vitest 5.1.0-beta.1

Source: https://github.com/vitest-dev/vitest
Tag scanned: v5.1.0-beta.1
Directory: packages/vitest (only this part of the repository was scanned)
Compared with: v5.0.5 (0 signals introduced since)
Files: 287 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 67 info
Scan time: 8.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-21 00:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/vitest/src/integrations/env/loader.ts:71:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    'vitest.runtime.environment.import',
    () => import(packageId) as Promise<{ default: Environment }>,
  )
  return resolveEnvironmentFromModule(name, packageId, pkg)
```
likely benign LLM, confidence 0.85 Loads a configured test environment package via a non-literal dynamic import.
Reasoning
The import specifier is a package identifier resolved from the project's configured environment package, inside a test-runner loader. Dynamic loading of a user-chosen module is the expected behavior here, and the snippet shows no decoding, obfuscation, or hidden payload.

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:56

orphaned high surrogate \uD83F (no matching low surrogate) (token pass, confidence 0.65)

    regex = new RegExp(
      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:64

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

    regex = new RegExp(
      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:71

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    regex = new RegExp(
      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:83

orphaned high surrogate \uD87F (no matching low surrogate) (token pass, confidence 0.65)

    regex = new RegExp(
      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:13

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:23

orphaned high surrogate \uD8BF (no matching low surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:31

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:38

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:47

orphaned high surrogate \uD8FF (no matching low surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:55

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:62

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:74

orphaned high surrogate \uD93F (no matching low surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:82

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:17

orphaned high surrogate \uD97F (no matching low surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:25

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:32

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:41

orphaned high surrogate \uD9BF (no matching low surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:49

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:56

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:65

orphaned high surrogate \uD9FF (no matching low surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:73

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:80

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:12

orphaned high surrogate \uDA3F (no matching low surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:20

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:27

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:36

orphaned high surrogate \uDA7F (no matching low surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:44

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:51

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:60

orphaned high surrogate \uDABF (no matching low surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:68

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:75

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:17

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:24

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:34

orphaned high surrogate \uDB3F (no matching low surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:42

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:49

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:58

orphaned high surrogate \uDB7F (no matching low surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:66

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:73

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:85

orphaned high surrogate \uDBBF (no matching low surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:12

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:19

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:29

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:37

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:44

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:27

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:35

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:44

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:52

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:62

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:70

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:82

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:90

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:16

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',
    )

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:24

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',
    )

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:36

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',
    )

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:44

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',
    )

info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/moduleEvaluator.ts:155:73

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
        },
        () => (this.vm ? this.vm.externalModulesExecutor.import(file) : import(file)),
      )
      .finally(() => {
```
likely benign LLM, confidence 0.85 Evaluates a module file by path with a non-literal dynamic import, falling back from a VM executor.
Reasoning
The import of a file path is a fallback when no VM external executor is set, inside a module evaluator that must load user test files at runtime. This is standard module-runner behavior, with no encoding or suspicious source involved.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:234:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    url.searchParams.set('mock', 'actual')
    return import(url.toString())
  }
```
likely benign LLM, confidence 0.88 Re-imports a module with a mock=actual query parameter to bypass a mock.
Reasoning
The URL is built from a resolved module path with a query parameter marking it as the actual module, which is the standard mocking mechanism for re-importing originals. No untrusted decoding or execution chain is visible.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:241:14

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    if (resolvedId.includes('mock=')) {
      return import(resolvedId)
    }
```
likely benign LLM, confidence 0.88 Imports a resolved module id that carries a mock marker.
Reasoning
The specifier is a resolved id containing a mock= marker, used to import the mocked variant of a module. This is ordinary test-mocking machinery and does not show malicious intent.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:250:14

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    if (redirect) {
      return import(pathToFileURL(redirect).toString())
    }
```
likely benign LLM, confidence 0.88 Imports a redirected module path converted to a file URL.
Reasoning
The import target comes from a redirect path converted with pathToFileURL, a standard, safe way to build file URLs. It is part of mock redirection logic, not a payload loader.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:255:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    url.searchParams.set('mock', 'automock')
    return import(url.toString())
  }
}
```
likely benign LLM, confidence 0.88 Imports a module URL tagged with mock=automock.
Reasoning
This sets mock=automock on a URL and imports it, which is the expected way to request an automocked module in a test runner. The snippet shows nothing obfuscated.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/vm/commonjs-executor.ts:182:16

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
        const require = Module.createRequire(parent?.filename ?? request)
        return require(request)
      }
```
likely benign LLM, confidence 0.85 Resolves and requires a CommonJS dependency through a parent-relative createRequire.
Reasoning
A require is created relative to the parent file and called with the request string. This is how a CJS executor resolves dependencies in a VM context. The require is built from Module.createRequire, a normal Node API, and the snippet shows no decoding or hidden behavior.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/utils/coverage.ts:72:15

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      ? await loader.import(builtInModule)
      : await import(/* @vite-ignore */ builtInModule)

    if (!coverageModule) {
```
likely benign LLM, confidence 0.88 Dynamically imports a built-in coverage provider module by name.
Reasoning
The coverage utility imports a built-in coverage provider module by name, using a vite-ignore hint to tell the bundler the specifier is dynamic. The loader path shows a clear, bounded purpose and no payload or obfuscation.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/utils/nativeModuleRunner.ts:45:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    return import(pathToFileURL(path + queryParams).toString())
  }
}
```
likely benign LLM, confidence 0.88 Imports a module by file path plus query params converted to a file URL.
Reasoning
The path and query string are converted to a file URL and imported, which is a normal way for a native module runner to load modules with cache-busting query parameters. Nothing indicates decoding or hidden execution.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/utils/traces.ts:72:27

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      const sdkInit = (
        options.sdkPath ? import(/* @vite-ignore */ options.sdkPath!) : Promise.resolve()
      ).catch((cause) => {
        throw new Error(
```
likely benign LLM, confidence 0.85 Optionally imports a user-configured tracing SDK path with error handling.
Reasoning
The import loads an optional SDK from a user-configured path for tracing, guarded by a conditional and a catch that wraps the error. This is an optional-plugin pattern with no sign of obfuscation or covert execution.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/vitest-dev/vitest vitest && cd vitest
git checkout v5.1.0-beta.1
disclude scan --severity info --diff v5.0.5 packages/vitest