Summary
Togoder Security scanned the npm package @noble/curves@1.8.0 on Oct 4, 2026. An AI review of 66 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
0
critical
0
high
0
medium
0
low
Findings
No findings. The reviewer saw nothing malicious or risky in this version.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| _shortw_utils.js | safe | No malicious patterns detected; the code is a benign utility module for cryptographic curve operations. |
| abstract/bls.js | safe | No malicious patterns detected; the code is a legitimate implementation of BLS signatures from the noble-curves library with no data exfiltration, credential harvesting, obfuscation, or suspicious network/process activity. |
| abstract/curve.js | safe | This is a legitimate elliptic curve cryptography library (noble-curves) implementing wNAF and Pippenger algorithms with no malicious patterns detected. |
| abstract/edwards.js | safe | No malicious patterns detected; this is a legitimate cryptographic library implementation from noble-curves. |
| abstract/hash-to-curve.js | safe | No malicious patterns detected; the code is a legitimate implementation of RFC 9380 hash-to-curve primitives for elliptic curve cryptography. |
| abstract/modular.js | safe | No malicious patterns detected; this is a legitimate cryptographic modular arithmetic utility from the noble-curves library with no data exfiltration, obfuscation, or execution-time side effects. |
| abstract/montgomery.js | safe | The code is a legitimate implementation of Montgomery curve operations for X25519/X448 from the noble-curves library, with no malicious patterns detected. |
| abstract/poseidon.js | safe | This file implements the Poseidon cryptographic hash function with only local arithmetic operations, input validation, and no suspicious network, filesystem, or process activity. |
| abstract/tower.js | safe | No malicious patterns detected; the code is a legitimate cryptographic tower field implementation from the noble-curves library with no network, filesystem, process, or dynamic code execution behavior. |
| abstract/utils.js | safe | No malicious patterns detected; the file contains standard cryptographic utility functions (hex/byte conversion, HMAC-DRBG, validation helpers) with no network, filesystem, process, or dynamic code execution behavior. |
| abstract/weierstrass.js | safe | No malicious patterns detected; the code is a standard cryptographic library implementation of short Weierstrass elliptic curves and ECDSA, with no data exfiltration, credential harvesting, obfuscation, or other suspicious behavior. |
| bls12-381.js | safe | No malicious patterns detected; the code implements BLS12-381 cryptographic curve operations from the well-known noble-curves library without any data exfiltration, obfuscation, credential harvesting, or suspicious behavior. |
| bn254.js | safe | No malicious patterns detected; the file is a legitimate cryptographic implementation of the bn254 elliptic curve from the noble-curves library. |
| ed25519.js | safe | No malicious patterns detected; this is a legitimate cryptographic library implementing ed25519, x25519, and ristretto255 from the noble-curves project. |
| ed448.js | safe | No malicious patterns detected; this is a legitimate cryptographic library implementation of Ed448, X448, and Decaf448 with no data exfiltration, credential harvesting, dynamic code execution, or network/file system abuse. |
| esm/_shortw_utils.js | safe | Cleared by Jev triage; no further analysis needed |
| esm/abstract/bls.js | safe | No malicious patterns detected |
| esm/abstract/curve.js | safe | No malicious patterns detected; the code is a legitimate implementation of elliptic curve multiplication algorithms from the noble-curves library with no network, filesystem, process, or credential access. |
| esm/abstract/edwards.js | safe | No malicious patterns detected; the code is a legitimate cryptographic implementation of Twisted Edwards curves and EdDSA signatures from the noble-curves library. |
| esm/abstract/hash-to-curve.js | safe | No malicious patterns detected; the code implements RFC 9380 hash-to-curve primitives with no network, filesystem, process, or dynamic execution behavior. |
| esm/abstract/modular.js | safe | This is a standard cryptographic modular arithmetic utility from the noble-curves library with no malicious patterns detected; all operations are local mathematical computations with no network, filesystem, process, or dynamic code execution. |
| esm/abstract/montgomery.js | safe | This is a legitimate implementation of Montgomery curve operations for X25519/X448 from the noble-curves library with no malicious patterns detected. |
| esm/abstract/poseidon.js | safe | Cleared by Jev triage; no further analysis needed |
| esm/abstract/tower.js | safe | Cleared by Jev triage; no further analysis needed |
| esm/abstract/utils.js | safe | No malicious patterns detected; the code is a standard cryptographic utility library (noble-curves) with no exfiltration, obfuscation, or suspicious behavior. |
Show 41 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| esm/abstract/weierstrass.js | safe | No malicious patterns detected; the code is a legitimate cryptographic library implementation for short Weierstrass elliptic curves with no signs of data exfiltration, credential harvesting, obfuscation, or other security concerns. |
| esm/bls12-381.js | safe | No malicious patterns detected in the BLS12-381 cryptographic implementation. |
| esm/bn254.js | safe | No malicious patterns detected; the file is a legitimate cryptographic implementation of the bn254 curve from the noble-curves library with no data exfiltration, credential harvesting, obfuscation, network calls, process spawning, or dynamic code execution. |
| esm/ed25519.js | safe | No malicious patterns detected; the file is a legitimate cryptographic library implementation for ed25519 and related primitives. |
| esm/ed448.js | safe | No malicious patterns detected; the code is a legitimate cryptographic implementation of Ed448, X448, and Decaf448 from the noble-curves library. |
| esm/index.js | safe | The file intentionally throws an error to prevent root module imports, contains no dynamic code execution, network, filesystem, credential, or process-spawning behavior, and is benign. |
| esm/jubjub.js | safe | No malicious patterns detected; this is a legitimate cryptographic curve implementation from the noble-curves library with no network, file system, process, or dynamic code execution behavior. |
| esm/p256.js | safe | No malicious patterns detected; the file is a legitimate implementation of the NIST P-256 curve from the noble-curves library. |
| esm/p384.js | safe | No malicious patterns detected; the code is a standard cryptographic implementation for the NIST P-384 elliptic curve. |
| esm/p521.js | safe | No malicious patterns detected; the code is a standard cryptographic implementation of NIST P-521 elliptic curve from the noble-curves library. |
| esm/pasta.js | safe | Cleared by Jev triage; no further analysis needed |
| esm/secp256k1.js | safe | No malicious patterns detected; this is the legitimate @noble/curves secp256k1 cryptographic implementation. |
| index.js | safe | No malicious patterns detected; the file simply throws an error instructing users to import submodules. |
| jubjub.js | safe | No malicious patterns detected; the code is a standard implementation of the JubJub elliptic curve from the noble-curves library with no suspicious behavior. |
| p256.js | safe | No malicious patterns detected |
| p384.js | safe | No malicious patterns detected; this is a legitimate cryptographic implementation of the NIST P-384 elliptic curve from the noble-curves library. |
| p521.js | safe | No malicious patterns detected |
| pasta.js | safe | No malicious patterns detected; the code is a legitimate cryptographic library defining Pasta curves with standard imports and no suspicious behavior. |
| secp256k1.js | safe | This is a legitimate secp256k1 elliptic curve cryptography implementation from the noble-curves library with no malicious patterns detected. |
| src/_shortw_utils.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/abstract/bls.ts | safe | No malicious patterns detected; the code is a legitimate cryptographic implementation of BLS signatures from the noble-curves library. |
| src/abstract/curve.ts | safe | No malicious patterns detected; the code is a standard, well-documented elliptic curve cryptography library implementation for elliptic curve multiplication, Pippenger algorithm, and MSM precomputation, with no data exfiltration, credential harvesting, obfuscation, dynamic execution, or filesystem/process manipulation. |
| src/abstract/edwards.ts | safe | The code is a legitimate cryptographic library implementation of Twisted Edwards curves and EdDSA signatures with no malicious patterns detected. |
| src/abstract/hash-to-curve.ts | safe | No malicious patterns detected; the code is a legitimate implementation of RFC 9380 hash-to-curve from the noble-curves library, with no data exfiltration, credential harvesting, obfuscation, or network/process activity. |
| src/abstract/modular.ts | safe | This is a legitimate cryptographic utility module from the noble-curves library implementing modular arithmetic and finite field operations, with no malicious patterns detected. |
| src/abstract/montgomery.ts | safe | No malicious patterns detected |
| src/abstract/poseidon.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/abstract/tower.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/abstract/utils.ts | safe | No malicious patterns detected; the file contains standard cryptographic utility functions from the noble-curves library with no network, filesystem, process, or dynamic code execution behavior. |
| src/abstract/weierstrass.ts | safe | This is a legitimate cryptographic library implementing Weierstrass elliptic curve and ECDSA operations with no malicious patterns. |
| src/bls12-381.ts | safe | No malicious patterns detected |
| src/bn254.ts | safe | No malicious patterns detected; the file is a legitimate cryptographic implementation of the bn254 curve from the noble-curves library. |
| src/ed25519.ts | safe | This is the legitimate @noble/curves ed25519 implementation with no malicious patterns detected. |
| src/ed448.ts | safe | No malicious patterns detected; the code is a legitimate cryptographic library implementation of Ed448, X448, and Decaf448 with no external calls, obfuscation, or suspicious behavior. |
| src/index.ts | safe | The file only throws an error to prevent direct root module import, with no malicious patterns detected. |
| src/jubjub.ts | safe | No malicious patterns detected; the file contains standard elliptic curve cryptography implementation for the JubJub curve with no exfiltration, credential harvesting, dynamic execution, or suspicious behavior. |
| src/p256.ts | safe | No malicious patterns detected; the code is a standard implementation of the NIST P-256 elliptic curve from the noble-curves library. |
| src/p384.ts | safe | No malicious patterns detected; the file is a legitimate implementation of the NIST P-384 elliptic curve from the noble-curves library with no network, process, or filesystem side effects. |
| src/p521.ts | safe | Cryptographic curve implementation with no malicious patterns detected |
| src/pasta.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/secp256k1.ts | safe | No malicious patterns detected; the code is a standard, well-known implementation of secp256k1 elliptic curve cryptography from the @noble/curves library with no signs of exfiltration, credential harvesting, obfuscation, or other security concerns. |
Affected version ranges
None of the 5 scanned versions of @noble/curves are flagged high or critical. The latest scanned version, 1.9.7, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.
1.2.01.9.7
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 1.9.1 – 1.9.7 | No issues | 2 | >=1.9.1 <=1.9.7 | |
| 1.8.2 – 1.9.0 | Not scanned | 2 | >=1.8.2 <=1.9.0 | |
| 1.4.2 – 1.8.1 | No issues | 3 | >=1.4.2 <=1.8.1 | |
| 1.2.0 | Not scanned | 1 | 1.2.0 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of @noble/curves
Frequently asked questions
Is @noble/curves safe to use?
Our AI source review of @noble/curves@1.8.0 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does @noble/curves contain malware?
No malware was identified in @noble/curves@1.8.0 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @noble/curves checked?
Togoder Security downloaded the published npm package and had an AI model read its 66 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @noble/curves together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @noble/curves@1.8.0, cost nothing.