undici-types 8.12.3

Source: https://github.com/nodejs/undici
Tag scanned: v8.12.3
Compared with: v8.12.2 (0 signals introduced since)
Files: 834 scanned, 30 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 56 info
Scan time: 31.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 49 of 49 warn and critical signals; 49 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-19 19:26

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line README.md:3:1

line length 521 characters (raw pass, confidence 0.50)

[![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h

info proc-macro-presence deps/milo/macros/README.md:10:1

[embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)
```
#[proc_macro]
pub fn new_macro(input: TokenStream) -> TokenStream {
  TokenStream::new( /* ... */)
```
info proc-macro-presence deps/milo/macros/README.md:23:1

[embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)
```
#[proc_macro]
pub fn char(input: TokenStream) -> TokenStream {
  let character = parse_macro_input!(input as LitChar);
```
info proc-macro-presence deps/milo/macros/src/lib.rs:11:1

proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)
```
#[proc_macro]
pub fn generate(_: TokenStream) -> TokenStream { generators::generate() }
```

info long-line docs/docs/index.md:5:1

line length 521 characters (raw pass, confidence 0.50)

[![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h

info long-line lib/llhttp/constants.js:3:1

line length 636 characters (raw pass, confidence 0.50)

exports.SPECIAL_HEADERS = exports.MINOR = exports.MAJOR = exports.HTAB_SP_VCHAR_OBS_TEXT = exports.QUOTED_STRING = exports.CONNECTION_TOKEN_CHARS = exports.HEADER_CHARS = exports.TOKEN = exports.HEX = exports.URL_CHAR = exports.USERINFO_CHARS = exports.MARK = exports.ALPHANUM = exports.NUM = exports.HEX_MAP = exports.N

info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:171:1

base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
```
likely benign LLM, confidence 0.93 Base64-encoded PNG image embedded as test fixture data in a multipart parser test.
Reasoning
Raw-pass base64 finding inside a busboy test file. The blob decodes to a PNG header (iVBORw0KGgo), which is typical of multipart upload test fixtures. Not executed or decoded at runtime, so it is a test payload.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:188:1

base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
```
likely benign LLM, confidence 0.93 Base64-encoded PNG image in a busboy test fixture.
Reasoning
Same embedded PNG test fixture as the other findings in this file (base64 of a PNG). Raw-pass, high false-positive rate, and the context is a parser test.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:254:1

base64-like blob (1044 bytes over 14 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKfSURBVDjLpZPrS1NhHMf9O3bOdmwDCWRE
IYKEUHsVJBI7mg3FvCxL09290jZj2EyLMnJexkgpLbPUanNOberU5taUMnHZUULMvelCtWF0sW/n
```
likely benign LLM, confidence 0.93 Base64-encoded PNG sample in multipart upload test data.
Reasoning
Base64 PNG blob within a multipart test body. The file is a test suite for busboy, which parses uploads, so embedded sample files are expected.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:275:1

base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLpZPrS5NhGIf9W7YvBYOkhlko
qCklWChv2WyKik7blnNris72bi6dus0DLZ0TDxW1odtopDs4D8MDZuLU0kXq61CijSIIasOvv94V
```
likely benign LLM, confidence 0.93 Base64 image data used as a test upload fixture.
Reasoning
Base64 PNG content in a parser test fixture. No decode-and-execute path is visible, and the content is ordinary image data.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:336:1

base64-like blob (776 bytes over 11 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHYSURBVDjLlVLPS1RxHJynpVu7KEn0Vt+2
l6IO5qGCIsIwCPwD6hTUaSk6REoUHeoQ0qVAMrp0COpY0SUIPVRgSl7ScCUTst6zIoqg0y7lvpnP
```
likely benign LLM, confidence 0.93 Base64-encoded image sample in busboy test input.
Reasoning
Base64 PNG fixture in busboy's test file. The blob is plain image data rather than a dropper or obfuscated code.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:354:1

base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLhZNNSFRRFIC/N++9eWMzhkl/
ZJqFMQMRFvTvImkXSdKiVRAURBRRW1eZA9EqaNOiFlZEtQxKyrJwUS0K+qEQzaTE/AtLHR3Hmffu
```
likely benign LLM, confidence 0.93 Base64 PNG sample embedded in multipart test input.
Reasoning
Repeats the PNG-in-base64 test pattern. Raw-pass blob detection in a test directory for a multipart library is expected noise.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:376:1

base64-like blob (3212 bytes over 43 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
        `
LS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5amRTRmhjQVJrOGZ5R055Ng0KQ29udGVudC1EaXNwb3Np
dGlvbjogZm9ybS1kYXRhOyBuYW1lPSJmaWxlMSI7IGZpbGVuYW1lPSJndGstYXBwbHkucG5nIg0K
Q29udGVudC1UeXBlOiBpbWFnZS9wbmcNCg0KiVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACN
```
likely benign LLM, confidence 0.92 Base64-encoded multipart form body with an embedded PNG, used as a parser test case.
Reasoning
Snippet decodes to a multipart boundary header (LS0tLS0tV2ViS2l0 = '------WebKitFormBoundary') followed by Content-Disposition and a PNG. This is a crafted multipart request body used for parser testing, not malicious.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:427:1

base64-like blob (1336 bytes over 18 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAANnSURB
VDiNldJ9aJVVHAfw7znPuS/PvW4405WbLWfbsBuNbramq5Tp7mLqIFPXINlwpAitaCAPjWKgBdXz
```
likely benign LLM, confidence 0.93 Base64 PNG image fixture in busboy tests.
Reasoning
Base64 PNG content (including Inkscape metadata) in a test fixture. Ordinary test data with no execution path.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:452:1

base64-like blob (1272 bytes over 17 lines, compression ratio 0.78) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAM1SURB
VDiNrZTPaxtHFMc/M7uzs7KobckyDjQxtoPbnlJyMBRKgsGFHkwvvfbuU/+BQCilBHrof+BT7zmV
```
likely benign LLM, confidence 0.92 Base64-encoded PNG sample used in multipart parsing tests.
Reasoning
Base64 PNG fixture in a multipart parser test, similar to the other entries in this file. No sign of obfuscated code.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:478:1

base64-like blob (2400 bytes over 32 lines, compression ratio 0.70) (raw pass, confidence 0.60)
```
        `
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS03ZDkxYjAzYTIwMTI4DQpDb250ZW50LURpc3Bv
c2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9ImZpbGUxIjsgZmlsZW5hbWU9IkM6XFB5dGhvbjI1XHd6
dGVzdFx3ZXJremV1Zy1tYWluXHRlc3RzXG11bHRpcGFydFxmaXJlZm94My0ycG5nMXR4dFxmaWxl
```
likely benign LLM, confidence 0.92 Base64 multipart body with a file-path filename, used for upload parsing tests.
Reasoning
Base64 decodes to a multipart body with a Windows file path in filename metadata, typical of upload test cases covering filename handling. Test data, not an attack payload.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:518:1

base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
```
likely benign LLM, confidence 0.93 Base64 PNG test fixture in busboy's parser tests.
Reasoning
Repeats the base64 PNG fixture pattern from the same test file. Raw-pass detection on test data.
info ~~warn~~ → info by review encoding-base64 test/busboy/test-parser.js:535:1

base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)
```
                `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
```
likely benign LLM, confidence 0.93 Base64-encoded PNG sample in busboy test data.
Reasoning
Same PNG base64 fixture pattern as the rest of the file. Benign test input in a multipart parser test suite.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:25:17

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 A base64-encoded SRI digest constant in an undici fetch integrity test.
Reasoning
Raw base64 pattern on a SHA hash string constant used as a subresource integrity value in an undici test file; the hash is the digest of 'Hello world!' and the file is a test fixture.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:63:17

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Repeated base64 SRI digest used as expected value in tests.
Reasoning
Same SRI sha256 digest constant of 'Hello world!' repeated in a test; expected legitimate test data.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:94:17

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Base64 SRI digest constant in a fetch integrity test.
Reasoning
Same SRI digest constant reused in another test case; benign fixture data.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:110:17

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.96 sha384 base64 digest constant in fetch integrity test.
Reasoning
A sha384 digest of the test body in a subresource integrity test; benign raw base64 hash.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:126:24

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha384-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
```
likely benign LLM, confidence 0.96 SRI sha384 value used to assert a fetch rejection.
Reasoning
Integrity option value with sha384 base64 digest passed to fetch in a rejection test; legitimate test data.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:132:17

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.96 sha512 base64 digest constant in integrity test.
Reasoning
sha512 base64 digest constant for the test body; benign test fixture.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:148:24

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha512-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
```
likely benign LLM, confidence 0.96 Mismatched SRI sha512 value in a rejection test.
Reasoning
Deliberately incorrect sha512 integrity value used to test rejection; benign.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:154:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.96 sha384 base64 digest constant in integrity test.
Reasoning
sha384 digest constant in a hash-comparison test; benign.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:244:19

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'ä'
```
likely benign LLM, confidence 0.95 Multiple SRI digest constants in a fetch integrity test.
Reasoning
Hash constants for multiple algorithms in an SRI test; the sha384 'ä' is an odd value but in a test fixture, and the base64 match is a legitimate digest.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:265:19

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.96 Set of base64 SRI digest constants in integrity test.
Reasoning
Collection of SRI digest constants for hash algorithms in a test file; legitimate.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:266:19

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.96 Base64 SRI digest constants in integrity test.
Reasoning
Repeated SRI digest constants in the same test fixture; legitimate.
info ~~warn~~ → info by review encoding-base64 test/fetch/integrity.js:267:19

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.96 sha512 base64 digest constant in integrity test.
Reasoning
sha512 digest constant in an integrity test fixture; legitimate.
info ~~critical~~ → info by review proxy-global-hijack test/install.js:13:27

`new Proxy(globalThis, ...)` interposes on a global object — every property read goes through the handler (ast pass, confidence 0.90)
```
  // and no other properties are added to globalThis by undici.install().
  const proxyGlobalThis = new Proxy(globalThis, {
    set (target, prop, value) {
      if (exportsToCheck.has(prop)) {
```
likely benign LLM, confidence 0.90 Test helper wrapping globalThis in a Proxy to detect unexpected global property writes.
Reasoning
A Proxy over globalThis in undici's install test verifies that no unexpected globals are added. It is a test-only guard, not malicious interposition, though it does intercept global property access, which is notable.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:12:18

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
const skip = runtimeFeatures.has('crypto') === false
const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

test('should ignore well-formed but unknown algorithm tokens', { skip }, (t) => {
```
likely benign LLM, confidence 0.96 SHA256 base64 digest constant in SRI regression test.
Reasoning
Base64 SHA256 digest constant in a regression test for a GHSA advisory about SRI parsing; legitimate test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:25:20

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Base64-encoded SHA hash constants used as test fixtures in an SRI test.
Reasoning
These are SRI hash constants (sha256/384/512 base64 digests of 'Hello world!') in a test file for subresource integrity; base64 digests are expected here and there is no decoding or execution of the blob.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:26:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Base64 sha384 digest fixture in an SRI test file.
Reasoning
Same SRI digest constant block as the other findings in this test file; the base64 string is a legitimate hash value.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:27:20

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Base64 sha512 digest fixture in an SRI test file.
Reasoning
A base64 sha512 digest used as an integrity value in a test; expected content for this kind of test, not obfuscation.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:59:25

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
```
likely benign LLM, confidence 0.97 Intentionally incorrect base64 digest fixture for negative SRI testing.
Reasoning
Deliberately wrong hash constants used to test that integrity checks reject mismatches; legitimate test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:60:25

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
```
likely benign LLM, confidence 0.97 Incorrect base64 sha384 digest fixture for negative testing.
Reasoning
Wrong-hash fixture for negative SRI tests; base64 digest strings are expected in this context.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:61:25

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
```
likely benign LLM, confidence 0.97 Incorrect base64 sha512 digest fixture for negative testing.
Reasoning
Wrong sha512 digest fixture for negative SRI testing; legitimate test constant.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:95:25

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  await t.assert.doesNotReject(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha1024-MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  }))
})
```
likely benign LLM, confidence 0.96 Base64 digest inside an integrity option in a fetch test.
Reasoning
Integrity attribute value with a sha1024-prefixed base64 digest used in a fetch test checking that malformed or unknown algorithms are handled; the blob is a hash string, not a payload.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:101:20

6 rows of base64-like lines, lines 101-106 (first: base64-like blob (44 bytes, compression ratio 1.25)) (raw pass, confidence 0.60)
```
  const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Block of base64 SRI digest fixtures in a test.
Reasoning
Multi-line block of SRI hash constants in a test file; the row grouping reflects the same legitimate digest fixtures.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:12:20

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Base64 sha256 digest constant for an algorithm-application test.
Reasoning
Comment states these are hash values generated for 'Hello world!'; they are legitimate SRI digest fixtures.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:13:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Base64 sha384 digest constant in an SRI test.
Reasoning
Hash fixture with a comment identifying its origin as generated test data; benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:14:20

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('valid sha256', { skip }, (t) => {
```
likely benign LLM, confidence 0.97 Base64 sha512 digest constant in an SRI test.
Reasoning
Legitimate sha512 digest fixture in an SRI test file, consistent with the surrounding hash constants.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:15:26

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  test('identical strings, actualValue has one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
```
likely benign LLM, confidence 0.97 Base64 SRI hash literal used as test input for case-sensitive matching.
Reasoning
This is a test fixture for SRI hash comparison in the ssri library. The base64 string is a hash value used as test data, not an obfuscated payload. Raw-pass base64 heuristic fires on any base64-looking literal.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:22:28

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.97 Base64 hash test fixture with padding variant.
Reasoning
Same SRI hash test fixture with padding variations, part of a unit test checking equality of hash strings. Benign test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:28:28

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.97 Base64 hash test fixture with double padding.
Reasoning
Test fixture containing a base64 hash with double padding for comparison testing. Benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:33:26

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  test('identical strings, both have one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
```
likely benign LLM, confidence 0.97 Base64 hash test fixture for identical-string comparison.
Reasoning
Test fixture for identical hash strings in an SRI comparison test. Benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:34:28

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.97 Base64 hash test fixture for identical-string comparison.
Reasoning
Test fixture for SRI hash comparison, benign test data.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:39:26

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
  test('identical strings, both have two padding chars', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
```
likely benign LLM, confidence 0.97 Double-padded base64 hash test fixture.
Reasoning
Test fixture with double-padded base64 hash for SRI comparison tests. Benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:40:28

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
```
likely benign LLM, confidence 0.97 Double-padded base64 hash test fixture.
Reasoning
Test fixture with double-padded base64 hash for SRI comparison tests. Benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:45:26

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
  test('identical strings, expectedValue has invalid third padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
```
likely benign LLM, confidence 0.97 Base64 hash fixture with invalid padding for negative test.
Reasoning
Test fixture deliberately using an invalid padding variant to check the comparison returns false. Benign test case.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:46:28

base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
  })
```
likely benign LLM, confidence 0.97 Base64 hash fixture with invalid padding for negative test.
Reasoning
Same negative-test fixture with invalid padding. Benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:12:20

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
  /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Precomputed SHA-256/384/512 digests used in metadata parsing tests.
Reasoning
Hash values for a known string ('Hello world!') in SRI metadata parsing tests, with a comment explaining their origin. These are real SHA-256/384/512 digests, not obfuscated payloads.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:13:20

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
```
likely benign LLM, confidence 0.97 Precomputed SHA-384/512 digests used as test vectors.
Reasoning
Same precomputed hash digests used as test vectors for SRI metadata parsing. Benign.
info ~~warn~~ → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:14:20

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('should parse valid metadata with option', { skip }, (t) => {
```
likely benign LLM, confidence 0.95 Base64-encoded SHA-384/SHA-512 hash constants used as test fixtures for SRI metadata parsing.
Reasoning
The flagged string is a base64-encoded SHA-384 hash literal used as test fixture data for parsing SRI metadata. Its length and format match real SRI digests (hash384 is 64 base64 chars here, hash512 is 88), and the file is a test for subresource-integrity parsing. The raw-pass base64 signal is a false positive on expected cryptographic test data.

info long-line types/index.d.ts:48:1

line length 512 characters (raw pass, confidence 0.50)

export { Dispatcher, BalancedPool, RoundRobinPool, Pool, Client, buildConnector, errors, Agent, Dispatcher1Wrapper, request, stream, pipeline, connect, upgrade, setGlobalDispatcher, getGlobalDispatcher, setGlobalOrigin, getGlobalOrigin, interceptors, cacheStores, MockClient, MockPool, MockAgent, SnapshotAgent, MockCall

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodejs/undici undici && cd undici
git checkout v8.12.3
disclude scan --severity info --diff v8.12.2 .