Summary
Togoder Security scanned the npm package @semantic-release/release-notes-generator@14.1.0 on Oct 6, 2026. An AI review of 4 source files produced 2 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
Dynamic module loading with user-controlled input
NPS-4084E2DBB6D7
The code dynamically imports npm packages based on user-supplied preset or config values. While import-from-esm is used to resolve modules relative to the package or cwd, an attacker who controls the plugin configuration could load an arbitrary npm package, which is a legitimate but potentially risky feature common to semantic-release plugins.
Dynamic module loading with user-controlled input
NPS-0B063AC6F374
The config parameter is passed directly to importFrom.silent and importFrom, allowing arbitrary module names to be resolved and executed. This enables loading any installed npm package as a changelog configuration, which is the documented purpose but still represents a code execution vector if configuration is untrusted.
Code execution via imported modules
NPS-1E53FAFDBAB7
The loaded configuration module is invoked as a function ((await importFrom...)(presetConfig) and (...)()), executing arbitrary code from the resolved module. This is expected behavior for conventional-changelog presets but executes third-party code at runtime.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/load-changelog-config.js | medium | The code is a standard semantic-release changelog config loader that dynamically imports user-specified npm packages, which is intentional functionality but introduces a code execution surface if configuration input is untrusted; no overt malicious patterns such as exfiltration, credential harvesting, or shell spawning were found. |
| index.js | safe | No malicious patterns detected; the code appears to be a legitimate semantic-release plugin for generating changelogs. |
| lib/hosts-config.js | safe | Cleared by Jev triage; no further analysis needed |
| wrappers/conventional-changelog-writer.js | safe | Cleared by Jev triage; no further analysis needed |
Frequently asked questions
Is @semantic-release/release-notes-generator safe to use?
No confirmed malware was found in @semantic-release/release-notes-generator@14.1.0, but the review flagged 2 medium, 1 low severity findings for risky patterns worth checking before you rely on it.
Does @semantic-release/release-notes-generator contain malware?
No malware was identified in @semantic-release/release-notes-generator@14.1.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @semantic-release/release-notes-generator checked?
Togoder Security downloaded the published npm package and had an AI model read its 4 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @semantic-release/release-notes-generator together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @semantic-release/release-notes-generator@14.1.0, cost nothing.