Summary
Togoder Security scanned the npm package acorn@8.15.0 on Oct 4, 2026. An AI review of 1 source file produced 1 low severity finding. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
Findings 1
File system read
NPS-EE2585055525
The script reads files specified as command-line arguments and from stdin. This is expected behavior for a CLI parser/validator tool (acorn) and operates only on user-provided paths outside the package scope in a legitimate, non-malicious manner.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/bin.js | safe | The code is a legitimate CLI wrapper for the acorn JavaScript parser that reads user-specified files/stdin and prints parsed output; no malicious patterns such as exfiltration, credential harvesting, obfuscation, shell execution, or dynamic code evaluation were detected. |
Affected version ranges
None of the 2 scanned versions of acorn are flagged high or critical. The latest scanned version, 8.18.0, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 8.18.0 | No issues | 1 | 8.18.0 | |
| 8.17.0 | Not scanned | 1 | 8.17.0 | |
| 8.15.0 | No issues | 1 | 8.15.0 | |
| 6.4.2 – 7.4.1 | Not scanned | 2 | >=6.4.2 <=7.4.1 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of acorn
Frequently asked questions
Is acorn safe to use?
Our AI source review of acorn@8.15.0 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does acorn contain malware?
No malware was identified in acorn@8.15.0 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was acorn checked?
Togoder Security downloaded the published npm package and had an AI model read its 1 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan acorn together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in acorn@8.15.0, cost nothing.