# @img/sharp-win32-arm64@0.35.5 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:11:13.000Z
- Files reviewed: 1
- Findings: 1 medium severity finding
- Report: https://security.togoder.click/npm/@img/sharp-win32-arm64
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package @img/sharp-win32-arm64@0.35.5 on Oct 6, 2026. An AI review of 1 source file produced 1 medium severity finding. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Native binary loading at import time

Finding ID: `NPS-198B684440F0`

File: `index.cjs:1`

The module immediately loads a platform-specific native binary (.node file) via require() when imported. While this is a common pattern for native Node.js addons like sharp, it means arbitrary native code executes at import time, which cannot be audited from this JavaScript file alone. If the referenced binary were tampered with, it could contain any malicious payload (data exfiltration, reverse shells, etc.) without being visible in this source.

## Files reviewed

- `index.cjs` (medium): Safe-looking thin wrapper, but it delegates all behavior to an unaudited native binary loaded at import time.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology