Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner's obfuscation heuristic was almost certainly triggered by the Unicode combining-diacriticals character class in the normalization regex, which visually renders as unusual or invisible characters. Reading the full supplied source shows this is an accent-stripping routine (NFD normalization followed by removal of combining marks and lowercasing) used to make search case- and accent-insensitive, exactly as the project's stated purpose describes. The entire file consists of plain, readable pure functions: term parsing, snippet generation, scoring, and iterating over dossier metadata. There is no obfuscated code, no eval or dynamic code construction, no network access, no DOM access, no file system access, no credential handling, and no data leaving the local context. Nothing in the supplied code conceals behavior.