Summary
Togoder Security scanned the npm package flat-cache@6.1.23 on Oct 6, 2026. An AI review of 2 source files produced 2 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 4
Path Traversal / Arbitrary File Write
NPS-E64088E7017E
The cacheId and cacheDir options are concatenated directly into a file path without sanitization in load(), save(), and cacheFilePath. A malicious or user-controlled cacheId containing '../' sequences could cause the cache to be read from or written to arbitrary locations on the filesystem outside the intended cache directory.
Arbitrary File Deletion
NPS-72D9017E57CA
The clearAll() function accepts a cacheDirectory argument and passes it directly to fs.rmSync with recursive:true and force:true. If an attacker can control this argument, they could delete arbitrary directories on the filesystem. destroy(includeCacheDirectory=true) similarly performs recursive rmSync on cacheDirPath derived from user-controllable cacheDir.
Unsafe Deserialization / Custom Serializer
NPS-083EBD757C3A
The constructor accepts options.deserialize and options.serialize, which are assigned to _parse and _stringify and used to deserialize cache files loaded from disk via flatted.parse by default. While flatted is safer than eval, allowing arbitrary custom deserializers could enable code execution if a consumer passes an unsafe function. Default use of flatted.parse on disk content is a deserialization surface.
Unbounded File Read / DoS
NPS-F6BA0466C28B
loadFile and loadFileStream read entire cache files into memory without size limits. A very large cache file could cause memory exhaustion (DoS).
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/index.mjs | medium | This is a legitimate flat-file caching library with no overtly malicious patterns, but it has path traversal and arbitrary file deletion risks when cacheId/cacheDir/clearAll arguments are attacker-controlled, and a deserialization surface via configurable parse/stringify. |
| dist/index.cjs | safe | No malicious patterns detected; the code is a legitimate flat-file caching library using standard Node.js fs/path modules without exfiltration, credential harvesting, obfuscation, or process spawning. |
Frequently asked questions
Is flat-cache safe to use?
No confirmed malware was found in flat-cache@6.1.23, but the review flagged 2 medium, 2 low severity findings for risky patterns worth checking before you rely on it.
Does flat-cache contain malware?
No malware was identified in flat-cache@6.1.23 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was flat-cache checked?
Togoder Security downloaded the published npm package and had an AI model read its 2 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan flat-cache together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in flat-cache@6.1.23, cost nothing.