disclude.io

npm / undici / 8.12.3

undici 8.12.3

Source
https://github.com/nodejs/undici
Tag scanned
v8.12.3
Compared with
v8.12.2 (0 signals introduced since)
Files
834 scanned, 30 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 56 info
Scan time
29.9 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 49 of 49 warn and critical signals; 49 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-20 13:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info long-line README.md:3:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  2. info proc-macro-presence deps/milo/macros/README.md:10:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn new_macro(input: TokenStream) -> TokenStream {
  TokenStream::new( /* ... */)
  3. info proc-macro-presence deps/milo/macros/README.md:23:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn char(input: TokenStream) -> TokenStream {
  let character = parse_macro_input!(input as LitChar);
  4. info proc-macro-presence deps/milo/macros/src/lib.rs:11:1

    proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    
#[proc_macro]
pub fn generate(_: TokenStream) -> TokenStream { generators::generate() }
  5. info long-line docs/docs/index.md:5:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  6. info long-line lib/llhttp/constants.js:3:1

    line length 636 characters (raw pass, confidence 0.50)

    exports.SPECIAL_HEADERS = exports.MINOR = exports.MAJOR = exports.HTAB_SP_VCHAR_OBS_TEXT = exports.QUOTED_STRING = exports.CONNECTION_TOKEN_CHARS = exports.HEADER_CHARS = exports.TOKEN = exports.HEX = exports.URL_CHAR = exports.USERINFO_CHARS = exports.MARK = exports.ALPHANUM = exports.NUM = exports.HEX_MAP = exports.N
  7. info warn → info by review encoding-base64 test/busboy/test-parser.js:171:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.95 Base64-encoded PNG image embedded as test fixture data in the busboy multipart parser tests.
    Reasoning

    The blob decodes to a PNG header (iVBORw0KGgo...) inside a template literal in a multipart parser test fixture. Embedded image test data is expected in this context, and the raw pass has a high false-positive rate for base64.

  8. info warn → info by review encoding-base64 test/busboy/test-parser.js:188:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.95 Base64 PNG test fixture in the busboy multipart parser test suite.
    Reasoning

    Same embedded PNG base64 fixture (iVBORw0KGgo header) in a busboy parser test. It is test input data, not executable or obfuscated code.

  9. info warn → info by review encoding-base64 test/busboy/test-parser.js:254:1

    base64-like blob (1044 bytes over 14 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKfSURBVDjLpZPrS1NhHMf9O3bOdmwDCWRE
IYKEUHsVJBI7mg3FvCxL09290jZj2EyLMnJexkgpLbPUanNOberU5taUMnHZUULMvelCtWF0sW/n
    likely benign LLM, confidence 0.95 Base64-encoded PNG image used as multipart upload fixture in busboy tests.
    Reasoning

    Base64 PNG blob inside a template literal in a multipart test file, consistent with uploaded-file test payloads.

  10. info warn → info by review encoding-base64 test/busboy/test-parser.js:275:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLpZPrS5NhGIf9W7YvBYOkhlko
qCklWChv2WyKik7blnNris72bi6dus0DLZ0TDxW1odtopDs4D8MDZuLU0kXq61CijSIIasOvv94V
    likely benign LLM, confidence 0.95 Base64 PNG fixture for multipart parsing tests.
    Reasoning

    Standard PNG base64 test data in a parser test; nothing decodes or executes it.

  11. info warn → info by review encoding-base64 test/busboy/test-parser.js:336:1

    base64-like blob (776 bytes over 11 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHYSURBVDjLlVLPS1RxHJynpVu7KEn0Vt+2
l6IO5qGCIsIwCPwD6hTUaSk6REoUHeoQ0qVAMrp0COpY0SUIPVRgSl7ScCUTst6zIoqg0y7lvpnP
    likely benign LLM, confidence 0.95 Base64 PNG part of a multipart form test body in busboy's tests.
    Reasoning

    Base64 PNG content inside a multipart body string in a test file. This is fixture data for exercising the parser.

  12. info warn → info by review encoding-base64 test/busboy/test-parser.js:354:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLhZNNSFRRFIC/N++9eWMzhkl/
ZJqFMQMRFvTvImkXSdKiVRAURBRRW1eZA9EqaNOiFlZEtQxKyrJwUS0K+qEQzaTE/AtLHR3Hmffu
    likely benign LLM, confidence 0.95 Base64 PNG image fixture for busboy parser tests.
    Reasoning

    PNG base64 blob in a parser test fixture. No decoding into executable code is present in the snippet.

  13. info warn → info by review encoding-base64 test/busboy/test-parser.js:376:1

    base64-like blob (3212 bytes over 43 lines, compression ratio 0.71) (raw pass, confidence 0.60)

            `
LS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5amRTRmhjQVJrOGZ5R055Ng0KQ29udGVudC1EaXNwb3Np
dGlvbjogZm9ybS1kYXRhOyBuYW1lPSJmaWxlMSI7IGZpbGVuYW1lPSJndGstYXBwbHkucG5nIg0K
Q29udGVudC1UeXBlOiBpbWFnZS9wbmcNCg0KiVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACN
    likely benign LLM, confidence 0.95 Multipart form-data test fixture containing a base64 PNG file part.
    Reasoning

    Multipart body with a Content-Disposition header for gtk-apply.png followed by base64 PNG data. This is a realistic upload fixture for a form-parsing library's tests.

  14. info warn → info by review encoding-base64 test/busboy/test-parser.js:427:1

    base64-like blob (1336 bytes over 18 lines, compression ratio 0.77) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAANnSURB
VDiNldJ9aJVVHAfw7znPuS/PvW4405WbLWfbsBuNbramq5Tp7mLqIFPXINlwpAitaCAPjWKgBdXz
    likely benign LLM, confidence 0.95 Base64-encoded PNG test payload in busboy's parser test suite.
    Reasoning

    Base64 PNG (Inkscape-generated metadata visible in the encoded text) inside a test fixture for multipart parsing.

  15. info warn → info by review encoding-base64 test/busboy/test-parser.js:452:1

    base64-like blob (1272 bytes over 17 lines, compression ratio 0.78) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAM1SURB
VDiNrZTPaxtHFMc/M7uzs7KobckyDjQxtoPbnlJyMBRKgsGFHkwvvfbuU/+BQCilBHrof+BT7zmV
    likely benign LLM, confidence 0.95 Base64 PNG fixture for multipart upload tests.
    Reasoning

    Another PNG base64 fixture in the same parser test file, with the same benign structure.

  16. info warn → info by review encoding-base64 test/busboy/test-parser.js:478:1

    base64-like blob (2400 bytes over 32 lines, compression ratio 0.70) (raw pass, confidence 0.60)

            `
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS03ZDkxYjAzYTIwMTI4DQpDb250ZW50LURpc3Bv
c2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9ImZpbGUxIjsgZmlsZW5hbWU9IkM6XFB5dGhvbjI1XHd6
dGVzdFx3ZXJremV1Zy1tYWluXHRlc3RzXG11bHRpcGFydFxmaXJlZm94My0ycG5nMXR4dFxmaWxl
    likely benign LLM, confidence 0.93 Base64-encoded multipart body with Windows-style filename, used as a busboy parser test fixture.
    Reasoning

    Base64 text decodes to multipart boundary and Content-Disposition headers with a Windows file path. This is realistic test data for a multipart parser, including a path-separator edge case, and it is not an attack.

  17. info warn → info by review encoding-base64 test/busboy/test-parser.js:518:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.95 Base64 PNG test fixture for multipart parsing.
    Reasoning

    Repeated PNG base64 fixture in the busboy test file, identical to earlier findings in the same file.

  18. info warn → info by review encoding-base64 test/busboy/test-parser.js:535:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.95 Base64 PNG image fixture in busboy's test suite.
    Reasoning

    Base64 PNG blob in a parser test template literal, the same benign fixture pattern as the rest of the file.

  19. info warn → info by review encoding-base64 test/fetch/integrity.js:25:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 A base64 SHA-256 integrity hash constant in an undici fetch test.
    Reasoning

    Base64 string is a SHA-256 digest of 'Hello world!' used as a Subresource Integrity hash in an undici test file; legitimate test data.

  20. info warn → info by review encoding-base64 test/fetch/integrity.js:63:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Repeated base64 SRI hash constant in a fetch integrity test.
    Reasoning

    Same SHA-256 integrity hash constant reused in a test; no encoded payload or execution.

  21. info warn → info by review encoding-base64 test/fetch/integrity.js:94:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 SHA-256 integrity hash constant in a fetch test.
    Reasoning

    Same SHA-256 SRI hash for a known body in a test fixture.

  22. info warn → info by review encoding-base64 test/fetch/integrity.js:110:17

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 SHA-384 integrity hash constant in a fetch test.
    Reasoning

    SHA-384 SRI digest string for 'Hello world!' used in a test assertion.

  23. info warn → info by review encoding-base64 test/fetch/integrity.js:126:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha384-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    likely benign LLM, confidence 0.96 Base64 SRI hash used to test a mismatched integrity rejection.
    Reasoning

    Integrity string is a SRI-format hash of a known value passed to fetch in a rejection test.

  24. info warn → info by review encoding-base64 test/fetch/integrity.js:132:17

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 SHA-512 integrity hash constant in a fetch test.
    Reasoning

    SHA-512 digest of 'Hello world!' as test fixture data.

  25. info warn → info by review encoding-base64 test/fetch/integrity.js:148:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha512-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    likely benign LLM, confidence 0.96 Base64 SRI hash in a rejected-fetch test case.
    Reasoning

    Known-digest SRI string used in a negative test for sha512 integrity mismatch.

  26. info warn → info by review encoding-base64 test/fetch/integrity.js:154:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 SHA-384 hash constant in an integrity test.
    Reasoning

    SHA-384 digest constant used in test data; no payload behavior.

  27. info warn → info by review encoding-base64 test/fetch/integrity.js:244:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'ä'
    likely benign LLM, confidence 0.95 Base64 SHA-256 hash constant in a fetch integrity test.
    Reasoning

    SHA-256 digest constant alongside a stray non-ASCII string 'ä' in a test; the blob itself is a standard hash. The unicode character is a minor oddity in a test fixture.

  28. info warn → info by review encoding-base64 test/fetch/integrity.js:265:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Multiple base64 SRI hash constants in a test.
    Reasoning

    Group of standard SRI digests for test vectors.

  29. info warn → info by review encoding-base64 test/fetch/integrity.js:266:19

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SHA-384 and SHA-512 hash constants in a test.
    Reasoning

    Standard SRI digest constants for test data.

  30. info warn → info by review encoding-base64 test/fetch/integrity.js:267:19

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 SHA-512 hash constant in a fetch test.
    Reasoning

    SHA-512 digest constant used as test vector.

  31. info critical → info by review proxy-global-hijack test/install.js:13:27

    `new Proxy(globalThis, ...)` interposes on a global object — every property read goes through the handler (ast pass, confidence 0.90)

      // and no other properties are added to globalThis by undici.install().
  const proxyGlobalThis = new Proxy(globalThis, {
    set (target, prop, value) {
      if (exportsToCheck.has(prop)) {
    likely benign LLM, confidence 0.90 Proxy wrapping globalThis in a test checking global-property leakage.
    Reasoning

    A Proxy on globalThis in undici's install test is used to verify that no extra globals are added. It is a test-harness technique that observes set traps, not a malicious hijack; the severity is high but context is benign.

  32. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:12:18

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

    const skip = runtimeFeatures.has('crypto') === false
const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

test('should ignore well-formed but unknown algorithm tokens', { skip }, (t) => {
    likely benign LLM, confidence 0.96 Base64 SHA-256 hash constant in a subresource integrity regression test.
    Reasoning

    Standard SHA-256 SRI hash constant in a regression test for a GHSA advisory about unknown algorithm tokens.

  33. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:25:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64-encoded SHA-256 digest constant used as a test fixture.
    Reasoning

    These are SRI hash constants in a test file for a fetch integrity feature; base64 digests are expected here and are not obfuscation.

  34. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:26:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64-encoded SHA-384 digest constant used as a test fixture.
    Reasoning

    Standard base64 SHA-384/512 digest test constants in a subresource-integrity test; legitimate.

  35. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:27:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64-encoded SHA-512 digest constant used as a test fixture.
    Reasoning

    Base64 digest string in an SRI test file, consistent with expected hash values for 'Hello world!'.

  36. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:59:25

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
    likely benign LLM, confidence 0.97 Incorrect base64 digest constant used to test integrity failure.
    Reasoning

    Deliberately wrong hash values in a negative SRI test; these are plain digest literals, not encoded payloads.

  37. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:60:25

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
    likely benign LLM, confidence 0.97 Incorrect base64 SHA-384 digest used to test rejection.
    Reasoning

    Wrong-value SHA-384 digest in a negative integrity test; benign test data.

  38. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:61:25

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Incorrect base64 SHA-512 digest used to test rejection.
    Reasoning

    Wrong-value SHA-512 digest in a negative integrity test; benign test data.

  39. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:95:25

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.doesNotReject(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha1024-MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  }))
})
    likely benign LLM, confidence 0.96 Base64 digest in an sha1024 integrity option within a test.
    Reasoning

    Integrity attribute value with a base64 digest inside a fetch test; standard SRI usage.

  40. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:101:20

    6 rows of base64-like lines, lines 101-106 (first: base64-like blob (44 bytes, compression ratio 1.25)) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Block of base64 hash fixture constants flagged as a row cluster.
    Reasoning

    Multi-line group of SRI digest constants in a test file; the row grouping is just a set of hash fixtures.

  41. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SHA-256 digest fixture for the Hello world test string.
    Reasoning

    Comment states these are hash values generated for 'Hello world!'; base64 digest fixtures for an SRI test.

  42. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SHA-384 digest fixture for the Hello world test string.
    Reasoning

    Same generated digest fixtures as the adjacent lines; legitimate test data.

  43. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('valid sha256', { skip }, (t) => {
    likely benign LLM, confidence 0.97 Base64 SHA-512 digest fixture for the Hello world test string.
    Reasoning

    Base64 SHA-512 digest fixture in an SRI test with a documented generation source; benign.

  44. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:15:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, actualValue has one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.97 Base64 SRI digest literal used as test input for padding-comparison behavior.
    Reasoning

    The raw pass flagged a base64-like string that is a test fixture for SRI hash comparison; the file is a test of caseSensitiveMatch with padding variants. Legitimate test data, not obfuscation.

  45. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:22:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.97 Base64 digest test fixture with padding variant.
    Reasoning

    Same base64 test fixture repeated in a padding-mismatch test case; expected in a subresource-integrity test suite.

  46. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:28:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.97 Base64 digest test fixture with double padding.
    Reasoning

    Padding-variant base64 test fixture in an SRI comparison test; no execution or hidden payload.

  47. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:33:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, both have one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.97 Base64 digest literal in identical-match test.
    Reasoning

    Identical-string test fixture for base64 digest comparison; legitimate test code.

  48. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:34:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.97 Base64 digest literal in identical-match test.
    Reasoning

    Duplicate base64 test fixture in an SRI comparison test; benign.

  49. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:39:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, both have two padding chars', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.97 Base64 digest test fixture with two padding characters.
    Reasoning

    Base64 digest fixture with two padding chars used in a test asserting equality; benign test data.

  50. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:40:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.97 Base64 digest test fixture with two padding characters.
    Reasoning

    Repeated base64 test fixture in SRI matching test; no malicious indicators.

  51. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:45:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, expectedValue has invalid third padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
    likely benign LLM, confidence 0.97 Base64 digest fixture with invalid third padding char for negative testing.
    Reasoning

    Test fixture deliberately containing an invalid padding character to check rejection; a legitimate negative test.

  52. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:46:28

    base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
  })
    likely benign LLM, confidence 0.97 Base64 digest fixture with invalid padding for negative testing.
    Reasoning

    Same negative-test fixture with invalid padding; benign test code.

  53. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.96 Precomputed SHA-256/384/512 digest literals for SRI parsing tests.
    Reasoning

    Hash constants with a comment stating they were generated for 'Hello world!' in an SRI metadata parsing test; these are expected digest values, not obfuscated payloads.

  54. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.96 Precomputed SHA digest literals used as SRI test vectors.
    Reasoning

    Multi-line hash constants in an SRI parsing test file with explanatory comment; standard test fixtures.

  55. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('should parse valid metadata with option', { skip }, (t) => {
    likely benign LLM, confidence 0.95 A base64 SHA-384 hash literal used as test data for SRI metadata parsing.
    Reasoning

    The flagged string is a base64-encoded SHA-384 digest used as a test fixture for subresource integrity metadata parsing. This is a legitimate test vector in a well-known npm package (ssri-like SRI parsing). The raw pass has a high false-positive rate for base64 blobs, and the context is clearly a hash literal in a test file with no decoding or execution.

  56. info long-line types/index.d.ts:48:1

    line length 512 characters (raw pass, confidence 0.50)

    export { Dispatcher, BalancedPool, RoundRobinPool, Pool, Client, buildConnector, errors, Agent, Dispatcher1Wrapper, request, stream, pipeline, connect, upgrade, setGlobalDispatcher, getGlobalDispatcher, setGlobalOrigin, getGlobalOrigin, interceptors, cacheStores, MockClient, MockPool, MockAgent, SnapshotAgent, MockCall

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nodejs/undici undici && cd undici
git checkout v8.12.3
disclude scan --severity info --diff v8.12.2 .