# d3-array@3.2.4 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:14:57.000Z
- Files reviewed: 62
- Findings: 2 low severity findings
- Report: https://security.togoder.click/npm/d3-array
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package d3-array@3.2.4 on Oct 6, 2026. An AI review of 62 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] Complex/obfuscated logic

Finding ID: `NPS-C37F8E2DAC9C`

File: `src/transpose.js`

The matrix transposition uses a dense, hard-to-read loop structure with multiple variables (i, j, m, n) declared in unusual ways. This could conceal logic, though in this case it appears to be a legitimate (if unconventional) transpose implementation.

### [low] Undefined variable usage

Finding ID: `NPS-361E00179FA2`

File: `src/transpose.js:4`

The variable 'n' is assigned without declaration inside the function scope (n = matrix.length). In non-strict mode this leaks to global scope; in strict mode it throws a ReferenceError. While not inherently malicious, this pattern can mask bugs or be exploited in certain module wrapping scenarios.

## Files reviewed

- `src/transpose.js` (medium): The code appears to be a legitimate matrix transpose utility with no obvious malicious patterns, but has minor code quality issues (undeclared variable) that warrant a warning.
- `dist/d3-array.js` (safe): No malicious patterns detected
- `src/array.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/ascending.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/bin.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/bisect.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/bisector.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/blur.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/constant.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/count.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/cross.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/cumsum.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/descending.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/deviation.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/difference.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/disjoint.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/every.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/extent.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/filter.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/fsum.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/greatest.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/greatestIndex.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/group.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/groupSort.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/identity.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/intersection.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/least.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/leastIndex.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/map.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/max.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/maxIndex.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/mean.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/median.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/merge.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/min.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/minIndex.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/mode.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/nice.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/number.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/pairs.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/permute.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/quantile.js` (safe): No malicious patterns detected
- `src/quickselect.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/range.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/rank.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/reduce.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/reverse.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/scan.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/shuffle.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/some.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/sort.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/subset.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/sum.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/superset.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/threshold/freedmanDiaconis.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/threshold/scott.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/threshold/sturges.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/ticks.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/union.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/variance.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/zip.js` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology