date-fns@4.4.0 security report

document.write can be dangerous as it may overwrite the entire document if called after page load, and can be used for XSS if the written content is not properly sanitized. Here, the content is conditionally derived from the script's own outerHTML via a regex, which limits the risk.

The file logs a message that date-fns CDN files have moved to @date-fns/cdn, which is a legitimate deprecation notice, not a malicious pattern.

The file is a date-fns locale bundle for Moroccan Arabic (ar-MA). It only contains locale data, formatting/parsing functions, and attaches the locale to window.dateFns. No network, filesystem, process, eval, or credential-access behavior is present. The console.log is a deprecation notice about CDN URL migration, not exfiltration.

The code is a standard date-fns locale bundle for Belarusian. It contains only locale data, formatting/parsing helpers, and a console.log notice about CDN URL migration. No network, filesystem, process, credential, or dynamic execution patterns are present.

The script prints a deprecation notice to the console indicating CDN files have moved to @date-fns/cdn. This is a benign informational message, not a security concern.

The code logs a deprecation warning about CDN files moving to @date-fns/cdn. This is not malicious but indicates the package is outdated.

The code modifies the global window.dateFns object to register the en-CA locale. This is expected behavior for a date-fns CDN locale file and is not malicious.

The file logs a deprecation notice to the console, which is benign and expected for a CDN build artifact.

A console.log message at the end of the file informs users that date-fns CDN files have moved and provides a URL for updated information. This is benign and likely intended as a migration notice.

Contains a console.log deprecation notice and a CDN migration message, which is informational and not malicious.

The IIFE executes at import time and mutates the global window.dateFns object, attaching the hy locale. While this is normal for a CDN bundle, top-level code that runs on import is a category worth noting.

The script logs a message stating CDN files have moved to @date-fns/cdn. This is benign but indicates stale distribution behavior that could be replaced with a redirect.

The code logs a deprecation warning about CDN files moving to @date-fns/cdn. This is benign informational output.

A console.log message about CDN URL migration is present. This is benign and intended to inform developers about updated CDN URLs.

The IIFE runs immediately upon import/load and attaches date-fns locale data to window.dateFns. This is expected behavior for CDN distribution files and does not perform malicious actions.

The code assigns a locale object to window.dateFns at import time, which is expected behavior for a CDN build. It does so by merging with any existing window.dateFns.locale object. This is not data exfiltration or backdoor behavior, but it does mutate the global namespace on import, which could have side effects if other code relies on the same global.

The code logs a deprecation warning that the CDN files have moved to @date-fns/cdn, advising users to update their URLs. This is benign and intended to inform users of a package relocation.

The file registers a Japanese locale on the global window.dateFns object and logs a deprecation notice. This is expected behavior for a CDN distribution file and contains no malicious patterns such as data exfiltration, credential harvesting, obfuscated payloads, or dynamic code execution.

The code logs a console message indicating that date-fns CDN files have moved to @date-fns/cdn. This is a benign informational message, not a security concern.

The file ends with console.log instructing users to migrate to @date-fns/cdn. This is a benign informational message from the library maintainers, not a security concern.

The code logs a deprecation warning to the console indicating that CDN files have moved. This is not malicious and is common for maintaining backwards compatibility.

This is a legitimate date-fns locale file for Serbian (Cyrillic) localization. It contains only locale data (strings, format patterns, match patterns) and pure helper functions for date formatting/parsing. The IIFE at the top is Babel-generated helper boilerplate for object spread. The only side effect is assigning to window.dateFns.locale.sr, which is the intended CDN behavior for this library. The console.log at the end is a deprecation notice pointing users to the new @date-fns/cdn package. No network requests, no filesystem access, no eval/Function constructors, no process spawning, no credential harvesting, no obfuscation.

The code logs a deprecation message indicating CDN files have moved to @date-fns/cdn, which is informational and not malicious.

The script logs a deprecation notice to the console at the top level, which executes on import. This is benign informational output and does not perform any sensitive actions.

The script attaches the 'ta' locale object onto window.dateFns at load time. This is expected behavior for a CDN locale bundle and does not exfiltrate data or execute untrusted code.

The file executes an IIFE immediately upon being loaded. At the end, it assigns the 'uk' locale into the global window.dateFns object. This is expected for a CDN locale bundle but constitutes top-level code that mutates global state at import time.

The script logs a deprecation notice to the console ('date-fns CDN files have moved to @date-fns/cdn...'). This is benign but illustrates that the file performs side effects at load time, which could be abused in modified versions.

An expression -(Math.pow(10, 8) * 24 * 60 * 60 * 1e3); appears standalone near the constructFromSymbol definition. It computes a constant (milliseconds in 10^8 days) but is unused. This kind of stray expression is often characteristic of code that has been mangled or that hides values; it is not malicious here but is a minor code-smell worth noting.

The code uses console.log to display a deprecation notice. This is a benign informational message, not a security risk, but it logs to the console without user control.

Deprecation notice logged to console indicating CDN files moved to @date-fns/cdn; not malicious, just a migration message.

The file logs a message indicating that date-fns CDN files have moved to @date-fns/cdn, advising users to update their URLs. This is informational and not a security risk.