Summary
Togoder Security scanned the npm package destr@2.0.5 on Oct 4, 2026. An AI review of 3 source files produced 2 low severity findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
Findings 2
Regular expression denial of service (ReDoS) potential
NPS-643A5B204E09
The regular expressions suspectProtoRx and suspectConstructorRx are complex but bounded, used only on JSON-like strings. No catastrophic backtracking evident, but worth noting for untrusted input.
Prototype pollution prevention
NPS-52DC7FF4C1B0
The code explicitly checks for and drops __proto__ and constructor keys during JSON parsing to prevent prototype pollution attacks. This is a security feature, not a vulnerability.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/index.cjs | safe | The code is a safe JSON parser with explicit prototype pollution guards; no malicious patterns detected. |
| dist/index.mjs | safe | No malicious patterns detected; the code is a defensive JSON parsing utility that explicitly guards against prototype pollution. |
| lib/index.cjs | safe | Cleared by Jev triage; no further analysis needed |
Frequently asked questions
Is destr safe to use?
Our AI source review of destr@2.0.5 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does destr contain malware?
No malware was identified in destr@2.0.5 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was destr checked?
Togoder Security downloaded the published npm package and had an AI model read its 3 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan destr together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in destr@2.0.5, cost nothing.