vite 8.3.5

Source: https://github.com/vitejs/vite
Artifact scanned: vite-8.3.5.tgz (npm tarball · 573.7 KB · SHA-256 7f22c2a78d15…)
Compared with: vite-8.3.4.tgz (4 signals introduced since)
Files: 37 scanned, 0 skipped (binary, oversized, or unrecognised)
Signals: 1 critical · 0 warn · 54 info
Scan time: 29.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 24 of 24 warn and critical signals; 23 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 18:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

critical dynamic-execution dist/node/chunks/node.js:3023:9

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
function evalValue(rawValue) {
	return new Function(`
    var console, exports, global, module, process, require
    return (\n${rawValue}\n)
```
inconclusive LLM, confidence 0.50 Helper evaluates a raw value as JavaScript through the Function constructor.
Reasoning
Function() builds code from rawValue and runs it with Node globals in scope. Build tools do this to evaluate config values, so it may be a bundled config parser. Still arbitrary code execution if the input is untrusted, and the snippet does not show where rawValue comes from.

info long-line dist/node/chunks/build.js:3446:1 new in this release

line length 565 characters (raw pass, confidence 0.50)

	exports.combinator = exports.word = exports.comment = exports.str = exports.tab = exports.newline = exports.feed = exports.cr = exports.backslash = exports.bang = exports.slash = exports.doubleQuote = exports.singleQuote = exports.space = exports.greaterThan = exports.pipe = exports.equals = exports.plus = exports.car

info long-line dist/node/chunks/build.js:3530:1 new in this release

line length 592 characters (raw pass, confidence 0.50)

	var wordDelimiters = (_b = {}, _b[t.space] = true, _b[t.tab] = true, _b[t.newline] = true, _b[t.cr] = true, _b[t.feed] = true, _b[t.ampersand] = true, _b[t.asterisk] = true, _b[t.bang] = true, _b[t.comma] = true, _b[t.colon] = true, _b[t.semicolon] = true, _b[t.openParenthesis] = true, _b[t.closeParenthesis] = true, _

info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:6870:18 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		try {
			return (await import(`${pathToFileURL(url)}?t=${Date.now()}`)).default;
		} catch (err) {
			if (!TS_EXT_RE.test(url))
```
likely benign LLM, confidence 0.80 Cache-busting re-import of a config file in Vite.
Reasoning
Timestamp-suffixed import of a file URL to bypass the module cache when reloading config. Standard Vite behaviour.

info long-line dist/node/index.js:1:1 new in this release

line length 1412 characters (raw pass, confidence 0.50)

export { w as BuildEnvironment, b as DevEnvironment, t as Visitor, T as build, U as buildErrorMessage, E as createBuilder, u as createFetchableDevEnvironment, X as createFilter, k as createIdResolver, H as createLogger, v as createRunnableDevEnvironment, N as createServer, M as createServerHotChannel, B as createServer

info ~~warn~~ → info by review unicode-mixed-script README.md:12:46

identifier `viːt` mixes scripts: Latin + Other (raw pass, confidence 0.80)
```
Vite (French word for "quick", pronounced [`/viːt/`](https://cdn.jsdelivr.net/gh/vitejs/vite@main/docs/public/vite.mp3), like "veet") is a build tool that aims to provide a faster and leaner development experience for modern web projects. It consists of two major parts:
```
dismissed LLM, confidence 0.95 IPA pronunciation text in the Vite README.
Reasoning
The flagged 'viːt' is an IPA phonetic transcription in Markdown prose, where mixed scripts are normal. Not an identifier or code.
info whitespace-anomaly dist/client/bundledDevClient.mjs:6:1

file mixes tab and space indentation (1264 tab-indented and 86 space-indented lines) (raw pass, confidence 0.40)
```
let nanoid = (size = 21) => {
	let id = "";
	let i = size | 0;
	while (i-- > 0) id += urlAlphabet[Math.random() * 64 | 0];
```
info ~~warn~~ → info by review dynamic-import dist/client/bundledDevClient.mjs:403:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		try {
			await import(
				/* @vite-ignore */
				this.options.base + url
```
likely benign LLM, confidence 0.85 Vite dev client dynamically imports a module URL during HMR.
Reasoning
The import specifier is a base URL plus a module URL inside Vite's HMR client, and the @vite-ignore comment marks it as intentional. Expected dev-server behaviour.
info unicode-surrogate dist/client/bundledDevClient.mjs:940:19

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
function isHighSurrogate(value) {
	return value >= "\ud800" && value <= "\udbff";
}
//#endregion
```
info unicode-surrogate dist/client/bundledDevClient.mjs:940:40

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)
```
function isHighSurrogate(value) {
	return value >= "\ud800" && value <= "\udbff";
}
//#endregion
```
info ~~warn~~ → info by review dynamic-import dist/client/bundledDevClient.mjs:1298:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
	const [acceptedPathWithoutQuery, query] = acceptedPath.split(`?`);
	const importPromise = import(
		/* @vite-ignore */
		moduleUrlToBrowserUrl(`${acceptedPathWithoutQuery}?${explicitImportRequired ? "import&" : ""}t=${timestamp}${query ? `&${query}` : ""}`, base)
```
likely benign LLM, confidence 0.85 Vite HMR client re-imports an accepted module with a timestamp query.
Reasoning
The specifier is built from the accepted HMR path with a timestamp query, the standard Vite HMR re-import pattern.
info whitespace-anomaly dist/client/client.mjs:5:1

file mixes tab and space indentation (976 tab-indented and 86 space-indented lines) (raw pass, confidence 0.40)
```
let nanoid = (size = 21) => {
	let id = "";
	let i = size | 0;
	while (i-- > 0) id += urlAlphabet[Math.random() * 64 | 0];
```
info unicode-surrogate dist/client/client.mjs:443:19

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
function isHighSurrogate(value) {
	return value >= "\ud800" && value <= "\udbff";
}
//#endregion
```
info unicode-surrogate dist/client/client.mjs:443:40

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)
```
function isHighSurrogate(value) {
	return value >= "\ud800" && value <= "\udbff";
}
//#endregion
```
info ~~warn~~ → info by review dynamic-import dist/client/client.mjs:1027:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
	const [acceptedPathWithoutQuery, query] = acceptedPath.split(`?`);
	const importPromise = import(
		/* @vite-ignore */
		moduleUrlToBrowserUrl(`${acceptedPathWithoutQuery}?${explicitImportRequired ? "import&" : ""}t=${timestamp}${query ? `&${query}` : ""}`, base)
```
likely benign LLM, confidence 0.85 Vite HMR client re-imports an accepted module with a timestamp query.
Reasoning
Same HMR re-import pattern as the bundledDevClient finding, in the duplicate client build.

info unicode-surrogate dist/node/chunks/build.js:292:24

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

	/** Used to compose unicode character classes. */
	var rsAstralRange = "\\ud800-\\udfff";
	var rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23";
	var rsComboSymbolsRange = "\\u20d0-\\u20f0";

info unicode-surrogate dist/node/chunks/build.js:292:32

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

	/** Used to compose unicode character classes. */
	var rsAstralRange = "\\ud800-\\udfff";
	var rsComboMarksRange = "\\u0300-\\u036f\\ufe20-\\ufe23";
	var rsComboSymbolsRange = "\\u20d0-\\u20f0";

info unicode-surrogate dist/node/chunks/build.js:313:17

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

	var rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]";
	var rsFitz = "\\ud83c[\\udffb-\\udfff]";
	var rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")";
	var rsNonAstral = "[^" + rsAstralRange + "]";

info unicode-surrogate dist/node/chunks/build.js:313:25

orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

	var rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]";
	var rsFitz = "\\ud83c[\\udffb-\\udfff]";
	var rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")";
	var rsNonAstral = "[^" + rsAstralRange + "]";

info unicode-surrogate dist/node/chunks/build.js:313:33

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

	var rsMisc = "[^" + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + "]";
	var rsFitz = "\\ud83c[\\udffb-\\udfff]";
	var rsModifier = "(?:" + rsCombo + "|" + rsFitz + ")";
	var rsNonAstral = "[^" + rsAstralRange + "]";

info unicode-surrogate dist/node/chunks/build.js:316:24

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

	var rsNonAstral = "[^" + rsAstralRange + "]";
	var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
	var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
	var rsUpper = "[" + rsUpperRange + "]";

info unicode-surrogate dist/node/chunks/build.js:316:32

orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

	var rsNonAstral = "[^" + rsAstralRange + "]";
	var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
	var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
	var rsUpper = "[" + rsUpperRange + "]";

info unicode-surrogate dist/node/chunks/build.js:316:40

orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

	var rsNonAstral = "[^" + rsAstralRange + "]";
	var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
	var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
	var rsUpper = "[" + rsUpperRange + "]";

info unicode-surrogate dist/node/chunks/build.js:317:22

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

	var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
	var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
	var rsUpper = "[" + rsUpperRange + "]";
	var rsZWJ = "\\u200d";

info unicode-surrogate dist/node/chunks/build.js:317:30

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

	var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
	var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
	var rsUpper = "[" + rsUpperRange + "]";
	var rsZWJ = "\\u200d";

info unicode-surrogate dist/node/chunks/build.js:317:39

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

	var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
	var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
	var rsUpper = "[" + rsUpperRange + "]";
	var rsZWJ = "\\u200d";

info unicode-surrogate dist/node/chunks/build.js:317:47

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

	var rsRegional = "(?:\\ud83c[\\udde6-\\uddff]){2}";
	var rsSurrPair = "[\\ud800-\\udbff][\\udc00-\\udfff]";
	var rsUpper = "[" + rsUpperRange + "]";
	var rsZWJ = "\\u200d";

info whitespace-anomaly dist/node/chunks/node.js:49:1

file mixes tab and space indentation (31301 tab-indented and 181 space-indented lines) (raw pass, confidence 0.40)
```
var __esmMin = (fn, res, err) => () => {
	if (err) throw err[0];
	try {
		return fn && (res = fn(fn = 0)), res;
```
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:271:25

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		try {
			const result = await import(specifier + formatTrackingQuery(queryName, id, specifier));
			await new Promise((resolve) => setImmediate(resolve));
			return {
```
likely benign LLM, confidence 0.80 Vite SSR loader imports a module by specifier with a tracking query.
Reasoning
The specifier is the module id plus a tracking query in Vite's SSR module runner, a legitimate loader for the project's own modules.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:303:19

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
			return {
				result: await import(specifier + formatTrackingQuery(queryName, id, specifier)),
				dependencies: [...depsList].filter((url) => url.startsWith("file:")).map((url) => fileURLToPath(url))
			};
```
likely benign LLM, confidence 0.80 Vite SSR loader imports a module and collects its file dependencies.
Reasoning
Same SSR loader pattern, returning the module result and its file dependencies. Consistent with a build tool loading user config or modules.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:6453:38

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		const argsAndCode = genFakeWorkerArgsAndCode(fn, declareRequire, options.parentFunctions ?? {});
		const localImport = (specifier) => import(specifier);
		const args = [
			...declareRequire ? [createRequire(import.meta.url)] : [],
```
likely benign LLM, confidence 0.80 Generic localImport wrapper used by a bundled worker/function runner.
Reasoning
A generic import(specifier) wrapper used to run generated worker code in a bundled runner, which is a common and expected pattern in build tooling.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:6559:18

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		try {
			return (await import(
				/* webpackIgnore: true */
				url.pathToFileURL(id).href
```
likely benign LLM, confidence 0.85 Imports a resolved file path as a file URL in a Vite loader.
Reasoning
Imports a file URL from a resolved id, with webpackIgnore to mark intent. Standard config or module loading.
info ~~warn~~ → info by review dynamic-execution dist/node/chunks/node.js:7313:15827

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
ffer ? Buffer.from(A, "base64") : Uint8Array.from(atob(A), (A) => A.charCodeAt(0));
```
likely benign LLM, confidence 0.80 Minified base64 decoding fallback inside a bundled dependency.
Reasoning
atob applied to a minified bundle variable, most likely a base64 fallback for Buffer in a dependency. The snippet alone does not show a fetch or eval chain.
info unicode-zero-width dist/node/chunks/node.js:10173:35

U+FEFF ZERO WIDTH NO-BREAK SPACE (BOM) in source (in string/comment) (raw pass, confidence 0.45)
```
		CHAR_VERTICAL_LINE: "|",
		CHAR_ZERO_WIDTH_NOBREAK_SPACE: "⟨U+FEFF⟩"
	};
}));
```

info long-line dist/node/chunks/node.js:17273:1

line length 749 characters (raw pass, confidence 0.50)

	return (code) => code.replace(`__MODE__`, modeReplacement).replace(/__BASE__/g, baseReplacement).replace(`__SERVER_HOST__`, serverHostReplacement).replace(`__HMR_PROTOCOL__`, hmrProtocolReplacement).replace(`__HMR_HOSTNAME__`, hmrHostnameReplacement).replace(`__HMR_PORT__`, hmrPortReplacement).replace(`__HMR_DIRECT_TA

info ~~warn~~ → info by review dynamic-execution dist/node/chunks/node.js:17346:36

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
	function decodeBase64WithAtob(base64) {
		return decodeURIComponent(escape(atob(base64)));
	}
	function stripComment(sm) {
```
likely benign LLM, confidence 0.90 Decodes a base64 inline source map for stack-trace support.
Reasoning
decodeBase64WithAtob decodes an inline source map for stack traces, a standard source-map-support pattern with no execution or network step.
info dynamic-execution dist/node/chunks/node.js:17391:10

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
		var json = this.toJSON();
		return btoa(unescape(encodeURIComponent(json)));
	}
	Converter.prototype.toURI = function() {
```

info long-line dist/node/chunks/node.js:26735:1

line length 574 characters (raw pass, confidence 0.50)

						if (!hasViteIgnoreRE.test(source.slice(dynamicIndex + 1, end))) this.warn(`\n` + import_picocolors.default.cyan(importerModule.file) + `\n` + import_picocolors.default.reset(generateCodeFrame(source, start, end)) + import_picocolors.default.yellow(`\nThe above dynamic import cannot be analyzed by Vite.\nSee ${imp

info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:30975:29

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		const sssPath = loadPreprocessorPath("sugarss", root);
		return cachedSss = (await import(pathToFileURL(sssPath).href)).default;
	})();
	return cachedSss;
```
likely benign LLM, confidence 0.90 Lazily loads the sugarss CSS preprocessor from a resolved path.
Reasoning
Loads the optional sugarss preprocessor from a resolved path and caches it. Standard lazy loading of a CSS preprocessor.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:30989:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		async run(sassPath, data, options) {
			const sass = await import(sassPath);
			compilerPromise ??= sass.initAsyncCompiler();
			const compiler = await compilerPromise;
```
likely benign LLM, confidence 0.90 Lazily loads the sass preprocessor and its async compiler.
Reasoning
Loads the sass package from a resolved path and initialises its async compiler. Standard preprocessor loading.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:31047:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
				try {
					await import(sassPackage.path);
				} catch (e) {
					if (/sass-embedded-[a-z0-9]+-[a-z0-9]+/i.test(e.message)) {
```
likely benign LLM, confidence 0.85 Vite's optional sass-embedded loader dynamically imports the resolved Sass package path.
Reasoning
The import is inside a try block that checks for sass-embedded package-resolution errors, which matches Vite's optional Sass preprocessor loader. The specifier comes from the package's own resolved path, not attacker input, so this is a normal plugin-loading pattern.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:31174:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		return async (lessPath, content, options) => {
			const nodeLess = (await import(lessPath)).default;
			const viteResolverPlugin = createViteLessPlugin(nodeLess, options.filename);
			return await nodeLess.render(content, {
```
likely benign LLM, confidence 0.85 Vite's Less preprocessor dynamically imports the resolved less module.
Reasoning
This is Vite's Less preprocessor wrapper, which imports the Less package resolved by the build tool and then calls its render API on CSS source. The dynamic specifier is an expected consequence of optional preprocessor loading.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:31240:26

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		return async (stylusPath, content, root, options) => {
			const stylus = (await import(stylusPath)).default;
			const ref = stylus(content, {
				paths: ["node_modules"],
```
likely benign LLM, confidence 0.85 Vite's Stylus preprocessor dynamically imports the resolved stylus module.
Reasoning
This is Vite's Stylus preprocessor wrapper, which imports the resolved stylus package and renders CSS with it. The dynamic import of a locally resolved module path is expected for this plugin.
info ~~warn~~ → info by review dynamic-execution dist/node/chunks/node.js:33728:25

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
		else if (typeof atob === "function") {
			const binaryString = atob(urlContent);
			bytes = new Uint8Array(binaryString.length);
			for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
```
likely benign LLM, confidence 0.80 A browser-or-runtime fallback decodes base64 content into a byte array.
Reasoning
The atob call is in a fallback branch that decodes a base64 string into bytes, which is typical for handling inline data URLs or source payloads in a bundler. The snippet shows no subsequent eval or execution, only byte conversion.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:34452:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
	const makeWorker = () => new WorkerWithFallback(() => async (terserPath, code, options) => {
		const terser = await import(terserPath);
		try {
			return await terser.minify(code, options);
```
likely benign LLM, confidence 0.85 A minification worker dynamically imports the resolved terser module.
Reasoning
This is Vite's terser minifier worker, which imports the resolved terser module and calls minify on build output. The dynamic specifier is the resolved package path and the code is only minified, not executed.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:38092:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
	return {
		configExport: (await import(pathToFileURL(resolvedPath).href + "?t=" + Date.now())).default,
		dependencies: []
	};
```
likely benign LLM, confidence 0.85 Vite loads a config file via dynamic import with a cache-busting timestamp query.
Reasoning
This loads a user's config file as an ES module from its resolved file URL, with a timestamp query to bust the cache. That is the standard way bundlers reload config, and the import is local rather than fetched from the network.
info ~~warn~~ → info by review dynamic-import dist/node/chunks/node.js:38260:18

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
		try {
			return (await import(pathToFileURL(tempFileName).href)).default;
		} finally {
			fs.unlink(tempFileName, () => {});
```
likely benign LLM, confidence 0.85 Vite imports a temporarily bundled config file and then deletes it.
Reasoning
The import targets a temporary file that the config loader has just written from a bundled config, then deletes it in a finally block. This is a standard technique for loading a TypeScript or bundled config as a module, and the import is local.

info long-line dist/node/chunks/node.js:38364:1

line length 1572 characters (raw pass, confidence 0.50)

export { mergeConfig as $, optimizeDeps as A, createServerModuleRunner as B, preview_exports as C, formatPostcssSourceMap as D, createBuilder as E, searchForWorkspaceRoot as F, transformWithEsbuild as G, createLogger as H, isFileLoadingAllowed as I, resolveEnvPrefix as J, perEnvironmentState as K, isFileServingAllowed

info whitespace-anomaly dist/node/chunks/postcss-import.js:5:1

file mixes tab and space indentation (418 tab-indented and 3 space-indented lines) (raw pass, confidence 0.40)

var require_format_import_prelude = /* @__PURE__ */ __commonJSMin(((exports, module) => {
	module.exports = function formatImportPrelude(layer, media, supports) {
		const parts = [];
		if (typeof layer !== "undefined") {

info long-line dist/node/cli.js:718:1

line length 612 characters (raw pass, confidence 0.50)

cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--open [path]", `[boolean | string] open browser on startup`).option("--cors", `[boolean] enable CORS`).option("--s

info long-line dist/node/index.d.ts:6:1

line length 531 characters (raw pass, confidence 0.50)

import { CustomPluginOptions, ExistingRawSourceMap, FunctionPluginHooks, ImportKind, InputOption, InputOptions, LoadResult, MinimalPluginContext, ModuleFormat, ModuleInfo, ModuleType, ModuleTypeFilter, ObjectHook, OutputBundle, OutputChunk, OutputOptions, PartialResolvedId, PluginContext, PluginContextMeta, ResolveIdRe

info ~~warn~~ → info by review long-line dist/node/index.d.ts:4064:1

line length 4476 characters (raw pass, confidence 0.65)
```
export { type Alias, type AliasOptions, type AnymatchFn, type AnymatchPattern, type AppType, type BindCLIShortcutsOptions, type BuildAppHook, type BuildEnvironmentOptions, type BuildOptions, type BuilderOptions, type CLIShortcut, type CSSModulesOptions, type CSSOptions, type ChunkMetadata, type CommonServerOptions, typ
```
likely benign LLM, confidence 0.95 A generated declaration file contains one very long export statement re-exporting types.
Reasoning
This is a long generated TypeScript re-export statement listing many public type names. Long lines in generated declaration files are normal and carry no code or obfuscation risk.
info whitespace-anomaly dist/node/module-runner.js:10:1

file mixes tab and space indentation (1007 tab-indented and 7 space-indented lines) (raw pass, confidence 0.40)
```
function unwrapId(id) {
	return id.startsWith("/@id/") ? id.slice(5).replace("__x00__", "\0") : id;
}
const windowsSlashRE = /\\/g;
```
info ~~warn~~ → info by review dynamic-execution dist/node/module-runner.js:233:187

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
	let capturedBuffer = typeof Buffer == "function" ? Buffer : void 0;
	return capturedBuffer && typeof capturedBuffer.from == "function" ? (base64) => capturedBuffer.from(base64, "base64").toString("utf-8") : (base64) => textDecoder.decode(Uint8Array.from(atob(base64), (c) => c.charCodeAt(0)));
```
likely benign LLM, confidence 0.90 The module runner falls back to atob for base64 decoding when Buffer is absent.
Reasoning
The atob branch is a fallback used only when Buffer is unavailable, decoding a base64 string to UTF-8 text for source or map handling. There is no eval or fetch of the decoded value here, so it looks like ordinary runtime portability code.
info ~~warn~~ → info by review dynamic-import dist/node/module-runner.js:824:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
	runExternalModule(filepath) {
		return import(filepath);
	}
};
```
likely benign LLM, confidence 0.85 The module runner imports an external module from a resolved file path.
Reasoning
runExternalModule is Vite's module runner hook that imports an externally resolved file path to execute modules in the runner. Dynamic import with a runtime path is the core mechanism of this runner, not a sign of hidden behavior.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o vite-8.3.5.tgz https://registry.npmjs.org/vite/-/vite-8.3.5.tgz
printf '%s  %s\n' 7f22c2a78d15bac5ad755c5f413806048db453604fa0c293f6a0613890dc7c17 vite-8.3.5.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf vite-8.3.5.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg