Summary
Togoder Security scanned the npm package glob@13.0.6 on Oct 6, 2026. An AI review of 14 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
Findings
No findings. The reviewer saw nothing malicious or risky in this version.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/commonjs/glob.js | safe | This is a standard glob pattern matching library implementation with no malicious patterns detected. |
| dist/commonjs/has-magic.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/commonjs/ignore.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/commonjs/index.js | safe | No malicious patterns detected; the file is a standard re-export and API wrapper for the glob package. |
| dist/commonjs/pattern.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/commonjs/processor.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/commonjs/walker.js | safe | No malicious patterns detected; the code is a legitimate glob-walking utility with no network, credential, or command-execution activity. |
| dist/esm/glob.js | safe | No malicious patterns detected; the code is a legitimate glob traversal utility with no exfiltration, credential harvesting, obfuscation, or backdoor behavior. |
| dist/esm/has-magic.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/ignore.js | safe | No malicious patterns detected; the code implements gitignore-style pattern matching using minimatch with standard configuration. |
| dist/esm/index.js | safe | No malicious patterns detected; this is the standard ESM entry point for the glob package re-exporting APIs from internal modules and minimatch. |
| dist/esm/pattern.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/processor.js | safe | No malicious patterns detected; the code is a legitimate glob pattern processor from minimatch with no data exfiltration, obfuscation, process spawning, or suspicious network/file system activity. |
| dist/esm/walker.js | safe | No malicious patterns detected; the code is a standard glob walker utility with no network, credential, or process execution behavior. |
Frequently asked questions
Is glob safe to use?
Our AI source review of glob@13.0.6 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does glob contain malware?
No malware was identified in glob@13.0.6 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was glob checked?
Togoder Security downloaded the published npm package and had an AI model read its 14 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan glob together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in glob@13.0.6, cost nothing.