Summary
Togoder Security scanned the npm package get-symbol-description@1.1.0 on Oct 6, 2026. An AI review of 2 source files produced 1 medium severity finding. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 1
Dynamic code execution
NPS-2F484DAB986F
The code uses the Function constructor to dynamically create a function that reads the name property of an object's method. While this is a known technique for feature detection of inferred function names, using new Function/eval-like constructs can be abused in some contexts and is generally flagged as a potential security concern. Here it appears benign for its intended purpose.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| getInferredName.js | medium | Uses the Function constructor for feature detection of function name inference, which is a dynamic code execution pattern but appears benign in this context. |
| index.js | safe | No malicious patterns detected; the code is a legitimate polyfill for Symbol.prototype.description with no network, filesystem, or process activity. |
Frequently asked questions
Is get-symbol-description safe to use?
No confirmed malware was found in get-symbol-description@1.1.0, but the review flagged 1 medium severity finding for risky patterns worth checking before you rely on it.
Does get-symbol-description contain malware?
No malware was identified in get-symbol-description@1.1.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was get-symbol-description checked?
Togoder Security downloaded the published npm package and had an AI model read its 2 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan get-symbol-description together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in get-symbol-description@1.1.0, cost nothing.