Summary
Togoder Security scanned the npm package event-target-shim@5.0.1 on Oct 4, 2026. An AI review of 3 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
Dynamic code execution
NPS-1D3DE343A808
The code uses the Function constructor ('Function("return this")()') to obtain a reference to the global object. While this is a common UMD pattern and not inherently malicious, use of dynamic code generation (new Function/eval) is a potential risk indicator and may be disallowed in strict CSP environments.
Top-level side effects / global pollution
NPS-B603AC659F08
The UMD wrapper executes immediately on load, attaches to the global object, and mutates window.Event and window.EventTarget prototypes via Object.setPrototypeOf. This runs at import time and modifies global built-ins, which could affect other code in unexpected ways.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/event-target-shim.umd.js | medium | This appears to be a legitimate, non-malicious polyfill/shim for EventTarget; the only minor concern is use of the Function constructor for global object detection, a common UMD pattern. |
| dist/event-target-shim.js | safe | This is the well-known event-target-shim polyfill library; no malicious patterns, data exfiltration, credential harvesting, obfuscation, or suspicious behavior were detected. |
| dist/event-target-shim.mjs | safe | No malicious patterns detected; the code is a legitimate event-target shim library with no network, filesystem, process, or obfuscated behavior. |
Frequently asked questions
Is event-target-shim safe to use?
No confirmed malware was found in event-target-shim@5.0.1, but the review flagged 2 low severity findings for risky patterns worth checking before you rely on it.
Does event-target-shim contain malware?
No malware was identified in event-target-shim@5.0.1 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was event-target-shim checked?
Togoder Security downloaded the published npm package and had an AI model read its 3 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan event-target-shim together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in event-target-shim@5.0.1, cost nothing.