Summary
Togoder Security scanned the npm package d3-shape@3.2.0 on Oct 6, 2026. An AI review of 61 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
0
critical
0
high
0
medium
0
low
Findings
No findings. The reviewer saw nothing malicious or risky in this version.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/d3-shape.js | safe | This is the legitimate d3-shape v3.2.0 library from the official d3.js project containing only geometric and path-generation utilities with no malicious patterns, network activity, dynamic code execution, or credential access. |
| src/arc.js | safe | Cleared by Jev triage; no further analysis needed |
| src/area.js | safe | Cleared by Jev triage; no further analysis needed |
| src/areaRadial.js | safe | Cleared by Jev triage; no further analysis needed |
| src/array.js | safe | Cleared by Jev triage; no further analysis needed |
| src/constant.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/basis.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/basisClosed.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/basisOpen.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/bump.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/bundle.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/cardinal.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/cardinalClosed.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/cardinalOpen.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/catmullRom.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/catmullRomClosed.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/catmullRomOpen.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/linear.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/linearClosed.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/monotone.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/natural.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/radial.js | safe | Cleared by Jev triage; no further analysis needed |
| src/curve/step.js | safe | Cleared by Jev triage; no further analysis needed |
| src/descending.js | safe | Cleared by Jev triage; no further analysis needed |
| src/identity.js | safe | Cleared by Jev triage; no further analysis needed |
Show 36 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| src/index.js | safe | Cleared by Jev triage; no further analysis needed |
| src/line.js | safe | Cleared by Jev triage; no further analysis needed |
| src/lineRadial.js | safe | Cleared by Jev triage; no further analysis needed |
| src/link.js | safe | Cleared by Jev triage; no further analysis needed |
| src/math.js | safe | Cleared by Jev triage; no further analysis needed |
| src/noop.js | safe | Cleared by Jev triage; no further analysis needed |
| src/offset/diverging.js | safe | No malicious patterns detected; the code is a standard d3-shape diverging stack offset implementation with no network, filesystem, process, or dynamic execution behavior. |
| src/offset/expand.js | safe | Cleared by Jev triage; no further analysis needed |
| src/offset/none.js | safe | No malicious patterns detected; the code is a benign d3-shape stack offset utility with no network, filesystem, process, or dynamic code execution behavior. |
| src/offset/silhouette.js | safe | Cleared by Jev triage; no further analysis needed |
| src/offset/wiggle.js | safe | No malicious patterns detected; the code is a standard d3.js stack offset algorithm with no network, filesystem, or process activity. |
| src/order/appearance.js | safe | Cleared by Jev triage; no further analysis needed |
| src/order/ascending.js | safe | Cleared by Jev triage; no further analysis needed |
| src/order/descending.js | safe | Cleared by Jev triage; no further analysis needed |
| src/order/insideOut.js | safe | Cleared by Jev triage; no further analysis needed |
| src/order/none.js | safe | Cleared by Jev triage; no further analysis needed |
| src/order/reverse.js | safe | Cleared by Jev triage; no further analysis needed |
| src/path.js | safe | Cleared by Jev triage; no further analysis needed |
| src/pie.js | safe | Cleared by Jev triage; no further analysis needed |
| src/point.js | safe | Cleared by Jev triage; no further analysis needed |
| src/pointRadial.js | safe | Cleared by Jev triage; no further analysis needed |
| src/stack.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/asterisk.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/circle.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/cross.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/diamond.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/diamond2.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/plus.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/square.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/square2.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/star.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/times.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/triangle.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/triangle2.js | safe | Cleared by Jev triage; no further analysis needed |
| src/symbol/wye.js | safe | Cleared by Jev triage; no further analysis needed |
Frequently asked questions
Is d3-shape safe to use?
Our AI source review of d3-shape@3.2.0 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does d3-shape contain malware?
No malware was identified in d3-shape@3.2.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was d3-shape checked?
Togoder Security downloaded the published npm package and had an AI model read its 61 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan d3-shape together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in d3-shape@3.2.0, cost nothing.