Summary
Togoder Security scanned the npm package diff@8.0.4 on Oct 6, 2026. An AI review of 44 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
0
critical
0
high
0
medium
0
low
Findings
No findings. The reviewer saw nothing malicious or risky in this version.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/diff.js | safe | No malicious patterns detected; the code is a standard diff/patch library (jsdiff) with no network, filesystem, process, or dynamic code execution risks. |
| eslint.config.mjs | safe | Cleared by Jev triage; no further analysis needed |
| libcjs/convert/dmp.js | safe | Cleared by Jev triage; no further analysis needed |
| libcjs/convert/xml.js | safe | Cleared by Jev triage; no further analysis needed |
| libcjs/diff/array.js | safe | No malicious patterns detected; the code is a standard TypeScript-compiled array diff utility with no network, filesystem, process, or dynamic execution behavior. |
| libcjs/diff/base.js | safe | No malicious patterns detected; this is a legitimate diff algorithm implementation. |
| libcjs/diff/character.js | safe | No malicious patterns detected; the code is a standard character diff implementation with only local module imports and no network, filesystem, or process activity. |
| libcjs/diff/css.js | safe | No malicious patterns detected; the file implements a simple CSS diff utility with no suspicious network, filesystem, process, or dynamic code execution behavior. |
| libcjs/diff/json.js | safe | No malicious patterns detected; the code implements JSON diffing and canonicalization without network, filesystem, process, or dynamic code execution behavior. |
| libcjs/diff/line.js | safe | No malicious patterns detected; this is a standard line-diffing utility from the jsdiff library with no network, filesystem, process, or obfuscated code. |
| libcjs/diff/sentence.js | safe | No malicious patterns detected; the code is a standard sentence-level text diff implementation with no network, filesystem, process, or dynamic execution behavior. |
| libcjs/diff/word.js | safe | No malicious patterns detected; this is a legitimate word-diff library implementation with no network, filesystem, process, or obfuscated code. |
| libcjs/index.js | safe | No malicious patterns detected |
| libcjs/patch/apply.js | safe | No malicious patterns detected; the code is a pure unified diff patch application utility with no network, filesystem, process, or dynamic code execution behavior. |
| libcjs/patch/create.js | safe | No malicious patterns detected; the code is a standard unified diff/patch generation utility with no network, filesystem, process, or dynamic execution capabilities. |
| libcjs/patch/line-endings.js | safe | No malicious patterns detected; the code only performs pure line-ending normalization on patch data with no I/O, network, process, or dynamic execution. |
| libcjs/patch/parse.js | safe | Cleared by Jev triage; no further analysis needed |
| libcjs/patch/reverse.js | safe | No malicious patterns detected; the code is a benign patch reversal utility with no network, filesystem, or process manipulation. |
| libcjs/types.js | safe | No malicious patterns detected |
| libcjs/util/array.js | safe | Cleared by Jev triage; no further analysis needed |
| libcjs/util/distance-iterator.js | safe | Cleared by Jev triage; no further analysis needed |
| libcjs/util/params.js | safe | Cleared by Jev triage; no further analysis needed |
| libcjs/util/string.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/convert/dmp.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/convert/xml.js | safe | Cleared by Jev triage; no further analysis needed |
Show 19 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| libesm/diff/array.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/diff/base.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/diff/character.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/diff/css.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/diff/json.js | safe | No malicious patterns detected; the code is a standard JSON diff/canonicalization utility with no network, file system, process, or dynamic execution behavior. |
| libesm/diff/line.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/diff/sentence.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/diff/word.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/index.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/patch/apply.js | safe | No malicious patterns detected in the patch application logic; the code is a standard implementation of unified diff patching without network, filesystem, or execution side effects. |
| libesm/patch/create.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/patch/line-endings.js | safe | The code only manipulates patch objects and line endings; no malicious patterns, network activity, credential access, or code execution were detected. |
| libesm/patch/parse.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/patch/reverse.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/types.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/util/array.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/util/distance-iterator.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/util/params.js | safe | Cleared by Jev triage; no further analysis needed |
| libesm/util/string.js | safe | Cleared by Jev triage; no further analysis needed |
Affected version ranges
None of the 2 scanned versions of diff are flagged high or critical. The latest scanned version, 8.0.4, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.
4.0.28.0.4
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 8.0.4 | No issues | 1 | 8.0.4 | |
| 4.0.4 – 8.0.3 | Not scanned | 3 | >=4.0.4 <=8.0.3 | |
| 4.0.2 | Needs review | 1 | 4.0.2 | Dynamic code transformation and registration; Import-time code execution |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of diff
Frequently asked questions
Is diff safe to use?
Our AI source review of diff@8.0.4 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does diff contain malware?
No malware was identified in diff@8.0.4 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was diff checked?
Togoder Security downloaded the published npm package and had an AI model read its 44 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan diff together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in diff@8.0.4, cost nothing.