Summary
Togoder Security scanned the npm package function-bind@1.1.2 on Oct 4, 2026. An AI review of 2 source files produced 1 low severity finding. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 1
Dynamic code execution
NPS-EA4EDEF6A692
The implementation uses Function('binder', 'return function (...) { ... }')(binder) to dynamically generate a bound function. While this appears to be part of a standard polyfill for Function.prototype.bind (similar to the well-known function-bind package), the use of new Function with string concatenation is a code-generation pattern that can be risky if inputs are ever influenced by external data. In this specific file, boundArgs is constructed from numeric indices and a fixed string, so the generated code is not attacker-controlled. No obfuscation or encoded payload is present.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| implementation.js | medium | The file is a benign polyfill for Function.prototype.bind with no malicious network, credential, filesystem, or process activity, though it does use dynamic Function construction for legacy browser compatibility. |
| index.js | safe | Cleared by Jev triage; no further analysis needed |
Frequently asked questions
Is function-bind safe to use?
No confirmed malware was found in function-bind@1.1.2, but the review flagged 1 low severity finding for risky patterns worth checking before you rely on it.
Does function-bind contain malware?
No malware was identified in function-bind@1.1.2 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was function-bind checked?
Togoder Security downloaded the published npm package and had an AI model read its 2 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan function-bind together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in function-bind@1.1.2, cost nothing.