Summary
Togoder Security scanned the npm package d3-array@3.2.4 on Oct 6, 2026. An AI review of 62 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
Complex/obfuscated logic
NPS-C37F8E2DAC9C
The matrix transposition uses a dense, hard-to-read loop structure with multiple variables (i, j, m, n) declared in unusual ways. This could conceal logic, though in this case it appears to be a legitimate (if unconventional) transpose implementation.
Undefined variable usage
NPS-361E00179FA2
The variable 'n' is assigned without declaration inside the function scope (n = matrix.length). In non-strict mode this leaks to global scope; in strict mode it throws a ReferenceError. While not inherently malicious, this pattern can mask bugs or be exploited in certain module wrapping scenarios.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| src/transpose.js | medium | The code appears to be a legitimate matrix transpose utility with no obvious malicious patterns, but has minor code quality issues (undeclared variable) that warrant a warning. |
| dist/d3-array.js | safe | No malicious patterns detected |
| src/array.js | safe | Cleared by Jev triage; no further analysis needed |
| src/ascending.js | safe | Cleared by Jev triage; no further analysis needed |
| src/bin.js | safe | Cleared by Jev triage; no further analysis needed |
| src/bisect.js | safe | Cleared by Jev triage; no further analysis needed |
| src/bisector.js | safe | Cleared by Jev triage; no further analysis needed |
| src/blur.js | safe | Cleared by Jev triage; no further analysis needed |
| src/constant.js | safe | Cleared by Jev triage; no further analysis needed |
| src/count.js | safe | Cleared by Jev triage; no further analysis needed |
| src/cross.js | safe | Cleared by Jev triage; no further analysis needed |
| src/cumsum.js | safe | Cleared by Jev triage; no further analysis needed |
| src/descending.js | safe | Cleared by Jev triage; no further analysis needed |
| src/deviation.js | safe | Cleared by Jev triage; no further analysis needed |
| src/difference.js | safe | Cleared by Jev triage; no further analysis needed |
| src/disjoint.js | safe | Cleared by Jev triage; no further analysis needed |
| src/every.js | safe | Cleared by Jev triage; no further analysis needed |
| src/extent.js | safe | Cleared by Jev triage; no further analysis needed |
| src/filter.js | safe | Cleared by Jev triage; no further analysis needed |
| src/fsum.js | safe | Cleared by Jev triage; no further analysis needed |
| src/greatest.js | safe | Cleared by Jev triage; no further analysis needed |
| src/greatestIndex.js | safe | Cleared by Jev triage; no further analysis needed |
| src/group.js | safe | Cleared by Jev triage; no further analysis needed |
| src/groupSort.js | safe | Cleared by Jev triage; no further analysis needed |
| src/identity.js | safe | Cleared by Jev triage; no further analysis needed |
Show 37 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| src/index.js | safe | Cleared by Jev triage; no further analysis needed |
| src/intersection.js | safe | Cleared by Jev triage; no further analysis needed |
| src/least.js | safe | Cleared by Jev triage; no further analysis needed |
| src/leastIndex.js | safe | Cleared by Jev triage; no further analysis needed |
| src/map.js | safe | Cleared by Jev triage; no further analysis needed |
| src/max.js | safe | Cleared by Jev triage; no further analysis needed |
| src/maxIndex.js | safe | Cleared by Jev triage; no further analysis needed |
| src/mean.js | safe | Cleared by Jev triage; no further analysis needed |
| src/median.js | safe | Cleared by Jev triage; no further analysis needed |
| src/merge.js | safe | Cleared by Jev triage; no further analysis needed |
| src/min.js | safe | Cleared by Jev triage; no further analysis needed |
| src/minIndex.js | safe | Cleared by Jev triage; no further analysis needed |
| src/mode.js | safe | Cleared by Jev triage; no further analysis needed |
| src/nice.js | safe | Cleared by Jev triage; no further analysis needed |
| src/number.js | safe | Cleared by Jev triage; no further analysis needed |
| src/pairs.js | safe | Cleared by Jev triage; no further analysis needed |
| src/permute.js | safe | Cleared by Jev triage; no further analysis needed |
| src/quantile.js | safe | No malicious patterns detected |
| src/quickselect.js | safe | Cleared by Jev triage; no further analysis needed |
| src/range.js | safe | Cleared by Jev triage; no further analysis needed |
| src/rank.js | safe | Cleared by Jev triage; no further analysis needed |
| src/reduce.js | safe | Cleared by Jev triage; no further analysis needed |
| src/reverse.js | safe | Cleared by Jev triage; no further analysis needed |
| src/scan.js | safe | Cleared by Jev triage; no further analysis needed |
| src/shuffle.js | safe | Cleared by Jev triage; no further analysis needed |
| src/some.js | safe | Cleared by Jev triage; no further analysis needed |
| src/sort.js | safe | Cleared by Jev triage; no further analysis needed |
| src/subset.js | safe | Cleared by Jev triage; no further analysis needed |
| src/sum.js | safe | Cleared by Jev triage; no further analysis needed |
| src/superset.js | safe | Cleared by Jev triage; no further analysis needed |
| src/threshold/freedmanDiaconis.js | safe | Cleared by Jev triage; no further analysis needed |
| src/threshold/scott.js | safe | Cleared by Jev triage; no further analysis needed |
| src/threshold/sturges.js | safe | Cleared by Jev triage; no further analysis needed |
| src/ticks.js | safe | Cleared by Jev triage; no further analysis needed |
| src/union.js | safe | Cleared by Jev triage; no further analysis needed |
| src/variance.js | safe | Cleared by Jev triage; no further analysis needed |
| src/zip.js | safe | Cleared by Jev triage; no further analysis needed |
Scanned versions of d3-array
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 3.2.4 | Needs review | 62 | Oct 6, 2026 |
Frequently asked questions
Is d3-array safe to use?
No confirmed malware was found in d3-array@3.2.4, but the review flagged 2 low severity findings for risky patterns worth checking before you rely on it.
Does d3-array contain malware?
No malware was identified in d3-array@3.2.4 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was d3-array checked?
Togoder Security downloaded the published npm package and had an AI model read its 62 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan d3-array together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in d3-array@3.2.4, cost nothing.