# @eslint/compat@2.1.1 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-06T14:11:02.000Z
- Files reviewed: 2
- Findings: 1 low severity finding
- Report: https://security.togoder.click/npm/@eslint/compat
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package @eslint/compat@2.1.1 on Oct 6, 2026. An AI review of 2 source files produced 1 low severity finding. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

### [low] File system read

Finding ID: `NPS-3894295A26A8`

File: `dist/cjs/index.cjs:620`

The includeIgnoreFile function reads a user-specified ignore file from disk. This is expected behavior for an ESLint compatibility utility and does not access credentials, environment files, or data outside the explicitly provided path.

## Files reviewed

- `dist/cjs/index.cjs` (safe): The code is a legitimate ESLint compatibility layer that fixes up rule/plugin/context APIs and reads ignore files; no malicious patterns such as exfiltration, credential harvesting, obfuscation, process spawning, or dynamic code execution were found.
- `dist/esm/index.js` (safe): No malicious patterns detected; the code is a legitimate ESLint compatibility utility for fixing up rule/context APIs.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology