Summary
Togoder Security scanned the npm package fastest-levenshtein@1.0.16 on Oct 6, 2026. An AI review of 5 source files produced 2 low severity findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
Findings 2
File System Write
NPS-F6DAF1E975B1
The benchmark writes a data.json file to the current working directory if it doesn't exist. This is standard for benchmarks to persist test data between runs and is not malicious, but it does modify the file system outside the package scope.
File System Read
NPS-4D930707D5CF
Reads data.json from the current working directory. This is expected behavior for a benchmark script.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| bench.js | safe | This is a legitimate benchmark script comparing Levenshtein distance libraries; it only performs local file I/O for caching test data and contains no malicious patterns. |
| esm/mod.js | safe | No malicious patterns detected; the code is a standard implementation of the Myers string distance algorithm with no network, filesystem, or process operations. |
| mod.js | safe | No malicious patterns detected; the code is a standard implementation of the Myers string distance algorithm with no network, filesystem, process execution, or obfuscation concerns. |
| test.js | safe | No malicious patterns detected |
| test.ts | safe | Cleared by Jev triage; no further analysis needed |
Frequently asked questions
Is fastest-levenshtein safe to use?
Our AI source review of fastest-levenshtein@1.0.16 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does fastest-levenshtein contain malware?
No malware was identified in fastest-levenshtein@1.0.16 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was fastest-levenshtein checked?
Togoder Security downloaded the published npm package and had an AI model read its 5 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan fastest-levenshtein together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in fastest-levenshtein@1.0.16, cost nothing.