vite 8.3.5

Source: https://github.com/vitejs/vite
Tag scanned: v8.3.5
Directory: packages/vite (only this part of the repository was scanned)
Compared with: v8.3.4 (1 signals introduced since)
Files: 497 scanned, 66 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 34 info
Scan time: 17.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 25 of 25 warn and critical signals; 25 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-21 09:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/vite/src/client/client.ts:160:27 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const browserUrl = moduleUrlToBrowserUrl(moduleUrl, base)
    const importPromise = import(/* @vite-ignore */ browserUrl)
    if (isWithinCircularImport) {
      importPromise.catch(() => {
```
likely benign LLM, confidence 0.85 Dynamic import of a browser URL computed for a module during HMR.
Reasoning
The specifier is produced by moduleUrlToBrowserUrl from the module graph, and the @vite-ignore annotation shows intentional dynamic loading of Vite-managed modules for HMR.
info ~~warn~~ → info by review unicode-mixed-script packages/vite/README.md:12:46

identifier `viːt` mixes scripts: Latin + Other (raw pass, confidence 0.80)
```
Vite (French word for "quick", pronounced [`/viːt/`](https://cdn.jsdelivr.net/gh/vitejs/vite@main/docs/public/vite.mp3), like "veet") is a build tool that aims to provide a faster and leaner development experience for modern web projects. It consists of two major parts:
```
likely benign LLM, confidence 0.95 IPA phonetic symbol in the Vite README pronunciation text.
Reasoning
The mixed Latin and IPA character in the README is the phonetic transcription of 'Vite' (/viːt/), a legitimate linguistic symbol in documentation prose, not an identifier.
info ~~warn~~ → info by review dynamic-import packages/vite/src/client/bundledDevHmrClient.ts:345:13

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    try {
      await import(/* @vite-ignore */ this.options.base + url)
    } catch {
      this.requestFullReload(`failed to import hmr patch ${url}`)
```
likely benign LLM, confidence 0.85 Dynamic import of an HMR patch URL relative to the configured base.
Reasoning
This is Vite's HMR client loading update patches from its own base path; the @vite-ignore comment marks an intentional dynamic import of internally generated module URLs, a standard build-tool pattern.
info ~~warn~~ → info by review dynamic-import packages/vite/src/module-runner/esmEvaluator.ts:50:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  runExternalModule(filepath: string): Promise<any> {
    return import(filepath)
  }
}
```
likely benign LLM, confidence 0.80 Evaluator method importing an external module by filepath.
Reasoning
This is the ESM evaluator of the module runner, whose purpose is to import externalized modules by file path; the dynamic import is the core functionality rather than hidden execution.
info ~~warn~~ → info by review dynamic-execution packages/vite/src/module-runner/utils.ts:17:40

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
  return (base64: string) =>
    textDecoder.decode(Uint8Array.from(atob(base64), (c) => c.charCodeAt(0)))
})()
```
likely benign LLM, confidence 0.80 Base64 decode helper that turns a string into decoded text.
Reasoning
atob decoding a base64 string into a Uint8Array followed by TextDecoder is a routine utility for decoding inlined source maps or data; the snippet shows no eval or fetch of the decoded payload.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/__tests__/environment.spec.ts:173:25

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      const chunk = (output as RolldownOutput).output[0]
      const mod = await import(
        path.join(
          import.meta.dirname,
```
likely benign LLM, confidence 0.90 Test importing a built fixture chunk via path.join.
Reasoning
In a test file, the import path is built with path.join from import.meta.dirname to load a freshly built fixture bundle; this is ordinary test scaffolding.
info whitespace-anomaly packages/vite/src/node/__tests__/plugins/css.spec.ts:9:1

file mixes tab and space indentation (16 tab-indented and 638 space-indented lines) (raw pass, confidence 0.40)
```
import {
  convertTargets,
  createCSSResolvers,
  cssPlugin,
```
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/__tests__/resolve.spec.ts:312:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    })
    const mod1 = await import(
      join(import.meta.dirname, 'fixtures/file-url/dist/basic/index.js')
    )
```
likely benign LLM, confidence 0.90 Test importing a fixture module from a fixed relative path.
Reasoning
Test code importing a local fixture file via join(import.meta.dirname, ...); the path is static and benign.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/__tests__/resolve.spec.ts:327:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    })
    const mod2 = await import(
      join(import.meta.dirname, 'fixtures/file-url/dist/virtual/index.js')
    )
```
likely benign LLM, confidence 0.90 Test importing a virtual fixture module from a fixed relative path.
Reasoning
Same pattern as the previous finding: a test importing a local fixture module at a fixed path.
info ~~warn~~ → info by review encoding-base64 packages/vite/src/node/__tests__/utils.spec.ts:45:1

base64-like blob (1348 bytes over 22 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIID7zCCAtegAwIBAgIJS9D2rIN7tA8mMA0GCSqGSIb3DQEBCwUAMGkxFDASBgNV
BAMTC2V4YW1wbGUub3JnMQswCQYDVQQGEwJVUzERMA8GA1UECBMIVmlyZ2luaWEx
EzARBgNVBAcTCkJsYWNrc2J1cmcxDTALBgNVBAoTBFRlc3QxDTALBgNVBAsTBFRl
```
likely benign LLM, confidence 0.90 Embedded PEM certificate used as test fixture data.
Reasoning
The base64 block is a PEM certificate literal in a test file used to exercise certificate handling; the raw-pass blob heuristic fires on expected test data.

info encoding-base64 packages/vite/src/node/__tests__/utils.spec.ts:932:60

base64-like blob (264 bytes, compression ratio 0.79) (in comment) (raw pass, confidence 0.36)

https://evanw.github.io/source-map-visualization/#MzQALyogY29tbWVudCAqLwpjb25zb2xlLmxvZygiZm9vIik7CjE1NgB7InZlcnNpb24iOjMsInNvdXJjZXMiOlsiL3NyYy9mb28uanMiXSwic291cmNlc0NvbnRlbnQiOlsiY29uc29sZS5sb2coXCJmb29cIik7XG4iXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQzsifQo=

info encoding-base64 packages/vite/src/node/__tests__/utils.spec.ts:971:60

base64-like blob (388 bytes, compression ratio 0.76) (in comment) (raw pass, confidence 0.36)

https://evanw.github.io/source-map-visualization/#NjMALy8gYi5qcwpjb25zb2xlLmxvZygiLi9iLmpzIik7CgovLyBhLmpzCmNvbnNvbGUubG9nKCIuL2EuanMiKTsKMjIwAHsKICAidmVyc2lvbiI6IDMsCiAgInNvdXJjZXMiOiBbImIuanMiLCAiYS5qcyJdLAogICJzb3VyY2VzQ29udGVudCI6IFsiY29uc29sZS5sb2coJy4vYi5qcycpXG4iLCAiaW1wb3J0ICcuL2IuanMnXG5jb25zb2xlLmxvZygnLi9hLm

info encoding-base64 packages/vite/src/node/__tests__/utils.spec.ts:1032:60

base64-like blob (440 bytes, compression ratio 0.73) (in comment) (raw pass, confidence 0.36)

https://evanw.github.io/source-map-visualization/#NjYALmZvbyB7CiAgb3ZlcmZsb3c6IHNjcm9sbDsKICAtd2Via2l0LW92ZXJmbG93LXNjcm9sbGluZzogdG91Y2g7Cn0KMjU1AHsKICAiZmlsZSI6ICIvc3JjL3Nhc3Mvc3R5bGUuc2FzcyIsCiAgIm1hcHBpbmdzIjogIkFBQUE7RUFDRSxnQkFBZ0I7RUNEbEIsa0NBQUE7QURFQSIsCiAgIm5hbWVzIjogW10sCiAgInNvdXJjZXMiOiBbCiAgICAiL3NyYy9zYX

info encoding-base64 packages/vite/src/node/__tests__/utils.spec.ts:1044:60

base64-like blob (324 bytes, compression ratio 0.77) (in comment) (raw pass, confidence 0.36)

https://evanw.github.io/source-map-visualization/#MjkALmZvbyB7CiAgb3ZlcmZsb3c6IHNjcm9sbDsKfQoyMDcAewogICJmaWxlIjogIi9zcmMvc2Fzcy9zdHlsZS5zYXNzIiwKICAibWFwcGluZ3MiOiAiQUFBQTtFQUNFIiwKICAibmFtZXMiOiBbXSwKICAic291cmNlcyI6IFsKICAgICIvc3JjL3Nhc3MvdmVuZG9yL2luZGV4LnNjc3MiCiAgXSwKICAic291cmNlc0NvbnRlbnQiOiBbIi5mb28ge1xuICBvdm

info ~~warn~~ → info by review dynamic-import packages/vite/src/node/config.ts:2483:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  const module = await import(
    pathToFileURL(resolvedPath).href + '?t=' + Date.now()
  )
```
likely benign LLM, confidence 0.85 Config loader importing the bundled config file with a timestamp query.
Reasoning
Vite's config loader imports the bundled user config file via its file URL with a cache-busting query, which is the documented mechanism for loading vite.config files.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/config.ts:2784:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    try {
      return (await import(pathToFileURL(tempFileName).href)).default
    } finally {
      fs.unlink(tempFileName, () => {}) // Ignore errors
```
likely benign LLM, confidence 0.85 Imports a temporary compiled config file and removes it after.
Reasoning
Imports a temporary bundled config file in a try/finally that deletes it afterward; this is the standard transpile-then-load path for TypeScript configs.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/plugins/css.ts:2554:31

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      const sssPath = loadPreprocessorPath(PostCssDialectLang.sss, root)
      const resolved = (await import(pathToFileURL(sssPath).href)).default
      return (cachedSss = resolved)
    })()
```
likely benign LLM, confidence 0.90 Loads the optional SSS preprocessor module from a resolved path.
Reasoning
Loads the optional sass-style preprocessor from a path resolved from the project root, a normal plugin-loading pattern for an optional dependency.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/plugins/css.ts:2607:39

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    async run(sassPath, data, options) {
      const sass: typeof Sass = await import(sassPath)
      compilerPromise ??= sass.initAsyncCompiler()
      const compiler = await compilerPromise
```
likely benign LLM, confidence 0.90 Loads the sass package from a resolved path to create a compiler.
Reasoning
Loads the user's installed sass implementation by resolved path to initialize the compiler, which is the expected behavior of the CSS preprocessor plugin.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/plugins/css.ts:2714:17

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
        try {
          await import(sassPackage.path)
        } catch (e) {
          if (/sass-embedded-[a-z0-9]+-[a-z0-9]+/i.test(e.message)) {
```
likely benign LLM, confidence 0.90 Probes availability of the sass-embedded package by importing it.
Reasoning
Imports the sass-embedded package path in a try block to detect availability, a routine optional-dependency probe.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/plugins/css.ts:2965:46

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      ) => {
        const nodeLess: typeof Less = (await import(lessPath)).default
        const viteResolverPlugin = createViteLessPlugin(
          nodeLess,
```
likely benign LLM, confidence 0.90 Dynamic import of the Less compiler from a resolved path.
Reasoning
The import specifier is a path resolved from the installed Less package, a standard way to load an optional peer dependency. Nothing here shows untrusted input reaching the import.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/plugins/css.ts:3078:46

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      ) => {
        const stylus: typeof Stylus = (await import(stylusPath)).default

        const ref = stylus(content, {
```
likely benign LLM, confidence 0.90 Dynamic import of the Stylus compiler from a resolved path.
Reasoning
This mirrors the Less case: the Stylus module is loaded from a resolved path for an optional preprocessor dependency, which is a normal plugin pattern.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/plugins/terser.ts:49:57

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
        ) => {
          const terser: typeof import('terser') = await import(terserPath)
          try {
            return (await terser.minify(code, options)) as TerserMinifyOutput
```
likely benign LLM, confidence 0.90 Dynamic import of terser from a resolved path.
Reasoning
terserPath is resolved from the project's installed terser package before minification. This is a standard optional-dependency load, not attacker-controlled execution.
info ~~warn~~ → info by review dynamic-execution packages/vite/src/node/plugins/wasm.ts:43:28

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
    } else if (typeof atob === 'function') {
      const binaryString = atob(urlContent)
      bytes = new Uint8Array(binaryString.length)
      for (let i = 0; i < binaryString.length; i++) {
```
likely benign LLM, confidence 0.85 Base64 decoding of an embedded WASM module in a fallback path.
Reasoning
atob is used to decode a base64 WebAssembly payload that the build tool itself embeds, in a browser-compatible fallback path. The decoded bytes feed a WASM instantiation helper, not an eval or fetch of remote content.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/ssr/runtime/__tests__/fixtures/cyclic/entry.js:7:16

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export async function importAction(id) {
  return await import(/* @vite-ignore */ id)
}
```
likely benign LLM, confidence 0.92 Test fixture performing a dynamic import with a variable id.
Reasoning
This is a test fixture for SSR module-runtime cyclic imports. The variable id is a test input, and the pattern is the point of the test.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/ssr/runtime/__tests__/fixtures/dynamic-import.js:13:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    dynamicProcessed: await import('./simple'),
    dynamicRelative: await import(nameRelative),
    dynamicAbsolute: await import(nameAbsolute),
    dynamicAbsoluteExtension: await import(nameAbsoluteExtension),
```
likely benign LLM, confidence 0.92 Test fixture dynamic import of a relative module.
Reasoning
This is a test fixture exercising dynamic import forms in the SSR runtime. The specifiers are local test paths.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/ssr/runtime/__tests__/fixtures/dynamic-import.js:14:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    dynamicRelative: await import(nameRelative),
    dynamicAbsolute: await import(nameAbsolute),
    dynamicAbsoluteExtension: await import(nameAbsoluteExtension),
    dynamicAbsoluteFull: await import(
```
likely benign LLM, confidence 0.92 Test fixture dynamic import of an absolute module path.
Reasoning
Same test fixture; the specifiers point to local test modules to verify dynamic import resolution.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/ssr/runtime/__tests__/fixtures/dynamic-import.js:15:37

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    dynamicAbsolute: await import(nameAbsolute),
    dynamicAbsoluteExtension: await import(nameAbsoluteExtension),
    dynamicAbsoluteFull: await import(
      (process.platform === 'win32' ? '/@fs/' : '') + absolutePath
```
likely benign LLM, confidence 0.92 Test fixture dynamic import with a platform-dependent path prefix.
Reasoning
Test fixture building an /@fs/ path prefix per platform to test absolute-path dynamic imports. The path is test data.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/ssr/runtime/__tests__/fixtures/dynamic-import.js:16:32

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    dynamicAbsoluteExtension: await import(nameAbsoluteExtension),
    dynamicAbsoluteFull: await import(
      (process.platform === 'win32' ? '/@fs/' : '') + absolutePath
    ),
```
likely benign LLM, confidence 0.92 Test fixture dynamic import of an absolute module with extension.
Reasoning
Same test fixture pattern for an absolute extension-bearing import used in runtime tests.
info ~~warn~~ → info by review dynamic-import packages/vite/src/node/ssr/runtime/__tests__/fixtures/dynamic-import.js:19:27

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    ),
    dynamicFileUrl: await import(fileUrl),
    static: staticModule,
  }
```
likely benign LLM, confidence 0.92 Test fixture dynamic import of a file URL.
Reasoning
Test fixture dynamic import of a file URL, which tests the runtime's URL handling. There is no sign of malicious use.

info encoding-base64 packages/vite/src/node/ssr/runtime/__tests__/fixtures/pre-source-mapped-file.js:9:51

base64-like blob (692 bytes, compression ratio 0.70) (in comment) (raw pass, confidence 0.36)

//# sourceMappingURL=data:application/json;base64,ewogICJ2ZXJzaW9uIjogMywKICAic291cmNlcyI6IFsidHJhbnNwaWxlZC1pbmxpbmUudHMiXSwKICAic291cmNlc0NvbnRlbnQiOiBbImltcG9ydCAnbm9kZTpwYXRoJ1xuXG5leHBvcnQgdHlwZSBEdW1teSA9IHtcbiAgZm9vOiBcImZvb1wiLFxufVxuXG4vKipcbiAqIGR1bW15XG4gKiBkdW1teVxuICovXG5leHBvcnQgZGVmYXVsdCBmdW5jdGlvbiB0ZX

info dynamic-execution packages/vite/src/node/ssr/runtime/__tests__/server-source-maps.spec.ts:296:62

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
    `throw new Error('example')\n` +
    `//# ${SOURCEMAPPING_URL}=data:application/json;base64,${btoa(
      JSON.stringify(syntheticSourceMap),
    )}\n`
```
info ~~critical~~ → info by review dynamic-execution packages/vite/src/node/utils.ts:1765:14

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
export function evalValue<T = any>(rawValue: string): T {
  const fn = new Function(`
    var console, exports, global, module, process, require
    return (\n${rawValue}\n)
```
likely benign LLM, confidence 0.70 Evaluates a raw config value string via new Function to parse JavaScript-style values.
Reasoning
new Function evaluates a raw string, but it is a dev-time helper that parses values from the project's own configuration or env files, with the globals shadowed. It is an unsafe-by-design eval of local config, not a dropper or remote payload, though the severity is high for a non-literal Function body.
info unicode-surrogate packages/vite/src/shared/forwardConsole.ts:220:20

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
function isHighSurrogate(value: string): boolean {
  return value >= '\uD800' && value <= '\uDBFF'
}
```
info unicode-surrogate packages/vite/src/shared/forwardConsole.ts:220:41

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)
```
function isHighSurrogate(value: string): boolean {
  return value >= '\uD800' && value <= '\uDBFF'
}
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/vitejs/vite vite && cd vite
git checkout v8.3.5
disclude scan --severity info --diff v8.3.4 packages/vite