# debug@3.2.7 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-06T14:16:19.000Z
- Files reviewed: 5
- Findings: no findings
- Report: https://security.togoder.click/npm/debug@3.2.7
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package debug@3.2.7 on Oct 6, 2026. An AI review of 5 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

No findings.

## Files reviewed

- `node.js` (safe): No malicious patterns detected; the file is a simple re-export of a local module.
- `src/browser.js` (safe): No malicious patterns detected; this is the standard debug package browser implementation with no data exfiltration, code execution, or suspicious activity.
- `src/common.js` (safe): No malicious patterns detected; this is the standard source for the debug package's common logic.
- `src/index.js` (safe): No malicious patterns detected; the code is a standard environment detection shim that conditionally loads browser or node modules.
- `src/node.js` (safe): This is the legitimate Node.js implementation of the 'debug' npm package, with no malicious patterns detected.

## Version ranges

None of the 5 scanned versions of debug are flagged high or critical. The latest scanned version, 4.4.3, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 4.4.3 (`4.4.3`): clean
- 4.4.1 (`4.4.1`): not scanned
- 4.3.7 (`4.3.7`): clean
- 4.3.5 (`4.3.5`): not scanned
- 3.2.7 – 4.3.4 (`>=3.2.7 <=4.3.4`): clean
- 2.6.9 (`2.6.9`): medium

## Scanned versions

- [4.4.3](https://security.togoder.click/npm/debug@4.4.3): safe, 2026-10-04T14:37:25.000Z
- [4.3.7](https://security.togoder.click/npm/debug@4.3.7): safe, 2026-10-04T16:28:21.000Z
- [4.3.4](https://security.togoder.click/npm/debug@4.3.4): safe, 2026-10-04T16:08:36.000Z
- [3.2.7](https://security.togoder.click/npm/debug@3.2.7): safe, 2026-10-06T14:16:19.000Z
- [2.6.9](https://security.togoder.click/npm/debug@2.6.9): medium, 2026-10-04T16:27:08.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology