disclude.io

npm / undici / 8.12.1

undici 8.12.1

Source
https://github.com/nodejs/undici
Tag scanned
v8.12.1
Compared with
v8.12.0 (0 signals introduced since)
Files
828 scanned, 25 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 47 info
Scan time
24.6 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 40 of 40 warn and critical signals; 40 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-14 19:35

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info long-line README.md:3:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  2. info proc-macro-presence deps/milo/macros/README.md:10:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn new_macro(input: TokenStream) -> TokenStream {
  TokenStream::new( /* ... */)
  3. info proc-macro-presence deps/milo/macros/README.md:23:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn char(input: TokenStream) -> TokenStream {
  let character = parse_macro_input!(input as LitChar);
  4. info proc-macro-presence deps/milo/macros/src/lib.rs:11:1

    proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    
#[proc_macro]
pub fn generate(_: TokenStream) -> TokenStream { generators::generate() }
  5. info long-line docs/docs/index.md:5:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  6. info long-line lib/llhttp/constants.js:3:1

    line length 636 characters (raw pass, confidence 0.50)

    exports.SPECIAL_HEADERS = exports.MINOR = exports.MAJOR = exports.HTAB_SP_VCHAR_OBS_TEXT = exports.QUOTED_STRING = exports.CONNECTION_TOKEN_CHARS = exports.HEADER_CHARS = exports.TOKEN = exports.HEX = exports.URL_CHAR = exports.USERINFO_CHARS = exports.MARK = exports.ALPHANUM = exports.NUM = exports.HEX_MAP = exports.N
  7. info warn → info by review encoding-base64 test/busboy/test-parser.js:171:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.93 Base64-encoded PNG image embedded as a test fixture for multipart upload parsing.
    Reasoning

    Raw-pass base64 blob that decodes to PNG image data (the iVBORw0KGgo header) inside a busboy multipart parser test. Test fixtures commonly embed sample image uploads, and nothing indicates an obfuscated payload.

  8. info warn → info by review encoding-base64 test/busboy/test-parser.js:188:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.93 Another base64-encoded PNG sample used as multipart test input.
    Reasoning

    Same PNG base64 fixture pattern in a busboy test file, with a standard PNG header and no executable or decoding-to-code behavior.

  9. info warn → info by review encoding-base64 test/busboy/test-parser.js:254:1

    base64-like blob (1044 bytes over 14 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKfSURBVDjLpZPrS1NhHMf9O3bOdmwDCWRE
IYKEUHsVJBI7mg3FvCxL09290jZj2EyLMnJexkgpLbPUanNOberU5taUMnHZUULMvelCtWF0sW/n
    likely benign LLM, confidence 0.93 Base64-encoded PNG image in a busboy parser test case.
    Reasoning

    Base64 PNG content in a test fixture of a multipart parser. The entropy and length are expected for embedded image data.

  10. info warn → info by review encoding-base64 test/busboy/test-parser.js:275:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLpZPrS5NhGIf9W7YvBYOkhlko
qCklWChv2WyKik7blnNris72bi6dus0DLZ0TDxW1odtopDs4D8MDZuLU0kXq61CijSIIasOvv94V
    likely benign LLM, confidence 0.93 Base64 PNG fixture data in busboy's test-parser.js.
    Reasoning

    Base64 PNG blob inside a test template literal of a form-upload parser. Consistent with sample file content, not a dropper.

  11. info warn → info by review encoding-base64 test/busboy/test-parser.js:336:1

    base64-like blob (776 bytes over 11 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHYSURBVDjLlVLPS1RxHJynpVu7KEn0Vt+2
l6IO5qGCIsIwCPwD6hTUaSk6REoUHeoQ0qVAMrp0COpY0SUIPVRgSl7ScCUTst6zIoqg0y7lvpnP
    likely benign LLM, confidence 0.93 Base64 PNG sample in a multipart test body.
    Reasoning

    Base64 image data within a multipart body test string. The raw pass flags size and entropy only; the content is standard image encoding.

  12. info warn → info by review encoding-base64 test/busboy/test-parser.js:354:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLhZNNSFRRFIC/N++9eWMzhkl/
ZJqFMQMRFvTvImkXSdKiVRAURBRRW1eZA9EqaNOiFlZEtQxKyrJwUS0K+qEQzaTE/AtLHR3Hmffu
    likely benign LLM, confidence 0.93 Embedded base64 PNG test data for upload parsing.
    Reasoning

    Base64 PNG fixture in a busboy test file. The blob has the same structure as the other fixtures and no decoding-to-execution logic is visible.

  13. info warn → info by review encoding-base64 test/busboy/test-parser.js:376:1

    base64-like blob (3212 bytes over 43 lines, compression ratio 0.71) (raw pass, confidence 0.60)

            `
LS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5amRTRmhjQVJrOGZ5R055Ng0KQ29udGVudC1EaXNwb3Np
dGlvbjogZm9ybS1kYXRhOyBuYW1lPSJmaWxlMSI7IGZpbGVuYW1lPSJndGstYXBwbHkucG5nIg0K
Q29udGVudC1UeXBlOiBpbWFnZS9wbmcNCg0KiVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACN
    likely benign LLM, confidence 0.93 Base64-encoded multipart form body with a PNG file part, used as a parser test vector.
    Reasoning

    Base64 blob whose decoded text is a multipart boundary and Content-Disposition headers followed by PNG data. This is a hand-built multipart test body, which is a normal pattern for parser tests.

  14. info warn → info by review encoding-base64 test/busboy/test-parser.js:427:1

    base64-like blob (1336 bytes over 18 lines, compression ratio 0.77) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAANnSURB
VDiNldJ9aJVVHAfw7znPuS/PvW4405WbLWfbsBuNbramq5Tp7mLqIFPXINlwpAitaCAPjWKgBdXz
    likely benign LLM, confidence 0.93 Base64 PNG sample image in a multipart parsing test.
    Reasoning

    Base64 PNG (Inkscape-generated metadata visible in the encoded text) inside a busboy test. Legitimate test data for file upload handling.

  15. info warn → info by review encoding-base64 test/busboy/test-parser.js:452:1

    base64-like blob (1272 bytes over 17 lines, compression ratio 0.78) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAM1SURB
VDiNrZTPaxtHFMc/M7uzs7KobckyDjQxtoPbnlJyMBRKgsGFHkwvvfbuU/+BQCilBHrof+BT7zmV
    likely benign LLM, confidence 0.93 Base64-encoded PNG test fixture for busboy uploads.
    Reasoning

    Another base64 PNG fixture in the same test file, consistent with sample image uploads. No decoding or execution path is present.

  16. info warn → info by review encoding-base64 test/busboy/test-parser.js:478:1

    base64-like blob (2400 bytes over 32 lines, compression ratio 0.70) (raw pass, confidence 0.60)

            `
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS03ZDkxYjAzYTIwMTI4DQpDb250ZW50LURpc3Bv
c2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9ImZpbGUxIjsgZmlsZW5hbWU9IkM6XFB5dGhvbjI1XHd6
dGVzdFx3ZXJremV1Zy1tYWluXHRlc3RzXG11bHRpcGFydFxmaXJlZm94My0ycG5nMXR4dFxmaWxl
    likely benign LLM, confidence 0.92 Base64-encoded multipart test body with a file part and a Windows path in its filename.
    Reasoning

    Base64 blob decodes to a multipart body with a Windows-style filename path and form-data headers. Test input for a parser that handles such uploads; the path is data, not executed code.

  17. info warn → info by review encoding-base64 test/busboy/test-parser.js:518:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.95 Base64-encoded PNG image used as test fixture data for a multipart parser.
    Reasoning

    The blob is a base64-encoded PNG image (iVBORw0KGgo header) embedded as test fixture data in a busboy parser test. Legitimate test data, raw pass with high false-positive rate.

  18. info warn → info by review encoding-base64 test/busboy/test-parser.js:535:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.95 Base64-encoded PNG image fixture in a busboy parser test.
    Reasoning

    Another base64-encoded PNG (iVBORw0KGgo header) in a busboy test file, consistent with uploaded file fixture data. Benign.

  19. info warn → info by review encoding-base64 test/fetch/integrity.js:25:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 SRI sha256 hash constant for test body in fetch integrity test.
    Reasoning

    The string is a Subresource Integrity SHA-256 digest of 'Hello world!' used in a fetch integrity test. Expected cryptographic hash, not obfuscation.

  20. info warn → info by review encoding-base64 test/fetch/integrity.js:63:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Repeated SRI sha256 hash constant in fetch integrity test.
    Reasoning

    Same SRI sha256 hash constant for the fixed test body, repeated across test cases. Benign test data.

  21. info warn → info by review encoding-base64 test/fetch/integrity.js:94:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 SRI sha256 hash constant in fetch integrity test.
    Reasoning

    Same SRI sha256 hash for the test body; legitimate integrity verification test.

  22. info warn → info by review encoding-base64 test/fetch/integrity.js:110:17

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.96 SRI sha384 hash constant in fetch integrity test.
    Reasoning

    A 64-byte base64 SRI sha384 digest used to verify a fetch integrity check in tests. Expected content.

  23. info warn → info by review encoding-base64 test/fetch/integrity.js:126:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha384-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    likely benign LLM, confidence 0.95 Intentionally mismatched SRI sha384 hash to assert fetch rejects.
    Reasoning

    A sha384 SRI value deliberately incorrect to test rejection behavior in the integrity test. Legitimate test case.

  24. info warn → info by review encoding-base64 test/fetch/integrity.js:132:17

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.95 SRI sha512 hash constant in fetch integrity test.
    Reasoning

    A sha512 SRI digest for the test body, used in integrity tests. Expected content.

  25. info warn → info by review encoding-base64 test/fetch/integrity.js:148:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha512-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    likely benign LLM, confidence 0.95 Intentionally mismatched SRI sha512 hash in fetch rejection test.
    Reasoning

    Intentionally wrong sha512 SRI value used to test integrity rejection. Legitimate test.

  26. info warn → info by review encoding-base64 test/fetch/integrity.js:154:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.95 SRI sha384 hash constant in fetch integrity test.
    Reasoning

    A sha384 digest constant for the test body in the integrity test file. Benign.

  27. info warn → info by review encoding-base64 test/fetch/integrity.js:244:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'ä'
    likely benign LLM, confidence 0.93 SRI sha256 hash constant with a non-ASCII placeholder in fetch integrity test.
    Reasoning

    Standard sha256 SRI digest for the test body; the adjacent 'ä' assignment is an odd non-ASCII value in a test, but the flagged blob itself is a normal hash. Benign with slight uncertainty about the unicode line.

  28. info warn → info by review encoding-base64 test/fetch/integrity.js:265:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Test fixture containing base64-encoded SHA digests of a known string.
    Reasoning

    These are SHA-256/384/512 digest test vectors for 'Hello world!' used in Subresource Integrity tests of the undici test suite. Base64 hashes in a test file are expected and benign.

  29. info warn → info by review encoding-base64 test/fetch/integrity.js:266:19

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SHA hash constants used as integrity test fixtures.
    Reasoning

    Same SHA digest test vectors for 'Hello world!' in a fetch integrity test; standard and benign.

  30. info warn → info by review encoding-base64 test/fetch/integrity.js:267:19

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 SHA hash constants used as integrity test fixtures.
    Reasoning

    Same SHA-384/512 digest test constants; a raw-pass base64 heuristic hit on expected fixture data.

  31. info critical → info by review proxy-global-hijack test/install.js:13:27

    `new Proxy(globalThis, ...)` interposes on a global object — every property read goes through the handler (ast pass, confidence 0.90)

      // and no other properties are added to globalThis by undici.install().
  const proxyGlobalThis = new Proxy(globalThis, {
    set (target, prop, value) {
      if (exportsToCheck.has(prop)) {
    likely benign LLM, confidence 0.90 Test-only Proxy around globalThis that checks no unexpected globals are set by undici.install().
    Reasoning

    The Proxy wraps globalThis in a test verifying that undici.install() does not add unexpected globals. It is a test-harness assertion on the set trap, not a malicious interposition on production code. Test-file context makes it benign, though the pattern is inherently powerful, so confidence is not maximal.

  32. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SHA-256 test hash for SRI algorithm test.
    Reasoning

    Hash constants for 'Hello world!' with a comment stating they are generated test values; benign fixture data.

  33. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SHA-384 test hash for SRI algorithm test.
    Reasoning

    SHA-384 test vector in an SRI test file with an explanatory comment; benign.

  34. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('valid sha256', { skip }, (t) => {
    likely benign LLM, confidence 0.97 Base64 SHA-512 test hash for SRI algorithm test.
    Reasoning

    SHA-512 test vector in an SRI test file; benign fixture data.

  35. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:15:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, actualValue has one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.96 Base64 test value for a case-sensitive SRI comparison test.
    Reasoning

    Base64 string in a test asserting case-sensitive comparison of SRI values, differing only by padding. Test data, not obfuscation.

  36. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:22:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.96 Base64 test value paired with the padded variant in an SRI comparison test.
    Reasoning

    Companion padded/unpadded base64 test string for case-sensitive matching; benign test fixture.

  37. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:28:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.96 Base64 test value with mismatched padding for an SRI comparison test.
    Reasoning

    Base64 test value with double padding used for negative comparison testing; benign fixture.

  38. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:33:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, both have one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    dismissed LLM, confidence 0.95 A base64 SRI-style hash literal used as a test value for case-sensitive matching.
    Reasoning

    Raw-pass base64 heuristic fired on a literal SRI digest string used as test input in a subresource-integrity test suite. Legitimate test fixture data, not obfuscation.

  39. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:34:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    dismissed LLM, confidence 0.95 Same base64 SRI digest literal repeated as the expected value in the test.
    Reasoning

    Duplicate of the same test fixture string in a subresource-integrity test; expected base64 digest content in a unit test.

  40. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:39:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, both have two padding chars', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    dismissed LLM, confidence 0.95 A padded base64 SRI-style string used as test input.
    Reasoning

    Base64 digest literal with double padding used as test input for an SRI comparison test; benign test data.

  41. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:40:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    dismissed LLM, confidence 0.95 Repeated padded base64 test fixture for SRI comparison.
    Reasoning

    Same padded base64 test fixture repeated as expected value; benign.

  42. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:45:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, expectedValue has invalid third padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
    dismissed LLM, confidence 0.93 Base64-like test value with an intentionally invalid padding sequence for a negative test.
    Reasoning

    Test fixture deliberately containing an invalid padding character to exercise a negative case in SRI matching; legitimate edge-case test data.

  43. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:46:28

    base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
  })
    dismissed LLM, confidence 0.93 Expected-value counterpart of the invalid-padding test fixture.
    Reasoning

    Companion expected value for the invalid-padding negative test; benign fixture.

  44. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    dismissed LLM, confidence 0.95 A sha256 base64 digest constant for SRI metadata parsing tests.
    Reasoning

    Comment states these are hash values generated for 'Hello world!'; the sha256 digest literal is consistent with SRI test vectors. Benign.

  45. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    dismissed LLM, confidence 0.95 A sha384 base64 digest constant used in SRI metadata tests.
    Reasoning

    Sha384 base64 digest test vector in an SRI parsing test file with explanatory comment; benign.

  46. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('should parse valid metadata with option', { skip }, (t) => {
    dismissed LLM, confidence 0.95 A sha512 base64 digest constant used in SRI metadata tests.
    Reasoning

    Sha512 base64 digest test vector in the same SRI parsing test file; benign test data.

  47. info long-line types/index.d.ts:48:1

    line length 512 characters (raw pass, confidence 0.50)

    export { Dispatcher, BalancedPool, RoundRobinPool, Pool, Client, buildConnector, errors, Agent, Dispatcher1Wrapper, request, stream, pipeline, connect, upgrade, setGlobalDispatcher, getGlobalDispatcher, setGlobalOrigin, getGlobalOrigin, interceptors, cacheStores, MockClient, MockPool, MockAgent, SnapshotAgent, MockCall

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodejs/undici undici && cd undici
git checkout v8.12.1
disclude scan --severity info --diff v8.12.0 .