# es-abstract@1.24.2 security report (npm) - Verdict: **Needs review** (risk level: medium) - Scanned: 2026-10-06T14:16:06.000Z - Files reviewed: 2473 - Findings: 4 low severity findings - Report: https://security.togoder.click/npm/es-abstract - Source: Togoder Security (https://security.togoder.click), AI source-code review ## Summary Togoder Security scanned the npm package es-abstract@1.24.2 on Oct 6, 2026. An AI review of 2473 source files produced 4 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware. ## Findings ### [low] Informational Finding ID: `NPS-BB4379A3B0E2` File: `2018/AsyncIteratorClose.js:41` Commented-out 'process.exit(42);' appears in a Promise executor, but it is inert (inside a comment) and has no runtime effect. ### [low] Potential module resolution abuse Finding ID: `NPS-EFB795E82F40` File: `2018/CreateAsyncFromSyncIterator.js:10` The module loads various internal modules using relative paths and 'get-intrinsic'/'call-bound'. While these appear legitimate for this polyfill, the use of 'GetIntrinsic' with '%AsyncFromSyncIteratorPrototype%' and '%Promise%' could theoretically be used to access or modify intrinsic objects. This is standard polyfill behavior but requires trust in the package ecosystem. ### [low] Informational Finding ID: `NPS-BB4379A3B0E2` File: `2019/AsyncIteratorClose.js:41` Commented-out 'process.exit(42);' appears in a Promise executor, but it is inert (inside a comment) and has no runtime effect. ### [low] Informational Finding ID: `NPS-BB4379A3B0E2` File: `2020/AsyncIteratorClose.js:41` Commented-out 'process.exit(42);' appears in a Promise executor, but it is inert (inside a comment) and has no runtime effect. ## Files reviewed - `2018/CreateAsyncFromSyncIterator.js` (medium): The code is a legitimate ECMAScript specification polyfill for CreateAsyncFromSyncIterator with no clear malicious patterns, but it relies on intrinsic object access which warrants low-level caution. - `2015/AbstractEqualityComparison.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/AbstractRelationalComparison.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/AdvanceStringIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ArrayCreate.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ArraySetLength.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ArraySpeciesCreate.js` (safe): No malicious patterns detected; the code is a straightforward ECMAScript specification implementation without any security-relevant issues. - `2015/Call.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CanonicalNumericIndexString.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/Canonicalize.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CharacterRange.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CompletePropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CompletionRecord.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CreateDataProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CreateDataPropertyOrThrow.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CreateHTML.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CreateIterResultObject.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CreateListFromArrayLike.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/CreateMethodProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/DateFromTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/Day.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/DayFromYear.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/DayWithinYear.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/DaysInYear.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/DefinePropertyOrThrow.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/DeletePropertyOrThrow.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/DetachArrayBuffer.js` (safe): No malicious patterns detected; the code implements a standard ECMAScript DetachArrayBuffer helper using safe built-in APIs. - `2015/EnumerableOwnNames.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/FromPropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/Get.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/GetGlobalObject.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/GetIterator.js` (safe): No malicious patterns detected; the file is a standard ECMAScript spec implementation of GetIterator with no network, filesystem, or dynamic code execution concerns. - `2015/GetMethod.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/GetOwnPropertyKeys.js` (safe): No malicious patterns detected; the code is a legitimate implementation of the ECMAScript GetOwnPropertyKeys abstract operation with no suspicious behavior. - `2015/GetPrototypeFromConstructor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/GetSubstitution.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/GetV.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/GetValueFromBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/HasOwnProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/HasProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/HourFromTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/InLeapYear.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/InstanceofOperator.js` (safe): No malicious patterns detected - `2015/IntegerIndexedElementGet.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IntegerIndexedElementSet.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/InternalizeJSONProperty.js` (safe): This is a legitimate implementation of the ECMAScript InternalizeJSONProperty abstract operation with no malicious patterns detected. - `2015/Invoke.js` (safe): No malicious patterns detected; the code is a clean implementation of the ECMAScript Invoke abstract operation with proper input validation. - `2015/IsAccessorDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsArray.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsCallable.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsCompatiblePropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsConcatSpreadable.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsConstructor.js` (safe): No malicious patterns detected; the code is a legitimate utility for checking constructor status using standard ECMAScript introspection techniques. - `2015/IsDataDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsDetachedBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsExtensible.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsGenericDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsInteger.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsPromise.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsPropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsPropertyKey.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsRegExp.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IsWordChar.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IteratorClose.js` (safe): No malicious patterns detected; the code is a standard implementation of the ECMAScript IteratorClose abstract operation. - `2015/IteratorComplete.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IteratorNext.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IteratorStep.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/IteratorValue.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/MakeDate.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/MakeDay.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/MakeTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/MinFromTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/MonthFromTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/NewPromiseCapability.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/NormalCompletion.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ObjectCreate.js` (safe): No malicious patterns detected; the code is a standard ES-spec ObjectCreate implementation using legitimate dependencies. - `2015/ObjectDefineProperties.js` (safe): This is a standard ECMAScript specification implementation (Object.defineProperties) with no malicious patterns detected. - `2015/OrdinaryCreateFromConstructor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/OrdinaryDefineOwnProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/OrdinaryGetOwnProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/OrdinaryHasInstance.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/OrdinaryHasProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/QuoteJSONString.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/RegExpCreate.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/RegExpExec.js` (safe): No malicious patterns detected - `2015/RequireObjectCoercible.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/SameValue.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/SameValueZero.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/SecFromTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/Set.js` (safe): No malicious patterns detected - `2015/SetFunctionName.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/SetIntegrityLevel.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/SetValueInBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/SpeciesConstructor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/SplitMatch.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/StrictEqualityComparison.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/StringCreate.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/StringGetIndexProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/SymbolDescriptiveString.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/TestIntegrityLevel.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/TimeClip.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/TimeFromYear.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/TimeWithinDay.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToBoolean.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToDateString.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToInt16.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToInt32.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToInt8.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToInteger.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToLength.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToNumber.js` (safe): No malicious patterns detected - `2015/ToObject.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToPrimitive.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToPropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToPropertyKey.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToString.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToUint16.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToUint32.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToUint8.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ToUint8Clamp.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/Type.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ValidateAndApplyPropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/ValidateTypedArray.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/WeekDay.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/YearFromTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/abs.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/floor.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/max.js` (safe): No malicious patterns detected - `2015/min.js` (safe): No malicious patterns detected - `2015/modulo.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/msFromTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/tables/typed-array-objects.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/thisBooleanValue.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/thisNumberValue.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/thisStringValue.js` (safe): Cleared by Jev triage; no further analysis needed - `2015/thisTimeValue.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/AbstractEqualityComparison.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/AbstractRelationalComparison.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/AdvanceStringIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/ArrayCreate.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/ArraySetLength.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/ArraySpeciesCreate.js` (safe): No malicious patterns detected; the code is a straightforward ECMAScript specification implementation without any security-relevant issues. - `2016/Call.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CanonicalNumericIndexString.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/Canonicalize.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CharacterRange.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CompletePropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CompletionRecord.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CreateDataProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CreateDataPropertyOrThrow.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CreateHTML.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CreateIterResultObject.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CreateListFromArrayLike.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/CreateMethodProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/DateFromTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/Day.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/DayFromYear.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/DayWithinYear.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/DaysInYear.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/DefinePropertyOrThrow.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/DeletePropertyOrThrow.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/DetachArrayBuffer.js` (safe): No malicious patterns detected; the code implements a standard ECMAScript DetachArrayBuffer helper using safe built-in APIs. - `2016/EnumerableOwnNames.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/FromPropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/Get.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/GetGlobalObject.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/GetIterator.js` (safe): No malicious patterns detected; the file is a standard ECMAScript spec implementation of GetIterator with no network, filesystem, or dynamic code execution concerns. - `2016/GetMethod.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/GetOwnPropertyKeys.js` (safe): No malicious patterns detected; the code is a legitimate implementation of the ECMAScript GetOwnPropertyKeys abstract operation with no suspicious behavior. - `2016/GetPrototypeFromConstructor.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/GetSubstitution.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/GetV.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/GetValueFromBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/HasOwnProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/HasProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/HourFromTime.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/InLeapYear.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/InstanceofOperator.js` (safe): No malicious patterns detected - `2016/IntegerIndexedElementGet.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IntegerIndexedElementSet.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/InternalizeJSONProperty.js` (safe): This is a legitimate implementation of the ECMAScript InternalizeJSONProperty abstract operation with no malicious patterns detected. - `2016/Invoke.js` (safe): No malicious patterns detected; the code is a clean implementation of the ECMAScript Invoke abstract operation with proper input validation. - `2016/IsAccessorDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsArray.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsCallable.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsCompatiblePropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsConcatSpreadable.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsConstructor.js` (safe): No malicious patterns detected; the code is a legitimate utility for checking constructor status using standard ECMAScript introspection techniques. - `2016/IsDataDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsDetachedBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsExtensible.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsGenericDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsInteger.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsPromise.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsPropertyDescriptor.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsPropertyKey.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsRegExp.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IsWordChar.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IterableToArrayLike.js` (safe): Cleared by Jev triage; no further analysis needed - `2016/IteratorClose.js` (safe): No malicious patterns detected; the code is a standard implementation of the ECMAScript IteratorClose abstract operation. AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology