# function-bind@1.1.2 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T14:37:35.000Z
- Files reviewed: 2
- Findings: 1 low severity finding
- Report: https://security.togoder.click/npm/function-bind
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package function-bind@1.1.2 on Oct 4, 2026. An AI review of 2 source files produced 1 low severity finding. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] Dynamic code execution

Finding ID: `NPS-EA4EDEF6A692`

File: `implementation.js`

The implementation uses `Function('binder', 'return function (...) { ... }')(binder)` to dynamically generate a bound function. While this appears to be part of a standard polyfill for `Function.prototype.bind` (similar to the well-known `function-bind` package), the use of `new Function` with string concatenation is a code-generation pattern that can be risky if inputs are ever influenced by external data. In this specific file, `boundArgs` is constructed from numeric indices and a fixed string, so the generated code is not attacker-controlled. No obfuscation or encoded payload is present.

## Files reviewed

- `implementation.js` (medium): The file is a benign polyfill for Function.prototype.bind with no malicious network, credential, filesystem, or process activity, though it does use dynamic Function construction for legacy browser compatibility.
- `index.js` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology