# bidi-js@1.1.0 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-06T14:14:00.000Z
- Files reviewed: 13
- Findings: no findings
- Report: https://security.togoder.click/npm/bidi-js
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package bidi-js@1.1.0 on Oct 6, 2026. An AI review of 13 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

No findings.

## Files reviewed

- `dist/bidi.js` (safe): The file is a legitimate Unicode Bidirectional Algorithm (bidi) implementation with no malicious patterns, network calls, credential harvesting, or dynamic code execution.
- `dist/bidi.min.mjs` (safe): No malicious patterns detected; the code implements Unicode bidirectional text algorithm logic without any security-sensitive operations.
- `dist/bidi.mjs` (safe): No malicious patterns detected; the code is a legitimate Unicode Bidirectional Algorithm implementation with encoded data tables and no network, filesystem, or dynamic execution behavior.
- `src/brackets.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/charTypes.js` (safe): No malicious patterns detected; the code is a standard Unicode bidi character type lookup module with no network, filesystem, or process activity.
- `src/data/bidiBrackets.data.js` (safe): The file contains only static, auto-generated Bidi bracket pair mapping data with no executable code or malicious patterns.
- `src/data/bidiCharTypes.data.js` (safe): No malicious patterns detected; the file only exports static Unicode bidirectional character type data with no executable code.
- `src/data/bidiMirroring.data.js` (safe): No malicious patterns detected; the file contains only static bidi mirroring character data.
- `src/embeddingLevels.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/mirroring.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/reordering.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/util/parseCharacterMap.js` (safe): No malicious patterns detected; the code is a pure data parsing utility with no network, filesystem, process execution, or obfuscation concerns.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology