# css-tree@3.2.1 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:14:54.000Z
- Files reviewed: 272
- Findings: 1 low severity finding
- Report: https://security.togoder.click/npm/css-tree
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package css-tree@3.2.1 on Oct 6, 2026. An AI review of 272 source files produced 1 low severity finding. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] Static JSON data import

Finding ID: `NPS-5A2DE74B0593`

File: `lib/data-patch.js`

The module imports a static JSON file ('../data/patch.json') using createRequire and exports it as default. This itself is not malicious, but it means any data contained in patch.json will be available to consumers of this module. If patch.json were attacker-controlled or contained malicious payload (e.g., prototype pollution gadgets, large data, or executable-looking strings), it could be used in further attacks. The file does not perform exfiltration, credential harvesting, dynamic execution, or network/file system operations. No suspicious behavior is present in this specific file.

## Files reviewed

- `lib/data-patch.js` (medium): The file only loads and re-exports a local JSON data file with no malicious patterns, though the contents of patch.json are not inspected here and should be reviewed separately.
- `cjs/convertor/create.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/convertor/index.cjs` (safe): No malicious patterns detected; the file simply re-exports a converted walker module using local requires.
- `cjs/data-patch.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/data.cjs` (safe): No malicious patterns detected; the code is a straightforward data-processing module for MDN CSS definitions with no network, filesystem, process, or dynamic code execution behavior.
- `cjs/definition-syntax/SyntaxError.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/definition-syntax/generate.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/definition-syntax/index.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/definition-syntax/parse.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/definition-syntax/scanner.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/definition-syntax/walk.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/generator/create.cjs` (safe): No malicious patterns detected
- `cjs/generator/index.cjs` (safe): No malicious patterns detected
- `cjs/generator/sourceMap.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/generator/token-before.cjs` (safe): No malicious patterns detected; the code is a legitimate CSS tokenizer helper for determining whitespace insertion between tokens.
- `cjs/index.cjs` (safe): This file is a standard barrel/index file for a CSS parser library (css-tree), re-exporting internal modules without any malicious patterns, network calls, credential harvesting, or dynamic code execution.
- `cjs/lexer/Lexer.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/error.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/generic-an-plus-b.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/generic-const.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/generic-urange.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/generic.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/index.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/match-graph.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/match.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/prepare-tokens.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/search.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/structure.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/trace.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/lexer/units.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/parser/SyntaxError.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/parser/create.cjs` (safe): No malicious patterns detected; the code is a CSS parser module with no network, filesystem, or process manipulation.
- `cjs/parser/index.cjs` (safe): No malicious patterns detected; the file only imports local modules and exports a parser instance.
- `cjs/parser/parse-selector.cjs` (safe): No malicious patterns detected; the file only imports local modules and exports a parser function.
- `cjs/parser/sequence.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/container.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/font-face.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/import.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/index.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/layer.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/media.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/nest.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/page.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/scope.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/starting-style.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/atrule/supports.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/config/generator.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/config/lexer.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/config/mix.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/config/parser-selector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/config/parser.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/config/walker.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/create.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/function/expression.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/function/var.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/index.cjs` (safe): No malicious patterns detected
- `cjs/syntax/node/AnPlusB.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Atrule.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/AtrulePrelude.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/AttributeSelector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Block.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Brackets.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/CDC.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/CDO.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/ClassSelector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Combinator.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Comment.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Condition.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Declaration.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/DeclarationList.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Dimension.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Feature.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/FeatureFunction.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/FeatureRange.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Function.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/GeneralEnclosed.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Hash.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/IdSelector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Identifier.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Layer.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/LayerList.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/MediaQuery.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/MediaQueryList.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/NestingSelector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Nth.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Number.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Operator.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Parentheses.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Percentage.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/PseudoClassSelector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/PseudoElementSelector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Ratio.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Raw.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Rule.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Scope.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Selector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/SelectorList.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/String.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/StyleSheet.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/SupportsDeclaration.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/TypeSelector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/UnicodeRange.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Url.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/Value.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/WhiteSpace.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/index-generate.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/index-parse-selector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/index-parse.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/node/index.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/pseudo/index.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/pseudo/lang.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/scope/atrulePrelude.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/scope/default.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/scope/index.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/scope/selector.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/syntax/scope/value.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/tokenizer/OffsetToLocation.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/tokenizer/TokenStream.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/tokenizer/adopt-buffer.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/tokenizer/char-code-definitions.cjs` (safe): No malicious patterns detected
- `cjs/tokenizer/index.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/tokenizer/names.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/tokenizer/types.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/tokenizer/utils.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/utils/List.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/utils/clone.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/utils/create-custom-error.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/utils/ident.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/utils/index.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/utils/names.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/utils/string.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/utils/url.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/version.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/walker/create.cjs` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/walker/index.cjs` (safe): No malicious patterns detected
- `dist/data.cjs` (safe): No malicious patterns detected
- `dist/data.js` (safe): No malicious patterns detected
- `dist/version.cjs` (safe): No malicious patterns detected
- `dist/version.js` (safe): No malicious patterns detected
- `lib/convertor/create.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/convertor/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/data.js` (safe): No malicious patterns detected; the code only processes and patches CSS data from mdn-data with no network, filesystem, process execution, or obfuscation concerns.
- `lib/definition-syntax/SyntaxError.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/definition-syntax/generate.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/definition-syntax/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/definition-syntax/parse.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/definition-syntax/scanner.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/definition-syntax/walk.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/generator/create.js` (safe): No malicious patterns detected; the code is a standard CSS/JS source code generator with no network, filesystem, process, or dynamic execution activity.
- `lib/generator/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/generator/sourceMap.js` (safe): No malicious patterns detected; the code is a standard source map generator for CSS/PostCSS that only tracks location data and produces mappings without any network, filesystem, process, or obfuscated behavior.
- `lib/generator/token-before.js` (safe): No malicious patterns detected; the file is a pure CSS tokenizer serialization utility with no network, filesystem, process, or dynamic code execution activity.
- `lib/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/Lexer.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/error.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/generic-an-plus-b.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/generic-const.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/generic-urange.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/generic.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/match-graph.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/match.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/prepare-tokens.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/search.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/structure.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/trace.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/lexer/units.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/parser/SyntaxError.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/parser/create.js` (safe): This is a legitimate CSS parser implementation (resembling css-tree) with no malicious patterns, network activity, process spawning, or dynamic code execution detected.
- `lib/parser/index.js` (safe): No malicious patterns detected
- `lib/parser/parse-selector.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/parser/sequence.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/container.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/font-face.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/import.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/layer.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/media.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/nest.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/page.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/scope.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/starting-style.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/atrule/supports.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/config/generator.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/config/lexer.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/config/mix.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/config/parser-selector.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/config/parser.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/config/walker.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/create.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/function/expression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/function/var.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/node/AnPlusB.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/node/Atrule.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/node/AtrulePrelude.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/node/AttributeSelector.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/node/Block.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/node/Brackets.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/syntax/node/CDC.js` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology