which 7.0.0

Source: https://github.com/npm/node-which
Tag scanned: v7.0.0
Compared with: v6.0.1 (0 signals introduced since)
Files: 26 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 4.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 11:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution .github/actions/create-check/action.yml:39:45

[embedded bash] command name is a variable (`$serverUrl`, `$owner`, `$repo`, `$SHA`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
          return [
            `This check is assosciated with ${serverUrl}/${owner}/${repo}/commit/${SHA}.`,
            'Run logs:',
            job?.html_url || `could not be found for a job ending with: "${JOB_NAME}"`,
```
dismissed LLM, confidence 0.92 JavaScript string construction for a check-run description, misparsed as embedded bash.
Reasoning
The snippet is a JavaScript template literal building a human-readable check summary from ${serverUrl}, ${owner}, ${repo}, and ${SHA}. These are string interpolations inside a JS return array, not a shell command position. The embedded-bash parser appears to have treated the JavaScript inside a YAML script block as bash, so this is a parser artifact rather than runtime command execution.
info ~~critical~~ → info by review dynamic-execution .github/actions/create-check/action.yml:41:30

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
            'Run logs:',
            job?.html_url || `could not be found for a job ending with: "${JOB_NAME}"`,
          ].join(' ')
```
dismissed LLM, confidence 0.92 JavaScript fallback string with a template interpolation in a GitHub Actions script, flagged as a runtime-determined command.
Reasoning
The flagged ${JOB_NAME} sits inside a JavaScript template literal used as a fallback string in a `job?.html_url || ...` expression, followed by a `.join(' ')` call. No shell is invoked and no value is executed as a command. The critical severity comes from misreading JS interpolation as a command substitution.
info ~~warn~~ → info by review dynamic-execution .github/workflows/release.yml:227:29

[embedded bash] command name is a variable (`$owner`, `$repo`, `$runId`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
            const issue_number = releases[0].prNumber
            const runUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}`

            return [
```
dismissed LLM, confidence 0.92 JavaScript template literal constructing a workflow run URL, misparsed as embedded bash.
Reasoning
The snippet builds a GitHub Actions run URL with a JS template literal from owner, repo, and runId, then returns an array. This is ordinary github-script JavaScript in a workflow file. The 'command name is a variable' message comes from the bash parser misreading a JS template string, not from any shell execution.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/npm/node-which node-which && cd node-which
git checkout v7.0.0
disclude scan --severity info --diff v6.0.1 .