disclude.io

npm / undici / 8.12.3

undici 8.12.3

Source
https://github.com/nodejs/undici
Tag scanned
v8.12.3
Compared with
v8.12.2 (0 signals introduced since)
Files
834 scanned, 30 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 56 info
Scan time
33.3 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 49 of 49 warn and critical signals; 49 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-22 15:54

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info long-line README.md:3:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  2. info proc-macro-presence deps/milo/macros/README.md:10:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn new_macro(input: TokenStream) -> TokenStream {
  TokenStream::new( /* ... */)
  3. info proc-macro-presence deps/milo/macros/README.md:23:1

    [embedded rust] proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    #[proc_macro]
pub fn char(input: TokenStream) -> TokenStream {
  let character = parse_macro_input!(input as LitChar);
  4. info proc-macro-presence deps/milo/macros/src/lib.rs:11:1

    proc-macro attribute `#[proc_macro]` present (ast pass, confidence 0.95)

    
#[proc_macro]
pub fn generate(_: TokenStream) -> TokenStream { generators::generate() }
  5. info long-line docs/docs/index.md:5:1

    line length 521 characters (raw pass, confidence 0.50)

    [![Node CI](https://github.com/nodejs/undici/actions/workflows/ci.yml/badge.svg)](https://github.com/nodejs/undici/actions/workflows/nodejs.yml) [![neostandard javascript style](https://img.shields.io/badge/neo-standard-7fffff?style=flat\&labelColor=ff80ff)](https://github.com/neostandard/neostandard) [![npm version](h
  6. info long-line lib/llhttp/constants.js:3:1

    line length 636 characters (raw pass, confidence 0.50)

    exports.SPECIAL_HEADERS = exports.MINOR = exports.MAJOR = exports.HTAB_SP_VCHAR_OBS_TEXT = exports.QUOTED_STRING = exports.CONNECTION_TOKEN_CHARS = exports.HEADER_CHARS = exports.TOKEN = exports.HEX = exports.URL_CHAR = exports.USERINFO_CHARS = exports.MARK = exports.ALPHANUM = exports.NUM = exports.HEX_MAP = exports.N
  7. info warn → info by review encoding-base64 test/busboy/test-parser.js:171:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.95 Base64-encoded PNG image embedded as a test fixture in a multipart parser test.
    Reasoning

    Raw-pass base64 signal on a test fixture. The blob decodes to a PNG header and image data, and the file is a busboy multipart parser test, so embedded sample file payloads are expected.

  8. info warn → info by review encoding-base64 test/busboy/test-parser.js:188:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.95 Base64-encoded PNG image used as sample upload data in a busboy parser test.
    Reasoning

    Same pattern as the other fixtures: a base64 PNG payload in a busboy test file. Raw-pass base64 heuristics fire on test data like this, and nothing suggests execution or hiding.

  9. info warn → info by review encoding-base64 test/busboy/test-parser.js:254:1

    base64-like blob (1044 bytes over 14 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKfSURBVDjLpZPrS1NhHMf9O3bOdmwDCWRE
IYKEUHsVJBI7mg3FvCxL09290jZj2EyLMnJexkgpLbPUanNOberU5taUMnHZUULMvelCtWF0sW/n
    likely benign LLM, confidence 0.95 Base64-encoded PNG sample used as multipart test input.
    Reasoning

    Base64 PNG blob inside a multipart test case in a parser library's test suite. The content is test input, not executable or obfuscated code.

  10. info warn → info by review encoding-base64 test/busboy/test-parser.js:275:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLpZPrS5NhGIf9W7YvBYOkhlko
qCklWChv2WyKik7blnNris72bi6dus0DLZ0TDxW1odtopDs4D8MDZuLU0kXq61CijSIIasOvv94V
    likely benign LLM, confidence 0.95 Base64-encoded image sample in a busboy multipart test.
    Reasoning

    Base64 image data in a busboy test fixture. It is a sample file payload, and the raw-pass heuristic flags only its length and entropy.

  11. info warn → info by review encoding-base64 test/busboy/test-parser.js:336:1

    base64-like blob (776 bytes over 11 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHYSURBVDjLlVLPS1RxHJynpVu7KEn0Vt+2
l6IO5qGCIsIwCPwD6hTUaSk6REoUHeoQ0qVAMrp0COpY0SUIPVRgSl7ScCUTst6zIoqg0y7lvpnP
    likely benign LLM, confidence 0.95 Base64 image fixture within a multipart parsing test.
    Reasoning

    Base64 blob decoding to image data inside a parser test. No decode-and-execute pipeline or other malicious context appears in the snippet.

  12. info warn → info by review encoding-base64 test/busboy/test-parser.js:354:1

    base64-like blob (980 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJvSURBVDjLhZNNSFRRFIC/N++9eWMzhkl/
ZJqFMQMRFvTvImkXSdKiVRAURBRRW1eZA9EqaNOiFlZEtQxKyrJwUS0K+qEQzaTE/AtLHR3Hmffu
    likely benign LLM, confidence 0.95 Base64-encoded PNG used as test upload content.
    Reasoning

    Base64 PNG content in a test file for a multipart form parser. This is fixture data for upload handling.

  13. info warn → info by review encoding-base64 test/busboy/test-parser.js:376:1

    base64-like blob (3212 bytes over 43 lines, compression ratio 0.71) (raw pass, confidence 0.60)

            `
LS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5amRTRmhjQVJrOGZ5R055Ng0KQ29udGVudC1EaXNwb3Np
dGlvbjogZm9ybS1kYXRhOyBuYW1lPSJmaWxlMSI7IGZpbGVuYW1lPSJndGstYXBwbHkucG5nIg0K
Q29udGVudC1UeXBlOiBpbWFnZS9wbmcNCg0KiVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACN
    likely benign LLM, confidence 0.94 Base64-encoded multipart body with an embedded PNG as parser test input.
    Reasoning

    Base64 snippet containing a multipart boundary, Content-Disposition headers, and a PNG. This is a hand-built multipart request body for a parser test, which is a common legitimate testing technique.

  14. info warn → info by review encoding-base64 test/busboy/test-parser.js:427:1

    base64-like blob (1336 bytes over 18 lines, compression ratio 0.77) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAANnSURB
VDiNldJ9aJVVHAfw7znPuS/PvW4405WbLWfbsBuNbramq5Tp7mLqIFPXINlwpAitaCAPjWKgBdXz
    likely benign LLM, confidence 0.95 Base64-encoded PNG sample with editor metadata used in a parser test.
    Reasoning

    Base64 PNG with Inkscape metadata in a test fixture. It is sample image data from a busboy test case.

  15. info warn → info by review encoding-base64 test/busboy/test-parser.js:452:1

    base64-like blob (1272 bytes over 17 lines, compression ratio 0.78) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz
AAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAM1SURB
VDiNrZTPaxtHFMc/M7uzs7KobckyDjQxtoPbnlJyMBRKgsGFHkwvvfbuU/+BQCilBHrof+BT7zmV
    likely benign LLM, confidence 0.95 Base64-encoded PNG sample in a busboy test file.
    Reasoning

    Same kind of base64 PNG test fixture as the other entries in this file. The high-entropy raw signal is explained by image data.

  16. info warn → info by review encoding-base64 test/busboy/test-parser.js:478:1

    base64-like blob (2400 bytes over 32 lines, compression ratio 0.70) (raw pass, confidence 0.60)

            `
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS03ZDkxYjAzYTIwMTI4DQpDb250ZW50LURpc3Bv
c2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9ImZpbGUxIjsgZmlsZW5hbWU9IkM6XFB5dGhvbjI1XHd6
dGVzdFx3ZXJremV1Zy1tYWluXHRlc3RzXG11bHRpcGFydFxmaXJlZm94My0ycG5nMXR4dFxmaWxl
    likely benign LLM, confidence 0.94 Base64-encoded multipart upload fixture with a file path, used in parser tests.
    Reasoning

    Base64 decodes to a multipart body with a Windows file path and boundary markers. This is a test fixture simulating an uploaded file, and nothing in it runs code.

  17. info warn → info by review encoding-base64 test/busboy/test-parser.js:518:1

    base64-like blob (700 bytes over 10 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGdSURBVDjLpVMxa8JAFL6rAQUHXQoZpLU/
oUOnDtKtW/MDBFHHThUKTgrqICgOEtd2EVxb2qFkKTgVChbSCnZTiVBEMBRLiEmafleCDaWxDX3w
    likely benign LLM, confidence 0.95 Base64-encoded PNG test data in a busboy parser test.
    Reasoning

    Repeats the base64 PNG fixture seen at line 171. Raw-pass base64 detection on image test data in a parser test is a false positive.

  18. info warn → info by review encoding-base64 test/busboy/test-parser.js:535:1

    base64-like blob (940 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

                    `
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0
U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAJRSURBVBgZpcHda81xHMDx9+d3fudYzuYw
2RaZ5yTWolEiuZpCSjGJFEktUUr8A6ZxQZGHmDtqdrGUXHgoeZqSp1F2bLFWjtkOB8PZzvmd7+dj
    likely benign LLM, confidence 0.95 Base64-encoded PNG sample used as test input in a busboy test.
    Reasoning

    Repeats the base64 PNG fixture seen at line 188. It is sample upload content in a test file, so the raw-pass signal is a false positive.

  19. info warn → info by review encoding-base64 test/fetch/integrity.js:25:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.97 A base64 SHA-256 integrity hash constant in a fetch test.
    Reasoning

    The base64 string is a SHA-256 Subresource Integrity digest used as the expected hash for a fetch test body 'Hello world!'. Test fixtures of this kind are expected in a fetch integrity test file.

  20. info warn → info by review encoding-base64 test/fetch/integrity.js:63:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.97 Repeated base64 SHA-256 integrity hash in a fetch test.
    Reasoning

    Same SHA-256 SRI digest of 'Hello world!' reused in another test case of the integrity test suite. Benign fixture data.

  21. info warn → info by review encoding-base64 test/fetch/integrity.js:94:17

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.97 Base64 SHA-256 integrity hash fixture in a fetch test.
    Reasoning

    Same SHA-256 SRI digest fixture in another test of the integrity suite. Expected test data, not obfuscation.

  22. info warn → info by review encoding-base64 test/fetch/integrity.js:110:17

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.96 Base64 SHA-384 integrity hash fixture in a fetch test.
    Reasoning

    A 64-byte base64 string is a SHA-384 SRI digest of the test body, a standard encoding for hashes. Benign.

  23. info warn → info by review encoding-base64 test/fetch/integrity.js:126:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha384-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    dismissed LLM, confidence 0.96 SRI sha384 value used to assert fetch rejection on mismatch.
    Reasoning

    A SHA-384 SRI string passed as the integrity option to test a rejected mismatch. Legitimate test case.

  24. info warn → info by review encoding-base64 test/fetch/integrity.js:132:17

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.96 Base64 SHA-512 integrity hash fixture in a fetch test.
    Reasoning

    An 88-byte base64 SHA-512 digest of the test body in an integrity test. Standard hash encoding.

  25. info warn → info by review encoding-base64 test/fetch/integrity.js:148:24

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.rejects(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha512-ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
  }))
})
    dismissed LLM, confidence 0.96 Mismatched SRI sha512 value used to test rejection.
    Reasoning

    A SHA-512 SRI string with a deliberately wrong digest passed to assert rejection. Legitimate negative test.

  26. info warn → info by review encoding-base64 test/fetch/integrity.js:154:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.96 Base64 SHA-384 hash constant in a fetch integrity test.
    Reasoning

    A SHA-384 digest constant in the integrity test file. Benign hash fixture.

  27. info warn → info by review encoding-base64 test/fetch/integrity.js:244:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'ä'
    dismissed LLM, confidence 0.95 SHA-256 digest constant and a placeholder value in an integrity test.
    Reasoning

    The sha256 constant is a standard SRI digest of the test body; the sha384 entry is a non-ASCII placeholder in a test table, which is a harmless fixture for invalid input.

  28. info warn → info by review encoding-base64 test/fetch/integrity.js:265:19

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    dismissed LLM, confidence 0.96 Multiple base64 hash constants for integrity testing.
    Reasoning

    A group of SRI digest constants (sha256, sha384, sha512) of the test body used in an integrity test. Standard test fixtures.

  29. info warn → info by review encoding-base64 test/fetch/integrity.js:266:19

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const sha256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    dismissed LLM, confidence 0.96 Base64 SHA-512 digest constant in an integrity test.
    Reasoning

    Same group of SRI digest fixtures; sha512 base64 value is a standard digest of the test body.

  30. info warn → info by review encoding-base64 test/fetch/integrity.js:267:19

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const sha384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const sha512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    dismissed LLM, confidence 0.96 Base64 hash constants in an integrity test fixture.
    Reasoning

    SHA-384 and SHA-512 digest constants in the same integrity test fixture block. Benign.

  31. info critical → info by review proxy-global-hijack test/install.js:13:27

    `new Proxy(globalThis, ...)` interposes on a global object — every property read goes through the handler (ast pass, confidence 0.90)

      // and no other properties are added to globalThis by undici.install().
  const proxyGlobalThis = new Proxy(globalThis, {
    set (target, prop, value) {
      if (exportsToCheck.has(prop)) {
    likely benign LLM, confidence 0.85 A test-only Proxy wrapping globalThis to detect global property additions.
    Reasoning

    This is a test verifying that undici.install() does not add properties to globalThis. The Proxy on globalThis is an instrumentation tool that records writes so the test can assert on them; it is not a hijack of production code. The critical severity reflects the pattern alone, not the test's purpose.

  32. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:12:18

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

    const skip = runtimeFeatures.has('crypto') === false
const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='

test('should ignore well-formed but unknown algorithm tokens', { skip }, (t) => {
    dismissed LLM, confidence 0.97 Base64 SHA-256 hash constant in an SRI regression test.
    Reasoning

    A SHA-256 SRI digest constant in a regression test for a known advisory about unknown algorithm tokens. Benign test fixture.

  33. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:25:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SRI hash constant in a test fixture.
    Reasoning

    These are SHA-256/384/512 digest strings used as Subresource Integrity test vectors for the string 'Hello world!'. Base64 hashes in a test file are expected and benign.

  34. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:26:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SRI hash constant in a test fixture.
    Reasoning

    Same SRI digest test vectors (sha384/sha512 constants) for a known test string; raw base64 hash output is legitimate.

  35. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:27:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Base64 SRI hash constant in a test fixture.
    Reasoning

    A sha512 base64 digest used as a test expectation in an SRI security regression test; no execution or hiding involved.

  36. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:59:25

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
    likely benign LLM, confidence 0.97 Intentionally incorrect base64 hash constant for negative SRI test.
    Reasoning

    Deliberately wrong hash values used to test that mismatched integrity fails, consistent with a GHSA regression test. Benign.

  37. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:60:25

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256Wrong = 'MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='
    likely benign LLM, confidence 0.97 Intentionally incorrect base64 hash constant for negative SRI test.
    Reasoning

    Wrong-hash test vector for SRI verification; base64 digest literal in a test file is expected.

  38. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:61:25

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384Wrong = 'zxSYGGGjWi7iIZ9SmiTenQIQ+/nzPTd5bbesJhBTZvoYomj28rsVLXbUyJU/Yqob'
  const hash512Wrong = 'eC9loL1pd8AD1Btp9aHu+ymH5Rfnh64hiTYgyfeXy270KfjPQupBkhb2OeP35vZA8ofSBNJ01LzweDIhznuqaw=='

  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
    likely benign LLM, confidence 0.97 Intentionally incorrect base64 hash constant for negative SRI test.
    Reasoning

    Wrong sha512 test vector for an integrity mismatch check; a benign fixture value.

  39. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:95:25

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      await t.assert.doesNotReject(fetch(`http://localhost:${server.address().port}`, {
    integrity: 'sha1024-MWD71RGgcch4KOzmR6VMaqWh4VY7eonYmHWvemOtMno='
  }))
})
    likely benign LLM, confidence 0.96 Base64 integrity string passed to fetch in a test.
    Reasoning

    An integrity attribute value with a sha1024-style prefix and base64 digest used in a fetch test. The string is a test input for SRI handling, not a payload.

  40. info warn → info by review encoding-base64 test/subresource-integrity/GHSA-f72v-6w45-q472.js:101:20

    6 rows of base64-like lines, lines 101-106 (first: base64-like blob (44 bytes, compression ratio 1.25)) (raw pass, confidence 0.60)

      const body = 'Hello world!'
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.96 Block of base64 SRI hash constants in a test fixture.
    Reasoning

    Multi-line block of SRI hash constants in a test file; the aggregated base64 rows are just digest literals.

  41. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SRI hash constants with a comment explaining their origin.
    Reasoning

    Comment states these hashes were generated for 'Hello world!'; they are expected SRI digests in a test file.

  42. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.97 Base64 SRI hash constant in a test fixture.
    Reasoning

    Same expected digest constants for hashing tests; benign fixture data.

  43. info warn → info by review encoding-base64 test/subresource-integrity/apply-algorithm-to-bytes.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('valid sha256', { skip }, (t) => {
    likely benign LLM, confidence 0.97 Base64 SRI hash constant in a test fixture.
    Reasoning

    sha512 digest literal used as a test expectation; no obfuscation or malicious behavior.

  44. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:15:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, actualValue has one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.95 Base64 SRI hash test fixture string.
    Reasoning

    Base64 literals are test fixtures for SRI hash comparison in a test file for caseSensitiveMatch; raw pass has high false-positive rate and the context is clearly legitimate test data.

  45. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:22:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.95 Base64 SRI hash test fixture with padding variant.
    Reasoning

    Same SRI test fixture with padding variations, used to check string matching behavior in a unit test.

  46. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:28:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs'
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.95 Base64 test fixture with double padding.
    Reasoning

    Test fixture of base64 strings with padding edge cases for subresource integrity matching.

  47. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:33:26

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      test('identical strings, both have one padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.95 Base64 test fixture for identical-string match case.
    Reasoning

    Identical base64 test values for a string comparison unit test; no execution or concealment.

  48. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:34:28

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.95 Base64 test fixture for identical-string match case.
    Reasoning

    Duplicate base64 fixture in the same SRI test suite, clearly legitimate.

  49. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:39:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, both have two padding chars', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
    likely benign LLM, confidence 0.95 Base64 test fixture with two padding chars.
    Reasoning

    Double-padded base64 test fixture for SRI comparison; legitimate test data.

  50. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:40:28

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue))
  })
    likely benign LLM, confidence 0.95 Base64 test fixture with two padding chars.
    Reasoning

    Same double-padded fixture repeated in the test; benign.

  51. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:45:26

    base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

      test('identical strings, expectedValue has invalid third padding char', (t) => {
    const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
    likely benign LLM, confidence 0.95 Base64 fixture with invalid padding for negative test.
    Reasoning

    Test deliberately uses an invalid padding variant to check that matching returns false; benign edge-case testing.

  52. info warn → info by review encoding-base64 test/subresource-integrity/case-sensitive-match.js:46:28

    base64-like blob (46 bytes, compression ratio 1.24) (raw pass, confidence 0.60)

        const actualValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs=='
    const expectedValue = 'ypeBEsobvcr6wjGzmiPcTaeG7/gUfE5yuYB3ha/uSLs==='
    t.assert.ok(caseSensitiveMatch(actualValue, expectedValue) === false)
  })
    likely benign LLM, confidence 0.95 Base64 invalid-padding negative test fixture.
    Reasoning

    Negative-test fixture for invalid padding in an SRI unit test; no malicious behavior.

  53. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:12:20

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

      /* Hash values generated with for "Hello world!" */
  const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.95 Precomputed SHA-256/384/512 hash constants for SRI parsing tests.
    Reasoning

    The comment explicitly says these are hash values generated for 'Hello world!', consistent with SRI metadata parsing tests.

  54. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:13:20

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

      const hash256 = 'wFNeS+K3n/2TKRMFQ2v4iTFOSj+uwF7P/Lt98xrZ5Ro='
  const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='
    likely benign LLM, confidence 0.95 SHA-384 and SHA-512 digest constants for SRI parsing tests.
    Reasoning

    Hash constants with a descriptive comment in an SRI metadata parser test; legitimate digest fixtures.

  55. info warn → info by review encoding-base64 test/subresource-integrity/parse-metadata.js:14:20

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

      const hash384 = 'hiVfosNuSzCWnq4X3DTHcsvr38WLWEA5AL6HYU6xo0uHgCY/JV615lypu7hkHMz+'
  const hash512 = '9s3ioPgZMUzd5V/CJ9jX2uPSjMVWIioKitZtkcytSq1glPUXohgjYMmqz2o9wyMWLLb9jN/+2w/gOPVehf+1tg=='

  test('should parse valid metadata with option', { skip }, (t) => {
    likely benign LLM, confidence 0.97 Base64 SHA-384/SHA-512 hash constants used as test fixtures for SRI metadata parsing.
    Reasoning

    The flagged blob is a base64-encoded SHA-384 digest literal in a test fixture for subresource integrity metadata parsing. The file is a test for the ssri-style parser, and these hash strings are expected test inputs. The raw pass has a high false-positive rate on base64 blobs, and nothing here is executed or decoded to hide behavior.

  56. info long-line types/index.d.ts:48:1

    line length 512 characters (raw pass, confidence 0.50)

    export { Dispatcher, BalancedPool, RoundRobinPool, Pool, Client, buildConnector, errors, Agent, Dispatcher1Wrapper, request, stream, pipeline, connect, upgrade, setGlobalDispatcher, getGlobalDispatcher, setGlobalOrigin, getGlobalOrigin, interceptors, cacheStores, MockClient, MockPool, MockAgent, SnapshotAgent, MockCall

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/nodejs/undici undici && cd undici
git checkout v8.12.3
disclude scan --severity info --diff v8.12.2 .