Summary
Togoder Security scanned the npm package fast-json-stable-stringify@2.1.0 on Oct 6, 2026. An AI review of 6 source files produced 1 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
dynamic module loading
NPS-B255C430D67F
The code uses require(name) where 'name' is a computed value from the stringifyPackages object keys. While the keys are currently hardcoded to known package names, this pattern could allow loading arbitrary modules if the object were modified or if the file were tampered with. It is a potential supply chain risk if an attacker can influence the package names.
top-level code execution
NPS-12E45A92FB0B
The benchmark suite runs immediately upon import (suite.run()), which could cause unexpected side effects if the module is imported by other code. However, this is typical for benchmark scripts and not inherently malicious.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| benchmark/index.js | medium | The benchmark script dynamically loads packages based on a hardcoded list and runs a performance test at import time; while not overtly malicious, the dynamic require pattern and top-level execution pose minor supply chain and side-effect risks. |
| example/key_cmp.js | safe | Cleared by Jev triage; no further analysis needed |
| example/nested.js | safe | Cleared by Jev triage; no further analysis needed |
| example/str.js | safe | Cleared by Jev triage; no further analysis needed |
| example/value_cmp.js | safe | Cleared by Jev triage; no further analysis needed |
| index.js | safe | Cleared by Jev triage; no further analysis needed |
Frequently asked questions
Is fast-json-stable-stringify safe to use?
No confirmed malware was found in fast-json-stable-stringify@2.1.0, but the review flagged 1 medium, 1 low severity findings for risky patterns worth checking before you rely on it.
Does fast-json-stable-stringify contain malware?
No malware was identified in fast-json-stable-stringify@2.1.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was fast-json-stable-stringify checked?
Togoder Security downloaded the published npm package and had an AI model read its 6 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan fast-json-stable-stringify together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in fast-json-stable-stringify@2.1.0, cost nothing.