Key takeaways
- Your code gets reviewed; your dependencies usually do not. They are most of what you ship.
- An LLM can judge intent across a file: a decoded string passed to eval after reading environment variables, not just the word eval.
- A fast screening model clears plain library code first; the rest gets a full review.
- Findings are AI judgments: expect some false positives, and treat a clean result as strong evidence, not proof.
Why review dependency source
A typical application ships far more third-party code than its own, and almost none of it is read by anyone on the team. Advisory scanners check versions against reported problems; they cannot say what an unreported version does. Reading the code can, and a language model can read all of it.
How the review works
- Resolve: lockfiles are used as pinned; manifests and single packages are resolved to what the registry would serve.
- Download: each version's published archive is fetched from the official registry and unpacked. Nothing is installed or executed.
- Screening: non-code files are skipped, and a fast screening model clears files that are plainly ordinary library code.
- Review: a large language model reads each remaining file and reports install-time payloads, credential theft, exfiltration, obfuscated loaders, backdoors, wallet drainers and miners, plus lower-severity risky patterns.
- Cache: verdicts are stored by the SHA-256 of each file, so the same bytes are never reviewed (or billed) twice, and each scanned version gets a public report.
The full process, severity levels and limits are in the methodology.
AI review vs rules and signatures
Rule-based tools match patterns: a call to eval, a request in an install script. They are fast and predictable, and both easy to trip with legitimate code and easy to evade by rewriting the payload. A model reads the whole file and can follow what the code does with data: that it collects environment variables, encodes them, and sends them to a hard-coded host. That makes it better at novel payloads, at the cost of being a judgment that can be wrong.
Limits
- Code downloaded at runtime from a server is only visible as the download, not what it fetches.
- Very large or minified bundles and logic split across many files are harder to judge.
- Legitimate installers that fetch binaries are a common false positive.
- It does not report ordinary CVEs; keep an advisory scanner for those.
Try it
Upload a lockfile for a free quote, read an example report such as express, or call the API.
Frequently asked questions
Is there a tool that reviews the source code of my dependencies with AI?
Yes. Togoder Security downloads every package in your lockfile and has an AI model read each source file for malicious behavior, reporting findings with file, line and severity. It supports npm, PyPI, crates.io, Go, RubyGems and Packagist.
Does the AI execute the package?
No. The packages are only downloaded and unpacked; the model reads the source as text.