# enhanced-resolve@5.25.1 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-06T14:15:53.000Z
- Files reviewed: 54
- Findings: no findings
- Report: https://security.togoder.click/npm/enhanced-resolve
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package enhanced-resolve@5.25.1 on Oct 6, 2026. An AI review of 54 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

No findings.

## Files reviewed

- `lib/AliasFieldPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/AliasPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/AliasUtils.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/AppendPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/CachedInputFileSystem.js` (safe): No malicious patterns detected; the module is a legitimate filesystem caching implementation for the enhanced-resolve package with no network, process execution, or exfiltration behavior.
- `lib/CloneBasenamePlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ConditionalPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/DescriptionFilePlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/DescriptionFileUtils.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/DirectoryExistsPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ExportsFieldPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ExtensionAliasPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/FileExistsPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ImportsFieldPlugin.js` (safe): No malicious patterns detected; this is a legitimate resolver plugin for handling package.json 'imports' fields with caching and path validation.
- `lib/JoinRequestPartPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/JoinRequestPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/LogInfoPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/MainFieldPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ModulesInHierachicDirectoriesPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ModulesInHierarchicalDirectoriesPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ModulesInRootPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ModulesUtils.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/NextPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ParsePlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/PnpPlugin.js` (safe): No malicious patterns detected; the code is a legitimate Webpack resolver plugin for Yarn PnP integration.
- `lib/Resolver.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ResolverFactory.js` (safe): No malicious patterns detected; this is the legitimate enhanced-resolve ResolverFactory from webpack.
- `lib/RestrictionsPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/ResultPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/RootsPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/SelfReferencePlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/SymlinkPlugin.js` (safe): No malicious patterns detected; the file is a legitimate webpack resolver SymlinkPlugin implementation that reads symlinks via fs.readlink and performs no network, credential, process, or dynamic code operations.
- `lib/SyncAsyncFileSystemDecorator.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/TryNextPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/TsconfigPathsPlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/UnsafeCachePlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/UseFilePlugin.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/createInnerContext.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/forEachBail.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/getInnerRequest.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/getPaths.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/index.js` (safe): No malicious patterns detected; the code is a legitimate module resolution library (enhanced-resolve) with no exfiltration, credential harvesting, obfuscation, or suspicious behavior.
- `lib/util/entrypoints.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/fileURLToPath.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/fs.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/graceful-fs-browser.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/identifier.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/memoize.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/module-browser.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/path-browser.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/path.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/process-browser.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/strip-json-comments.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/util/url-browser.js` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology