disclude.io

npm / undici-types / 8.12.3

undici-types 8.12.3

Source
https://github.com/nodejs/undici
Tag scanned
v8.12.3
Compared with
v8.12.2 (0 signals introduced since)
Files
834 scanned, 30 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 56 info
Scan time
28.9 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 49 of 49 warn and critical signals; 49 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-22 11:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info long-line README.md:3:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  2. info proc-macro-presence deps/milo/macros/README.md:10:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn new_macro(input: TokenStream) -> TokenStream {
  TokenStream::new( /* ... */)
  3. info proc-macro-presence deps/milo/macros/README.md:23:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn char(input: TokenStream) -> TokenStream {
  let character = parse_macro_input!(input as LitChar);
  4. info proc-macro-presence deps/milo/macros/src/lib.rs:11:1

    proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    
#[proc_macro]
pub fn generate(_: TokenStream) -> TokenStream { generators::generate() }
  5. info long-line docs/docs/index.md:5:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  6. info long-line lib/llhttp/constants.js:3:1

    line length 636 characters (raw pass, confidence 0.50)

    exports.SPECIAL_HEADERS = exports.MINOR = exports.MAJOR = exports.HTAB_SP_VCHAR_OBS_TEXT = exports.QUOTED_STRING = exports.CONNECTION_TOKEN_CHARS = exports.HEADER_CHARS = exports.TOKEN = exports.HEX = exports.URL_CHAR = exports.USERINFO_CHARS = exports.MARK = exports.ALPHANUM = exports.NUM = exports.HEX_MAP = exports.N
  7. info warn → info by review encoding-base64 test/busboy/test-parser.js:171:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.93 Base64-encoded PNG image embedded as a test fixture in a busboy multipart parser test.
    Reasoning

    Raw-pass base64 match inside a template literal in a busboy parser test. The decoded content is a PNG image (the iVBORw0KGgo header), which is the expected payload for a multipart upload test. Raw findings have a high false-positive rate, and this is a fixture, not hidden code.

  8. info warn → info by review encoding-base64 test/busboy/test-parser.js:188:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.93 Base64-encoded PNG image used as multipart upload test data.
    Reasoning

    Same pattern as the other fixtures in this file: a base64 PNG (iVBORw0KGgo header) inside a template literal in a multipart parser test. It is test data for file-upload parsing.

  9. info warn → info by review encoding-base64 test/busboy/test-parser.js:254:1

    base64-like blob (1044 bytes over 14 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKfSURBVDjLpZPrS1NhHMf9O3bOdmwDCWRE
IYKEUHsVJBI7mg3FvCxL09290jZj2EyLMnJexkgpLbPUanNOberU5taUMnHZUULMvelCtWF0sW/n
    likely benign LLM, confidence 0.93 Base64-encoded PNG image test fixture for busboy parser tests.
    Reasoning

    Base64 PNG fixture in a busboy test file. The snippet shows only image data, with no decoding, execution, or dropper logic. Consistent with legitimate test content.

  10. info warn → info by review encoding-base64 test/busboy/test-parser.js:275:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLpZPrS5NhGIf9W7YvBYOkhlko
qCklWChv2WyKik7blnNris72bi6dus0DLZ0TDxW1odtopDs4D8MDZuLU0kXq61CijSIIasOvv94V
    likely benign LLM, confidence 0.93 Base64 PNG fixture in a busboy multipart test.
    Reasoning

    Base64 PNG blob in a multipart test fixture. No executable context is shown, and the file is a parser test suite.

  11. info warn → info by review encoding-base64 test/busboy/test-parser.js:336:1

    base64-like blob (776 bytes over 11 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHYSURBVDjLlVLPS1RxHJynpVu7KEn0Vt+2
l6IO5qGCIsIwCPwD6hTUaSk6REoUHeoQ0qVAMrp0COpY0SUIPVRgSl7ScCUTst6zIoqg0y7lvpnP
    likely benign LLM, confidence 0.93 Base64 PNG image sample used in busboy test cases.
    Reasoning

    Base64 image data in a parser test fixture. The blob decodes to a PNG-style payload typical of upload tests, and the file's purpose is parser verification.

  12. info warn → info by review encoding-base64 test/busboy/test-parser.js:354:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLhZNNSFRRFIC/N++9eWMzhkl/
ZJqFMQMRFvTvImkXSdKiVRAURBRRW1eZA9EqaNOiFlZEtQxKyrJwUS0K+qEQzaTE/AtLHR3Hmffu
    likely benign LLM, confidence 0.93 Base64 PNG fixture for busboy multipart parsing tests.
    Reasoning

    Base64 PNG fixture inside a multipart test in a parser library's test directory. No evidence of obfuscated code or malicious use.

  13. info warn → info by review encoding-base64 test/busboy/test-parser.js:376:1

    base64-like blob (3212 bytes over 43 lines, compression ratio 0.71) (raw pass, confidence 0.60)

            `
LS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5amRTRmhjQVJrOGZ5R055Ng0KQ29udGVudC1EaXNwb3Np
dGlvbjogZm9ybS1kYXRhOyBuYW1lPSJmaWxlMSI7IGZpbGVuYW1lPSJndGstYXBwbHkucG5nIg0K
Q29udGVudC1UeXBlOiBpbWFnZS9wbmcNCg0KiVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACN
    likely benign LLM, confidence 0.92 Base64-encoded multipart form body with an embedded PNG, used as a parser test fixture.
    Reasoning

    The blob starts with a base64-encoded multipart boundary and Content-Disposition headers (form-data, file1, gtk-apply.png) followed by PNG data. This is a hand-built multipart request body fixture for testing a parser, and the content is plainly test data.

  14. info warn → info by review encoding-base64 test/busboy/test-parser.js:427:1

    base64-like blob (1336 bytes over 18 lines, compression ratio 0.77) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAANnSURB
VDiNldJ9aJVVHAfw7znPuS/PvW4405WbLWfbsBuNbramq5Tp7mLqIFPXINlwpAitaCAPjWKgBdXz
    likely benign LLM, confidence 0.93 Base64-encoded PNG sample image in a busboy test fixture.
    Reasoning

    Base64 PNG blob (Inkscape metadata visible in the decoded chunk) in a busboy test file. Real-world sample image data used for upload parsing tests, not hidden logic.

  15. info warn → info by review encoding-base64 test/busboy/test-parser.js:452:1

    base64-like blob (1272 bytes over 17 lines, compression ratio 0.78) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAM1SURB
VDiNrZTPaxtHFMc/M7uzs7KobckyDjQxtoPbnlJyMBRKgsGFHkwvvfbuU/+BQCilBHrof+BT7zmV
    likely benign LLM, confidence 0.93 Base64 PNG image fixture in busboy parser tests.
    Reasoning

    Another base64 PNG fixture of the same kind as the nearby entries in this test file. The content is image data for multipart testing.

  16. info warn → info by review encoding-base64 test/busboy/test-parser.js:478:1

    base64-like blob (2400 bytes over 32 lines, compression ratio 0.70) (raw pass, confidence 0.60)

            `
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS03ZDkxYjAzYTIwMTI4DQpDb250ZW50LURpc3Bv
c2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9ImZpbGUxIjsgZmlsZW5hbWU9IkM6XFB5dGhvbjI1XHd6
dGVzdFx3ZXJremV1Zy1tYWluXHRlc3RzXG11bHRpcGFydFxmaXJlZm94My0ycG5nMXR4dFxmaWxl
    likely benign LLM, confidence 0.92 Base64-encoded multipart request body fixture with a Windows-style filename, used in busboy tests.
    Reasoning

    Base64 multipart body fixture with a boundary, form-data headers, and a Windows file path as the filename. This is a crafted upload request sample for testing filename handling in the parser. The path is data in a test, not executed code.

  17. info warn → info by review encoding-base64 test/busboy/test-parser.js:518:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.93 Base64 PNG fixture repeated in busboy multipart test cases.
    Reasoning

    Repeated base64 PNG fixture, identical in its opening bytes to other entries in the same test file. Legitimate test data.

  18. info warn → info by review encoding-base64 test/busboy/test-parser.js:535:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.93 Base64 PNG sample embedded as busboy test data.
    Reasoning

    Base64 PNG blob in a parser test file, matching the other fixtures here. No decoding or execution context is present.

  19. info warn → info by review encoding-base64 test/fetch/integrity.js:25:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 SRI hash constant in an undici fetch integrity test.
    Reasoning

    Raw base64 hash literal used as a Subresource Integrity digest in undici's fetch test suite; it is the SHA-256 of 'Hello world!' and is expected test data, not obfuscation.

  20. info warn → info by review encoding-base64 test/fetch/integrity.js:63:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Repeated base64 SRI digest constant in test file.
    Reasoning

    Same SHA-256 base64 test vector for 'Hello world!' in a fetch integrity test; benign test fixture.

  21. info warn → info by review encoding-base64 test/fetch/integrity.js:94:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 SRI digest constant in fetch integrity test.
    Reasoning

    Same benign SRI digest test vector reused across test cases.

  22. info warn → info by review encoding-base64 test/fetch/integrity.js:110:17

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.96 SHA-384 base64 digest test vector.
    Reasoning

    A SHA-384 digest of 'Hello world!' used as test input for integrity checking; legitimate test data.

  23. info warn → info by review encoding-base64 test/fetch/integrity.js:126:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha384-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    likely benign LLM, confidence 0.96 SRI hash used in a rejection test case.
    Reasoning

    Deliberately malformed or mismatched SRI hash in an assertion that fetch rejects; standard negative test.

  24. info warn → info by review encoding-base64 test/fetch/integrity.js:132:17

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.96 SHA-512 base64 digest test vector.
    Reasoning

    SHA-512 base64 digest of 'Hello world!' as a test vector for integrity verification.

  25. info warn → info by review encoding-base64 test/fetch/integrity.js:148:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha512-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    likely benign LLM, confidence 0.96 Mismatched SHA-512 integrity string in rejection test.
    Reasoning

    Intentionally wrong sha512 prefixed hash in a rejection assertion; benign negative test.

  26. info warn → info by review encoding-base64 test/fetch/integrity.js:154:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.96 Base64 SHA-384 digest constant.
    Reasoning

    SHA-384 test digest constant in integrity test file.

  27. info warn → info by review encoding-base64 test/fetch/integrity.js:244:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'ä'
    likely benign LLM, confidence 0.96 Base64 SHA-256 digest in multi-hash integrity test.
    Reasoning

    SHA-256 digest test constant alongside a multi-algorithm integrity test; benign.

  28. info warn → info by review encoding-base64 test/fetch/integrity.js:265:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.96 Set of SHA-256/384/512 base64 digests in test.
    Reasoning

    Group of standard SRI digest constants for multi-algorithm integrity tests; no hidden behavior.

  29. info warn → info by review encoding-base64 test/fetch/integrity.js:266:19

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.96 SHA-384/512 base64 digests in integrity test.
    Reasoning

    Standard SRI digest test constants; benign raw base64 flagged by entropy heuristic.

  30. info warn → info by review encoding-base64 test/fetch/integrity.js:267:19

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.96 Base64 SHA-512 digest constant.
    Reasoning

    SHA-512 base64 digest test vector in undici's integrity tests.

  31. info critical → info by review proxy-global-hijack test/install.js:13:27

    `new Proxy(globalThis, ...)` interposes on a global object — every property read goes through the handler (ast pass, confidence 0.90)

      // and no other properties are added to globalThis by undici.install().
  const proxyGlobalThis = new Proxy(globalThis, {
    set (target, prop, value) {
      if (exportsToCheck.has(prop)) {
    likely benign LLM, confidence 0.85 Test-only Proxy over globalThis checking which globals get set.
    Reasoning

    Proxy wrapping globalThis in undici's install test, used to verify that install() does not add unexpected globals. It is a test-harness observation tool, though interposing on the global object is a sensitive pattern, so some residual doubt remains.

  32. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:12:18

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

    const skip = runtimeFeatures.has('crypto') === false
const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

test('should ignore well-formed but unknown algorithm tokens', { skip }, (t) => {
    likely benign LLM, confidence 0.96 Base64 SHA-256 digest in SRI security regression test.
    Reasoning

    Known SHA-256 base64 digest used in a regression test for an SRI advisory about unknown algorithm tokens; benign test data.

  33. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:25:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64-encoded SHA-256 hash constant used in an SRI test.
    Reasoning

    These are SRI hash constants (sha256/384/512 digests of 'Hello world!') in a Node.js test file for subresource integrity. Base64 digests are expected here; no decoding or execution occurs.

  34. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:26:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64-encoded SHA-384 hash constant in an SRI test.
    Reasoning

    A base64 SHA-384 digest test fixture in an SRI test file; the raw-pass blob heuristic fires on expected cryptographic output.

  35. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:27:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64-encoded SHA-512 hash constant in an SRI test.
    Reasoning

    A base64 SHA-512 digest fixture used to verify integrity checking; benign test data.

  36. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:59:25

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
    likely benign LLM, confidence 0.97 Base64 incorrect SHA-256 digest used as a negative test vector.
    Reasoning

    Intentionally wrong hash values used as negative test cases for SRI verification; these are digests, not payloads.

  37. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:60:25

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
    likely benign LLM, confidence 0.97 Base64 incorrect SHA-384 digest used as a negative test vector.
    Reasoning

    Incorrect SHA-384 digest test vector for a failing integrity check; benign test data.

  38. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:61:25

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 incorrect SHA-512 digest used as a negative test vector.
    Reasoning

    Incorrect SHA-512 digest test vector in an SRI test; no executable or obfuscated content.

  39. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:95:25

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.doesNotReject(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha1024-MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  }))
})
    likely benign LLM, confidence 0.97 Base64 digest embedded in an integrity attribute of a test fetch.
    Reasoning

    An sha1024 integrity string in a fetch test; the base64 payload is a hash digest used in a test assertion.

  40. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:101:20

    6 rows of base64-like lines, lines 101-106 (first: base64-like blob (44 bytes, compression ratio 1.25)) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.96 Block of base64 SRI hash constants in a test file.
    Reasoning

    Multiple consecutive lines of SRI digest constants in a test fixture block; the multi-row grouping is just the set of expected hashes.

  41. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SHA-256 digest test vector with provenance comment.
    Reasoning

    Hash constants with a comment stating they were generated for 'Hello world!'; standard test vectors for SRI algorithm application.

  42. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SHA-384 digest test vector.
    Reasoning

    SHA-384 digest test vector in an SRI test file; benign.

  43. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('valid sha256', { skip }, (t) => {
    likely benign LLM, confidence 0.97 Base64 SHA-512 digest test vector.
    Reasoning

    SHA-512 digest test vector in an SRI test file; benign.

  44. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:15:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, actualValue has one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.97 Base64 hash literal used as test input for padding-tolerant string comparison.
    Reasoning

    Base64 strings are test fixtures for comparing SRI hash values with and without padding; this is a legitimate test of a caseSensitiveMatch helper in a well-known library. Raw pass has high false-positive rate for base64 literals.

  45. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:22:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.97 Base64 hash literal in SRI comparison test fixture.
    Reasoning

    Same padding-variant test fixture; no executable or malicious behavior, only string literals in a unit test.

  46. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:28:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.97 Base64 hash literal in SRI comparison test fixture.
    Reasoning

    Test fixture with padding variants for SRI comparison; benign test data.

  47. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:33:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, both have one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.97 Base64 hash literal in SRI comparison test fixture.
    Reasoning

    Identical base64 fixtures in a test case checking equal strings; benign.

  48. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:34:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.97 Base64 hash literal in SRI comparison test fixture.
    Reasoning

    Identical base64 fixtures in a test case; benign.

  49. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:39:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, both have two padding chars', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.97 Base64 hash literal in SRI comparison test fixture.
    Reasoning

    Double-padding base64 fixture in a unit test; benign.

  50. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:40:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.97 Base64 hash literal in SRI comparison test fixture.
    Reasoning

    Double-padding base64 fixture in a unit test; benign.

  51. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:45:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, expectedValue has invalid third padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
    likely benign LLM, confidence 0.97 Base64 literal with invalid padding used as negative test input.
    Reasoning

    Malformed padding fixture intentionally testing rejection of invalid input; benign test of validation logic.

  52. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:46:28

    base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
  })
    likely benign LLM, confidence 0.97 Base64 literal with invalid padding used as negative test input.
    Reasoning

    Negative-test fixture with invalid padding; benign.

  53. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 SHA-256/384/512 digest constants used in SRI metadata parsing tests.
    Reasoning

    Hash literals in a test file with a comment stating they were generated for 'Hello world!'; these are known SRI digests for test parsing, benign.

  54. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 SHA-384/512 digest constants used in SRI metadata parsing tests.
    Reasoning

    Same digest test constants with a generation comment; benign test data.

  55. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('should parse valid metadata with option', { skip }, (t) => {
    likely benign LLM, confidence 0.97 A base64-encoded SHA-384 hash constant used as test data for SRI metadata parsing.
    Reasoning

    The flagged string is a base64 SHA-384 digest literal in a test file for subresource integrity metadata parsing. Hash constants in SRI tests are expected, and the surrounding code is an ordinary test case. The raw pass has a high false-positive rate on base64 blobs, and nothing here suggests obfuscation or malicious intent.

  56. info long-line types/index.d.ts:48:1

    line length 512 characters (raw pass, confidence 0.50)

    export { Dispatcher, BalancedPool, RoundRobinPool, Pool, Client, buildConnector, errors, Agent, Dispatcher1Wrapper, request, stream, pipeline, connect, upgrade, setGlobalDispatcher, getGlobalDispatcher, setGlobalOrigin, getGlobalOrigin, interceptors, cacheStores, MockClient, MockPool, MockAgent, SnapshotAgent, MockCall

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/nodejs/undici undici && cd undici
git checkout v8.12.3
disclude scan --severity info --diff v8.12.2 .