Summary
Togoder Security scanned the npm package @typescript-eslint/utils@8.70.0 on Oct 6, 2026. An AI review of 39 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
0
critical
0
high
0
medium
0
low
Findings
No findings. The reviewer saw nothing malicious or risky in this version.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/ast-utils/eslint-utils/PatternMatcher.js | safe | The file is a standard TypeScript-compiled re-export shim that surfaces eslint-utils' PatternMatcher class and contains no malicious patterns. |
| dist/ast-utils/eslint-utils/ReferenceTracker.js | safe | No malicious patterns detected; the file is a standard TypeScript-compiled re-export of eslint-utils ReferenceTracker with no network, filesystem, process, or credential access. |
| dist/ast-utils/eslint-utils/astUtilities.js | safe | No malicious patterns detected in this TypeScript-compiled eslint utility re-export module. |
| dist/ast-utils/eslint-utils/index.js | safe | This is a standard TypeScript compilation helper file for re-exporting modules from eslint-utils, containing only common __createBinding and __exportStar helper functions with no malicious patterns. |
| dist/ast-utils/eslint-utils/predicates.js | safe | This is a standard TypeScript-compiled re-export module that only forwards ESLint utility predicate functions from @eslint-community/eslint-utils with no malicious patterns. |
| dist/ast-utils/eslint-utils/scopeAnalysis.js | safe | No malicious patterns detected |
| dist/ast-utils/helpers.js | safe | No malicious patterns detected |
| dist/ast-utils/index.js | safe | No malicious patterns detected; this is standard TypeScript/CommonJS module re-export boilerplate generated by the TypeScript compiler. |
| dist/ast-utils/misc.js | safe | No malicious patterns detected |
| dist/ast-utils/predicates.js | safe | No malicious patterns detected; the file contains only type predicate utility functions with no network, filesystem, process, or dynamic code execution activity. |
| dist/eslint-utils/InferTypesFromRule.js | safe | The file contains only a 'use strict' directive, an Object.defineProperty call for exports, and a source map comment, with no malicious patterns. |
| dist/eslint-utils/RuleCreator.js | safe | No malicious patterns detected; the file is a benign ESLint rule-creator utility with no network, filesystem, process, or dynamic-code behavior. |
| dist/eslint-utils/applyDefault.js | safe | No malicious patterns detected |
| dist/eslint-utils/deepMerge.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/eslint-utils/getParserServices.js | safe | No malicious patterns detected |
| dist/eslint-utils/index.js | safe | No malicious patterns detected; the file only contains standard TypeScript/CommonJS re-export helpers and relative module imports. |
| dist/eslint-utils/nullThrows.js | safe | No malicious patterns detected; the file contains a simple null assertion utility with no network, filesystem, process, or dynamic code execution behavior. |
| dist/eslint-utils/parserSeemsToBeTSESLint.js | safe | No malicious patterns detected |
| dist/index.js | safe | No malicious patterns detected; this is a standard TypeScript-compiled barrel file re-exporting local modules. |
| dist/json-schema.js | safe | No malicious patterns detected |
| dist/ts-eslint/AST.js | safe | No malicious patterns detected |
| dist/ts-eslint/Config.js | safe | No malicious patterns detected |
| dist/ts-eslint/ESLint.js | safe | No malicious patterns detected |
| dist/ts-eslint/Linter.js | safe | No malicious patterns detected; the file is a simple TypeScript re-export wrapper around ESLint's Linter class with no dynamic code execution, network, filesystem, or process activity. |
| dist/ts-eslint/Parser.js | safe | No malicious patterns detected |
Show 14 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/ts-eslint/ParserOptions.js | safe | No malicious patterns detected |
| dist/ts-eslint/Processor.js | safe | No malicious patterns detected |
| dist/ts-eslint/Rule.js | safe | No malicious patterns detected |
| dist/ts-eslint/RuleTester.js | safe | This is a minimal, benign file that simply re-exports a deprecated RuleTester class extending ESLint's official RuleTester; no malicious patterns detected. |
| dist/ts-eslint/Scope.js | safe | No malicious patterns detected; the code is standard TypeScript ESLint Scope re-export boilerplate using safe module import helpers. |
| dist/ts-eslint/SourceCode.js | safe | No malicious patterns detected |
| dist/ts-eslint/eslint/ESLintShared.js | safe | No malicious patterns detected; the file is a trivial module stub with only strict mode and export marker. |
| dist/ts-eslint/eslint/FlatESLint.js | safe | No malicious patterns detected |
| dist/ts-eslint/eslint/LegacyESLint.js | safe | No malicious patterns detected |
| dist/ts-eslint/index.js | safe | No malicious patterns detected |
| dist/ts-estree.js | safe | No malicious patterns detected |
| dist/ts-utils/NoInfer.js | safe | No malicious patterns detected |
| dist/ts-utils/index.js | safe | No malicious patterns detected; the file is standard TypeScript compiler helper code re-exporting local modules. |
| dist/ts-utils/isArray.js | safe | No malicious patterns detected |
Frequently asked questions
Is @typescript-eslint/utils safe to use?
Our AI source review of @typescript-eslint/utils@8.70.0 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does @typescript-eslint/utils contain malware?
No malware was identified in @typescript-eslint/utils@8.70.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @typescript-eslint/utils checked?
Togoder Security downloaded the published npm package and had an AI model read its 39 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @typescript-eslint/utils together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @typescript-eslint/utils@8.70.0, cost nothing.