# flat-cache@6.1.23 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:16:40.000Z
- Files reviewed: 2
- Findings: 2 medium, 2 low severity findings
- Report: https://security.togoder.click/npm/flat-cache
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package flat-cache@6.1.23 on Oct 6, 2026. An AI review of 2 source files produced 2 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Path Traversal / Arbitrary File Write

Finding ID: `NPS-E64088E7017E`

File: `dist/index.mjs`

The cacheId and cacheDir options are concatenated directly into a file path without sanitization in load(), save(), and cacheFilePath. A malicious or user-controlled cacheId containing '../' sequences could cause the cache to be read from or written to arbitrary locations on the filesystem outside the intended cache directory.

### [medium] Arbitrary File Deletion

Finding ID: `NPS-72D9017E57CA`

File: `dist/index.mjs`

The clearAll() function accepts a cacheDirectory argument and passes it directly to fs.rmSync with recursive:true and force:true. If an attacker can control this argument, they could delete arbitrary directories on the filesystem. destroy(includeCacheDirectory=true) similarly performs recursive rmSync on cacheDirPath derived from user-controllable cacheDir.

### [low] Unsafe Deserialization / Custom Serializer

Finding ID: `NPS-083EBD757C3A`

File: `dist/index.mjs`

The constructor accepts options.deserialize and options.serialize, which are assigned to _parse and _stringify and used to deserialize cache files loaded from disk via flatted.parse by default. While flatted is safer than eval, allowing arbitrary custom deserializers could enable code execution if a consumer passes an unsafe function. Default use of flatted.parse on disk content is a deserialization surface.

### [low] Unbounded File Read / DoS

Finding ID: `NPS-F6BA0466C28B`

File: `dist/index.mjs`

loadFile and loadFileStream read entire cache files into memory without size limits. A very large cache file could cause memory exhaustion (DoS).

## Files reviewed

- `dist/index.mjs` (medium): This is a legitimate flat-file caching library with no overtly malicious patterns, but it has path traversal and arbitrary file deletion risks when cacheId/cacheDir/clearAll arguments are attacker-controlled, and a deserialization surface via configurable parse/stringify.
- `dist/index.cjs` (safe): No malicious patterns detected; the code is a legitimate flat-file caching library using standard Node.js fs/path modules without exfiltration, credential harvesting, obfuscation, or process spawning.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology