# @eslint/config-helpers@0.7.0 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-06T14:11:02.000Z
- Files reviewed: 3
- Findings: 1 low severity finding
- Report: https://security.togoder.click/npm/@eslint/config-helpers
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package @eslint/config-helpers@0.7.0 on Oct 6, 2026. An AI review of 3 source files produced 1 low severity finding. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

### [low] file system access

Finding ID: `NPS-13C7D388DF6B`

File: `dist/cjs/index.cjs:465`

The code reads ignore files (e.g., .gitignore) using fs.readFileSync, which is expected functionality for the includeIgnoreFile helper and is limited to user-specified absolute paths validated to be absolute.

## Files reviewed

- `dist/cjs/index.cjs` (safe): The code is a legitimate ESLint config helper with no malicious patterns; file reads are limited to user-provided ignore file paths and no network, process spawning, or obfuscated code exists.
- `dist/esm/index.js` (safe): No malicious patterns detected; the code is a legitimate ESLint config helper that only reads user-specified ignore files from absolute paths without network, credential, or process execution activity.
- `dist/esm/types.ts` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology