npm / uri-js / 4.4.1

uri-js 4.4.1

Source

https://github.com/garycourt/uri-js

Commit scanned

9a328873a212 (recorded by npm)

Compared with

7cb6f9ccfa44 (0 signals introduced since)

Files

45 scanned, 21 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

2.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 20:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info whitespace-anomaly dist/es5/uri.all.js:3:1

   file mixes tab and space indentation (272 tab-indented and 722 space-indented lines) (raw pass, confidence 0.40)

   (function (global, factory) {
   	typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
   	typeof define === 'function' && define.amd ? define(['exports'], factory) :
   	(factory((global.URI = global.URI || {})));

2. info long-line dist/esnext/regexps-uri.js:7:1

   line length 613 characters (raw pass, confidence 0.50)

       UNRESERVED$$ = merge(ALPHA$$, DIGIT$$, "[\\-\\.\\_\\~]", UCSCHAR$$), SCHEME$ = subexp(ALPHA$$ + merge(ALPHA$$, DIGIT$$, "[\\+\\-\\.]") + "*"), USERINFO$ = subexp(subexp(PCT_ENCODED$ + "|" + merge(UNRESERVED$$, SUB_DELIMS$$, "[\\:]")) + "*"), DEC_OCTET$ = subexp(subexp("25[0-5]") + "|" + subexp("2[0-4]" + DIGIT$$) +

3. info long-line dist/esnext/regexps-uri.js:21:1

   line length 711 characters (raw pass, confidence 0.50)

       REG_NAME$ = subexp(subexp(PCT_ENCODED$ + "|" + merge(UNRESERVED$$, SUB_DELIMS$$)) + "*"), HOST$ = subexp(IP_LITERAL$ + "|" + IPV4ADDRESS$ + "(?!" + REG_NAME$ + ")" + "|" + REG_NAME$), PORT$ = subexp(DIGIT$$ + "*"), AUTHORITY$ = subexp(subexp(USERINFO$ + "@") + "?" + HOST$ + subexp("\\:" + PORT$) + "?"), PCHAR$ = su

4. info warn → info by review long-line dist/esnext/regexps-uri.js:24:1

   line length 2036 characters (raw pass, confidence 0.65)

       PATH_EMPTY$ = "(?!" + PCHAR$ + ")", PATH$ = subexp(PATH_ABEMPTY$ + "|" + PATH_ABSOLUTE$ + "|" + PATH_NOSCHEME$ + "|" + PATH_ROOTLESS$ + "|" + PATH_EMPTY$), QUERY$ = subexp(subexp(PCHAR$ + "|" + merge("[\\/\\?]", IPRIVATE$$)) + "*"), FRAGMENT$ = subexp(subexp(PCHAR$ + "|[\\/\\?]") + "*"), HIER_PART$ = subexp(subexp(

   likely benign LLM, confidence 0.95 Minified/generated build output assembling RFC 3986 URI regular expressions from string fragments.

   Reasoning

   A long line in a bundled/distributed build of a URI regex library (uri.js-style). The snippet shows concatenation of regex fragments building RFC 3986 URI patterns, which is a standard, legitimate technique for constructing long regexes. Long-line flag in a dist file from a raw pass is a known high-false-positive signal; no dynamic execution, encoding blobs, or malicious behavior is present.

5. info whitespace-anomaly tests/qunit.js:15:1

   file mixes tab and space indentation (626 tab-indented and 149 space-indented lines) (raw pass, confidence 0.40)

   
   	// Initialize the configuration options
   	init: function() {
   		config = {

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/garycourt/uri-js uri-js && cd uri-js
git checkout 9a328873a21262651c3790505b24c9e318a0e12d
disclude scan --severity info --diff 7cb6f9ccfa441f88de122e782fd34a27e3076057 .