# d3-shape@3.2.0 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-06T14:14:57.000Z
- Files reviewed: 61
- Findings: no findings
- Report: https://security.togoder.click/npm/d3-shape
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package d3-shape@3.2.0 on Oct 6, 2026. An AI review of 61 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

No findings.

## Files reviewed

- `dist/d3-shape.js` (safe): This is the legitimate d3-shape v3.2.0 library from the official d3.js project containing only geometric and path-generation utilities with no malicious patterns, network activity, dynamic code execution, or credential access.
- `src/arc.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/area.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/areaRadial.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/array.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/constant.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/basis.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/basisClosed.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/basisOpen.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/bump.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/bundle.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/cardinal.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/cardinalClosed.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/cardinalOpen.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/catmullRom.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/catmullRomClosed.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/catmullRomOpen.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/linear.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/linearClosed.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/monotone.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/natural.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/radial.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/curve/step.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/descending.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/identity.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/line.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/lineRadial.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/link.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/math.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/noop.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/offset/diverging.js` (safe): No malicious patterns detected; the code is a standard d3-shape diverging stack offset implementation with no network, filesystem, process, or dynamic execution behavior.
- `src/offset/expand.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/offset/none.js` (safe): No malicious patterns detected; the code is a benign d3-shape stack offset utility with no network, filesystem, process, or dynamic code execution behavior.
- `src/offset/silhouette.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/offset/wiggle.js` (safe): No malicious patterns detected; the code is a standard d3.js stack offset algorithm with no network, filesystem, or process activity.
- `src/order/appearance.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/order/ascending.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/order/descending.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/order/insideOut.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/order/none.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/order/reverse.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/path.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/pie.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/point.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/pointRadial.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/stack.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/asterisk.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/circle.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/cross.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/diamond.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/diamond2.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/plus.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/square.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/square2.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/star.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/times.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/triangle.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/triangle2.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/symbol/wye.js` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology