354:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLhZNNSFRRFIC/N++9eWMzhkl/
ZJqFMQMRFvTvImkXSdKiVRAURBRRW1eZA9EqaNOiFlZEtQxKyrJwUS0K+qEQzaTE/AtLHR3Hmffu
    likely benign LLM, confidence 0.94 Base64 PNG fixture in a multipart test.
    Reasoning

    Base64 PNG blob in a busboy test template literal. It is the same kind of multipart file-upload fixture as the rest of the file and carries no executable or dropper behavior.

  13. info warn → info by review encoding-base64 test/busboy/test-parser.js:376:1

    base64-like blob (3212 bytes over 43 lines, compression ratio 0.71) (raw pass, confidence 0.60)

            `
LS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5amRTRmhjQVJrOGZ5R055Ng0KQ29udGVudC1EaXNwb3Np
dGlvbjogZm9ybS1kYXRhOyBuYW1lPSJmaWxlMSI7IGZpbGVuYW1lPSJndGstYXBwbHkucG5nIg0K
Q29udGVudC1UeXBlOiBpbWFnZS9wbmcNCg0KiVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACN
    likely benign LLM, confidence 0.93 Base64-encoded multipart body with an embedded PNG file, used as a test request.
    Reasoning

    Base64 text decodes to a multipart boundary and headers (form-data, image/png) followed by PNG bytes. This is a crafted multipart request body for parser tests, a normal testing technique for upload handling.

  14. info warn → info by review encoding-base64 test/busboy/test-parser.js:427:1

    base64-like blob (1336 bytes over 18 lines, compression ratio 0.77) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAANnSURB
VDiNldJ9aJVVHAfw7znPuS/PvW4405WbLWfbsBuNbramq5Tp7mLqIFPXINlwpAitaCAPjWKgBdXz
    likely benign LLM, confidence 0.94 Base64 PNG sample in a multipart parser test.
    Reasoning

    Base64 PNG data (iVBORw0KGgo header) from a busboy test fixture, consistent with sample file content for upload parsing tests.

  15. info warn → info by review encoding-base64 test/busboy/test-parser.js:452:1

    base64-like blob (1272 bytes over 17 lines, compression ratio 0.78) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAM1SURB
VDiNrZTPaxtHFMc/M7uzs7KobckyDjQxtoPbnlJyMBRKgsGFHkwvvfbuU/+BQCilBHrof+BT7zmV
    likely benign LLM, confidence 0.94 Base64 PNG test data for multipart parsing.
    Reasoning

    Base64 PNG blob within a busboy test file. It is test input data for multipart parsing with no decoding into code or execution path.

  16. info warn → info by review encoding-base64 test/busboy/test-parser.js:478:1

    base64-like blob (2400 bytes over 32 lines, compression ratio 0.70) (raw pass, confidence 0.60)

            `
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS03ZDkxYjAzYTIwMTI4DQpDb250ZW50LURpc3Bv
c2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9ImZpbGUxIjsgZmlsZW5hbWU9IkM6XFB5dGhvbjI1XHd6
dGVzdFx3ZXJremV1Zy1tYWluXHRlc3RzXG11bHRpcGFydFxmaXJlZm94My0ycG5nMXR4dFxmaWxl
    likely benign LLM, confidence 0.93 Base64-encoded multipart request body with a file part, used in a parser test.
    Reasoning

    Base64 decodes to a multipart boundary and Content-Disposition headers including a Windows-style filename, followed by file data. This is a crafted multipart test body for the busboy parser, which fits a test scenario.

  17. info warn → info by review encoding-base64 test/busboy/test-parser.js:518:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.94 Base64 PNG fixture in a busboy test.
    Reasoning

    Repeat of the base64 PNG fixture pattern in the busboy test file. The payload is image data for upload parsing tests and shows no malicious or obfuscated execution.

  18. info warn → info by review encoding-base64 test/busboy/test-parser.js:535:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.94 Base64 PNG test fixture for multipart parsing.
    Reasoning

    Base64 PNG blob in a busboy multipart test template literal. Test fixture data, not a dropper or hidden payload.

  19. info warn → info by review encoding-base64 test/fetch/integrity.js:25:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.97 A base64 SHA-256 hash literal used as an expected integrity value in a test.
    Reasoning

    The blob is a SHA-256 digest used as a Subresource Integrity value in a fetch integrity test. Raw-pass base64 detection on test vectors like this is a known false positive.

  20. info warn → info by review encoding-base64 test/fetch/integrity.js:63:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.97 A base64 SHA-256 hash literal used as an expected integrity value in a test.
    Reasoning

    Same SRI hash test vector as the other findings in this file, used to check fetch integrity validation against a known body.

  21. info warn → info by review encoding-base64 test/fetch/integrity.js:94:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.97 A base64 SHA-256 hash literal used as an expected integrity value in a test.
    Reasoning

    Same SRI hash test vector, repeated in another fetch integrity test case.

  22. info warn → info by review encoding-base64 test/fetch/integrity.js:110:17

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.97 A base64 SHA-384 digest literal used as an expected integrity value in a test.
    Reasoning

    A 64-byte base64 SHA-384 digest of 'Hello world!' used as an SRI test value. The file is a conformance test for fetch integrity.

  23. info warn → info by review encoding-base64 test/fetch/integrity.js:126:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha384-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    dismissed LLM, confidence 0.96 A base64 SHA-384 integrity string used in a negative fetch test.
    Reasoning

    An sha384 SRI string passed as the integrity option to fetch in a test that asserts rejection on mismatch. This is a deliberately wrong test vector, not an attack.

  24. info warn → info by review encoding-base64 test/fetch/integrity.js:132:17

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.96 A base64 SHA-512 digest literal used as an expected integrity value in a test.
    Reasoning

    A 88-byte base64 SHA-512 digest used as an SRI test value in the fetch integrity test file.

  25. info warn → info by review encoding-base64 test/fetch/integrity.js:148:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha512-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    dismissed LLM, confidence 0.96 A base64 integrity string used in a negative fetch test.
    Reasoning

    A sha512 SRI string with a mismatched digest passed to fetch in a negative test that expects rejection.

  26. info warn → info by review encoding-base64 test/fetch/integrity.js:154:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.96 A base64 SHA-384 digest literal used as a test vector.
    Reasoning

    A SHA-384 digest literal used as a test vector for integrity checking.

  27. info warn → info by review encoding-base64 test/fetch/integrity.js:244:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'ä'
    dismissed LLM, confidence 0.93 A base64 SHA-256 test vector next to a non-ASCII string literal in an integrity test.
    Reasoning

    A SHA-256 digest literal in a fetch integrity test. The adjacent 'ä' value looks like a deliberate non-ASCII test input for hashing or encoding edge cases, not obfuscation.

  28. info warn → info by review encoding-base64 test/fetch/integrity.js:265:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    dismissed LLM, confidence 0.96 A group of base64 digest literals used as integrity test vectors.
    Reasoning

    A group of SHA-256, SHA-384 and SHA-512 test vectors for the same body, used to verify multi-algorithm integrity parsing.

  29. info warn → info by review encoding-base64 test/fetch/integrity.js:266:19

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    dismissed LLM, confidence 0.96 A group of base64 digest literals used as integrity test vectors.
    Reasoning

    Same group of SRI digest test vectors for the same body.

  30. info warn → info by review encoding-base64 test/fetch/integrity.js:267:19

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.96 A group of base64 digest literals used as integrity test vectors.
    Reasoning

    Same group of SRI digest test vectors for the same body.

  31. info critical → info by review proxy-global-hijack test/install.js:13:27

    `new Proxy(globalThis, ...)` interposes on a global object — every property read goes through the handler (ast pass, confidence 0.90)

      // and no other properties are added to globalThis by undici.install().
  const proxyGlobalThis = new Proxy(globalThis, {
    set (target, prop, value) {
      if (exportsToCheck.has(prop)) {
    likely benign LLM, confidence 0.90 A Proxy over globalThis in a test that verifies undici.install() adds no unexpected globals.
    Reasoning

    This is undici's install test. The Proxy wraps globalThis only to detect unexpected global property additions during undici.install(), and the comment above it describes that check. It is a test harness for global leakage, not a hijack of application code. The critical severity comes from the AST rule matching the pattern alone.

  32. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    dismissed LLM, confidence 0.97 Test fixture containing base64-encoded SRI digest values.
    Reasoning

    These are SRI hash test vectors (sha256/384/512 digests of 'Hello world!') in a test file for the subresource-integrity library, explicitly commented as generated hash values. Base64 digest strings are expected here and are not obfuscation.

  33. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    dismissed LLM, confidence 0.97 Test fixture containing a base64-encoded sha384 digest.
    Reasoning

    Same SRI test-vector constants as the other finding in this file; a raw base64 digest in a hash-algorithm test is legitimate data.

  34. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('valid sha256', { skip }, (t) => {
    dismissed LLM, confidence 0.97 Test fixture containing a base64-encoded sha512 digest.
    Reasoning

    Expected SRI digest constant used in tests of the subresource-integrity package; a legitimate base64 literal.

  35. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:15:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, actualValue has one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    dismissed LLM, confidence 0.97 Test string literal of a base64 value used to check padding-sensitive matching.
    Reasoning

    Test of a case-sensitive base64 comparison helper using a sample base64 string with padding. The literal is test data needed to exercise padding behavior.

  36. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:22:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    dismissed LLM, confidence 0.97 Test literal base64 value without padding for comparison tests.
    Reasoning

    Same base64 test literal reused for padding-comparison test cases in a legitimate SRI test suite.

  37. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:28:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    dismissed LLM, confidence 0.97 Test literal base64 value with double padding for comparison tests.
    Reasoning

    Test data with varying base64 padding characters to verify matching semantics; benign test vector.

  38. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:33:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, both have one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    dismissed LLM, confidence 0.97 Test literal base64 value with single padding in a match test.
    Reasoning

    Identical base64 test strings in a unit test for a padding-aware comparison function; no malicious behavior.

  39. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:34:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    dismissed LLM, confidence 0.97 Test literal base64 value with single padding used as expected value.
    Reasoning

    Duplicate base64 test vector in the same legitimate unit test file.

  40. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:39:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, both have two padding chars', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    dismissed LLM, confidence 0.97 Test literal base64 value with double padding in a match test.
    Reasoning

    Test literal with two padding characters for padding-validation test; benign.

  41. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:40:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    dismissed LLM, confidence 0.97 Test literal base64 value with double padding used as expected value.
    Reasoning

    Duplicate double-padded base64 test vector in a legitimate unit test.

  42. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:45:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, expectedValue has invalid third padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
    dismissed LLM, confidence 0.97 Test literal with invalid extra padding to verify mismatch detection.
    Reasoning

    Test deliberately uses an invalid third padding character to check rejection; the base64-like strings are test inputs for a negative case, not obfuscation.

  43. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:46:28

    base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
  })
    likely benign LLM, confidence 0.95 Test fixture containing base64-encoded SRI-style hash values used to verify case-sensitive comparison.
    Reasoning

    This is a raw-pass base64 match on a test fixture string for SRI hash comparison. The test intentionally uses near-identical base64 strings (one with an extra '=') to check that caseSensitiveMatch returns false. Legitimate test data, not obfuscation.

  44. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.96 Test constant holding a base64-encoded SHA-256 digest for SRI metadata parsing tests.
    Reasoning

    The snippet is preceded by a comment stating these are hash values generated for 'Hello world!'. These are standard SHA-256 base64 digests in a subresource-integrity test file, a well-known legitimate pattern.

  45. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.96 Test constants with base64-encoded SHA-384 and SHA-512 digests for SRI parsing tests.
    Reasoning

    Standard base64 digest constants (SHA-384/SHA-512 hash literals) in a test for SRI metadata parsing, with an explanatory comment. Expected content for this test file; no execution or concealment.

  46. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('should parse valid metadata with option', { skip }, (t) => {
    likely benign LLM, confidence 0.96 Test constant holding a base64-encoded SHA-384 digest for SRI metadata parsing.
    Reasoning

    Base64 hash literal in a test fixture for subresource integrity metadata parsing. Raw-pass high-entropy/base64 signal fires on expected cryptographic digest data, which is a known false-positive source.

  47. info long-line types/index.d.ts:48:1

    line length 512 characters (raw pass, confidence 0.50)

    export { Dispatcher, BalancedPool, RoundRobinPool, Pool, Client, buildConnector, errors, Agent, Dispatcher1Wrapper, request, stream, pipeline, connect, upgrade, setGlobalDispatcher, getGlobalDispatcher, setGlobalOrigin, getGlobalOrigin, interceptors, cacheStores, MockClient, MockPool, MockAgent, SnapshotAgent, MockCall

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodejs/undici undici && cd undici
git checkout v8.12.1
disclude scan --severity info --diff v8.12.0 .