Summary
Togoder Security scanned the npm package commander@15.0.0 on Oct 6, 2026. An AI review of 7 source files produced 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
child_process usage for executable subcommands
NPS-A7DA15007906
The Command library intentionally supports spawning external processes via childProcess.spawn() to run executable subcommands. The executable path is derived from the command name and configurable executableDir, not from untrusted runtime input, so this is standard Commander functionality rather than a backdoor. It does allow arbitrary file execution if an attacker controls program setup, but this is by design and documented behavior of the library.
Dynamic process exit and signal handling
NPS-9E5B46D24415
Process signal handlers are registered for SIGUSR1/SIGUSR2/SIGTERM/SIGINT/SIGHUP to forward signals to spawned child processes, and process.exit is called on child close. This is normal for process management in a CLI framework and does not constitute a backdoor or reverse shell.
Environment variable reading
NPS-3230625A9078
Options can read values from process.env via the envVar option feature (see _parseOptionsEnv and handleOptionValue env path). This is a documented feature for CLI option configuration and only reads explicitly configured variable names, not credential files like .npmrc, .aws, or .ssh.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/command.js | medium | This is the legitimate Commander.js CLI library; no data exfiltration, obfuscation, credential harvesting, crypto-mining, or backdoor patterns were found, only expected child_process spawning and env-var reading inherent to its documented CLI framework functionality. |
| index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/argument.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/error.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/help.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/option.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/suggestSimilar.js | safe | Cleared by Jev triage; no further analysis needed |
Affected version ranges
None of the 5 scanned versions of commander are flagged high or critical. The latest scanned version, 15.0.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 15.0.0 | Needs review | 1 | 15.0.0 | |
| 14.0.2 – 14.0.3 | Not scanned | 2 | >=14.0.2 <=14.0.3 | |
| 14.0.1 | Needs review | 1 | 14.0.1 | process spawning |
| 14.0.0 | No issues | 1 | 14.0.0 | |
| 13.1.0 | Not scanned | 1 | 13.1.0 | |
| 12.1.0 | No issues | 1 | 12.1.0 | |
| 3.0.2 – 10.0.1 | Not scanned | 8 | >=3.0.2 <=10.0.1 | |
| 2.20.3 | Needs review | 1 | 2.20.3 | process_spawning |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of commander
Frequently asked questions
Is commander safe to use?
No confirmed malware was found in commander@15.0.0, but the review flagged 3 low severity findings for risky patterns worth checking before you rely on it.
Does commander contain malware?
No malware was identified in commander@15.0.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was commander checked?
Togoder Security downloaded the published npm package and had an AI model read its 7 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan commander together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in commander@15.0.0, cost nothing.