Summary
Togoder Security scanned the npm package convert-source-map@2.0.0 on Oct 6, 2026. An AI review of 1 source file produced 1 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
File system read via user-supplied callback
NPS-2D15D52AFC96
The readFromFileMap function accepts a read parameter that is called with a filename extracted from a sourceMappingURL comment. This allows arbitrary file reads if the caller passes a permissive read function (e.g., fs.readFileSync). While this is an intended API feature for reading source map files, it could be abused if untrusted input reaches this function, potentially enabling reading of sensitive files like /etc/passwd or credentials. The package itself does not confine the path to the current working directory.
Dynamic code execution via Buffer and JSON.parse
NPS-8FE4D740B466
The code uses JSON.parse on decoded base64/URI content and Buffer constructors. While JSON.parse is not code execution, it can be exploited for prototype pollution if the input is attacker-controlled. No direct eval or new Function is present, but the package processes untrusted sourcemap comments and constructs objects from them, which could lead to prototype pollution in consumers.
Potential data exfiltration through sourcemap comments
NPS-ED913F4CC3C9
The functions fromComment, fromSource, and fromMapFileSource parse sourceMappingURL comments that may contain base64 or URI-encoded data. Although this module does not send data externally, it decodes and embeds arbitrary data from comments into sourcemap objects. If a malicious sourcemap is later used by a tool that uploads sourcemaps to a remote service, it could lead to unintended data exposure. This is a design risk rather than direct malware.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| index.js | medium | The code is a legitimate sourcemap conversion utility, but it exposes an API that can read arbitrary files via a user-supplied callback and processes untrusted sourcemap comments, posing medium-risk for path traversal and potential data exposure if misused. |
Scanned versions of convert-source-map
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 2.0.0 | Needs review | 1 | Oct 6, 2026 |
Frequently asked questions
Is convert-source-map safe to use?
No confirmed malware was found in convert-source-map@2.0.0, but the review flagged 1 medium, 2 low severity findings for risky patterns worth checking before you rely on it.
Does convert-source-map contain malware?
No malware was identified in convert-source-map@2.0.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was convert-source-map checked?
Togoder Security downloaded the published npm package and had an AI model read its 1 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan convert-source-map together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in convert-source-map@2.0.0, cost nothing.