Summary
Togoder Security scanned the npm package css-tree@3.2.1 on Oct 6, 2026. An AI review of 272 source files produced 1 low severity finding. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
0
critical
0
high
0
medium
1
low
Findings 1
low
Static JSON data import
NPS-5A2DE74B0593
The module imports a static JSON file ('../data/patch.json') using createRequire and exports it as default. This itself is not malicious, but it means any data contained in patch.json will be available to consumers of this module. If patch.json were attacker-controlled or contained malicious payload (e.g., prototype pollution gadgets, large data, or executable-looking strings), it could be used in further attacks. The file does not perform exfiltration, credential harvesting, dynamic execution, or network/file system operations. No suspicious behavior is present in this specific file.
lib/data-patch.js
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/data-patch.js | medium | The file only loads and re-exports a local JSON data file with no malicious patterns, though the contents of patch.json are not inspected here and should be reviewed separately. |
| cjs/convertor/create.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/convertor/index.cjs | safe | No malicious patterns detected; the file simply re-exports a converted walker module using local requires. |
| cjs/data-patch.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/data.cjs | safe | No malicious patterns detected; the code is a straightforward data-processing module for MDN CSS definitions with no network, filesystem, process, or dynamic code execution behavior. |
| cjs/definition-syntax/SyntaxError.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/definition-syntax/generate.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/definition-syntax/index.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/definition-syntax/parse.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/definition-syntax/scanner.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/definition-syntax/walk.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/generator/create.cjs | safe | No malicious patterns detected |
| cjs/generator/index.cjs | safe | No malicious patterns detected |
| cjs/generator/sourceMap.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/generator/token-before.cjs | safe | No malicious patterns detected; the code is a legitimate CSS tokenizer helper for determining whitespace insertion between tokens. |
| cjs/index.cjs | safe | This file is a standard barrel/index file for a CSS parser library (css-tree), re-exporting internal modules without any malicious patterns, network calls, credential harvesting, or dynamic code execution. |
| cjs/lexer/Lexer.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/error.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/generic-an-plus-b.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/generic-const.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/generic-urange.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/generic.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/index.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/match-graph.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/match.cjs | safe | Cleared by Jev triage; no further analysis needed |
Show 247 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| cjs/lexer/prepare-tokens.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/search.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/structure.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/trace.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/lexer/units.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/parser/SyntaxError.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/parser/create.cjs | safe | No malicious patterns detected; the code is a CSS parser module with no network, filesystem, or process manipulation. |
| cjs/parser/index.cjs | safe | No malicious patterns detected; the file only imports local modules and exports a parser instance. |
| cjs/parser/parse-selector.cjs | safe | No malicious patterns detected; the file only imports local modules and exports a parser function. |
| cjs/parser/sequence.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/container.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/font-face.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/import.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/index.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/layer.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/media.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/nest.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/page.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/scope.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/starting-style.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/atrule/supports.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/config/generator.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/config/lexer.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/config/mix.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/config/parser-selector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/config/parser.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/config/walker.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/create.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/function/expression.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/function/var.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/index.cjs | safe | No malicious patterns detected |
| cjs/syntax/node/AnPlusB.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Atrule.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/AtrulePrelude.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/AttributeSelector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Block.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Brackets.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/CDC.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/CDO.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/ClassSelector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Combinator.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Comment.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Condition.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Declaration.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/DeclarationList.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Dimension.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Feature.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/FeatureFunction.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/FeatureRange.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Function.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/GeneralEnclosed.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Hash.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/IdSelector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Identifier.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Layer.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/LayerList.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/MediaQuery.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/MediaQueryList.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/NestingSelector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Nth.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Number.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Operator.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Parentheses.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Percentage.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/PseudoClassSelector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/PseudoElementSelector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Ratio.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Raw.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Rule.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Scope.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Selector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/SelectorList.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/String.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/StyleSheet.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/SupportsDeclaration.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/TypeSelector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/UnicodeRange.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Url.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/Value.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/WhiteSpace.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/index-generate.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/index-parse-selector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/index-parse.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/node/index.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/pseudo/index.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/pseudo/lang.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/scope/atrulePrelude.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/scope/default.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/scope/index.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/scope/selector.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/syntax/scope/value.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/tokenizer/OffsetToLocation.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/tokenizer/TokenStream.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/tokenizer/adopt-buffer.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/tokenizer/char-code-definitions.cjs | safe | No malicious patterns detected |
| cjs/tokenizer/index.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/tokenizer/names.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/tokenizer/types.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/tokenizer/utils.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/utils/List.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/utils/clone.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/utils/create-custom-error.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/utils/ident.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/utils/index.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/utils/names.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/utils/string.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/utils/url.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/version.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/walker/create.cjs | safe | Cleared by Jev triage; no further analysis needed |
| cjs/walker/index.cjs | safe | No malicious patterns detected |
| dist/data.cjs | safe | No malicious patterns detected |
| dist/data.js | safe | No malicious patterns detected |
| dist/version.cjs | safe | No malicious patterns detected |
| dist/version.js | safe | No malicious patterns detected |
| lib/convertor/create.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/convertor/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/data.js | safe | No malicious patterns detected; the code only processes and patches CSS data from mdn-data with no network, filesystem, process execution, or obfuscation concerns. |
| lib/definition-syntax/SyntaxError.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/definition-syntax/generate.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/definition-syntax/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/definition-syntax/parse.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/definition-syntax/scanner.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/definition-syntax/walk.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/generator/create.js | safe | No malicious patterns detected; the code is a standard CSS/JS source code generator with no network, filesystem, process, or dynamic execution activity. |
| lib/generator/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/generator/sourceMap.js | safe | No malicious patterns detected; the code is a standard source map generator for CSS/PostCSS that only tracks location data and produces mappings without any network, filesystem, process, or obfuscated behavior. |
| lib/generator/token-before.js | safe | No malicious patterns detected; the file is a pure CSS tokenizer serialization utility with no network, filesystem, process, or dynamic code execution activity. |
| lib/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/Lexer.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/error.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/generic-an-plus-b.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/generic-const.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/generic-urange.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/generic.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/match-graph.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/match.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/prepare-tokens.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/search.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/structure.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/trace.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/lexer/units.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/parser/SyntaxError.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/parser/create.js | safe | This is a legitimate CSS parser implementation (resembling css-tree) with no malicious patterns, network activity, process spawning, or dynamic code execution detected. |
| lib/parser/index.js | safe | No malicious patterns detected |
| lib/parser/parse-selector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/parser/sequence.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/container.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/font-face.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/import.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/layer.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/media.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/nest.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/page.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/scope.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/starting-style.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/atrule/supports.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/config/generator.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/config/lexer.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/config/mix.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/config/parser-selector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/config/parser.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/config/walker.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/create.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/function/expression.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/function/var.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/AnPlusB.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Atrule.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/AtrulePrelude.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/AttributeSelector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Block.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Brackets.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/CDC.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/CDO.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/ClassSelector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Combinator.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Comment.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Condition.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Declaration.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/DeclarationList.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Dimension.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Feature.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/FeatureFunction.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/FeatureRange.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Function.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/GeneralEnclosed.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Hash.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/IdSelector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Identifier.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Layer.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/LayerList.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/MediaQuery.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/MediaQueryList.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/NestingSelector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Nth.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Number.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Operator.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Parentheses.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Percentage.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/PseudoClassSelector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/PseudoElementSelector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Ratio.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Raw.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Rule.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Scope.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Selector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/SelectorList.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/String.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/StyleSheet.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/SupportsDeclaration.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/TypeSelector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/UnicodeRange.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Url.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/Value.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/WhiteSpace.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/index-generate.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/index-parse-selector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/index-parse.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/node/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/pseudo/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/pseudo/lang.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/scope/atrulePrelude.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/scope/default.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/scope/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/scope/selector.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/syntax/scope/value.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/tokenizer/OffsetToLocation.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/tokenizer/TokenStream.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/tokenizer/adopt-buffer.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/tokenizer/char-code-definitions.js | safe | No malicious patterns detected |
| lib/tokenizer/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/tokenizer/names.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/tokenizer/types.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/tokenizer/utils.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/utils/List.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/utils/clone.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/utils/create-custom-error.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/utils/ident.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/utils/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/utils/names.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/utils/string.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/utils/url.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/version.js | safe | No malicious patterns detected |
| lib/walker/create.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/walker/index.js | safe | No malicious patterns detected; the file only imports a factory and configuration to create a walker instance. |
Frequently asked questions
Is css-tree safe to use?
No confirmed malware was found in css-tree@3.2.1, but the review flagged 1 low severity finding for risky patterns worth checking before you rely on it.
Does css-tree contain malware?
No malware was identified in css-tree@3.2.1 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was css-tree checked?
Togoder Security downloaded the published npm package and had an AI model read its 272 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan css-tree together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in css-tree@3.2.1, cost nothing.