which 7.0.0

Source: https://github.com/npm/node-which
Tag scanned: v7.0.0
Compared with: v6.0.1 (0 signals introduced since)
Files: 26 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 3.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution .github/actions/create-check/action.yml:39:45

[embedded bash] command name is a variable (`$serverUrl`, `$owner`, `$repo`, `$SHA`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
          return [
            `This check is assosciated with ${serverUrl}/${owner}/${repo}/commit/${SHA}.`,
            'Run logs:',
            job?.html_url || `could not be found for a job ending with: "${JOB_NAME}"`,
```
dismissed LLM, confidence 0.93 JavaScript template literals building a check-run summary string, misclassified as embedded bash.
Reasoning
The snippet is JavaScript (a return array with template literals and optional chaining) inside a YAML script block. The 'embedded bash' pass has misparsed JS template interpolations like ${serverUrl} as shell command names. No shell execution is visible, so this is a parser false positive.
info ~~critical~~ → info by review dynamic-execution .github/actions/create-check/action.yml:41:30

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
            'Run logs:',
            job?.html_url || `could not be found for a job ending with: "${JOB_NAME}"`,
          ].join(' ')
```
dismissed LLM, confidence 0.93 JavaScript template-literal string concatenation misread as a runtime-determined shell command.
Reasoning
The flagged construct is a JavaScript template literal interpolating ${JOB_NAME} inside a .join(' ') call. It is not a shell command substitution. The critical severity comes from the same misparse of JS syntax as bash, so the finding does not reflect real dynamic execution.
info ~~warn~~ → info by review dynamic-execution .github/workflows/release.yml:227:29

[embedded bash] command name is a variable (`$owner`, `$repo`, `$runId`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
            const issue_number = releases[0].prNumber
            const runUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}`

            return [
```
dismissed LLM, confidence 0.92 JavaScript template literal constructing a GitHub Actions run URL, misclassified as embedded bash.
Reasoning
The snippet is JavaScript building a runUrl with a template literal from owner, repo and runId, inside a github-script step. The bash pass has treated the JS interpolation as a shell command name. Nothing in the snippet executes a shell.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/npm/node-which node-which && cd node-which
git checkout v7.0.0
disclude scan --severity info --diff v6.0.1 .