# highlight.js@10.7.3 security report (npm) - Verdict: **No issues** (risk level: safe) - Scanned: 2026-10-06T14:16:52.000Z - Files reviewed: 192 - Findings: no findings - Report: https://security.togoder.click/npm/highlight.js - Source: Togoder Security (https://security.togoder.click), AI source-code review ## Summary Togoder Security scanned the npm package highlight.js@10.7.3 on Oct 6, 2026. An AI review of 192 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified. ## Findings No findings. ## Files reviewed - `lib/core.js` (safe): No malicious patterns detected; the code is the highlight.js core library, implementing syntax highlighting with no network exfiltration, credential harvesting, obfuscation, or process spawning. - `lib/highlight.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/index.js` (safe): This is the standard entry point for the highlight.js library that registers language grammars via static require calls; no malicious patterns were detected. - `lib/languages/1c.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/abnf.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/accesslog.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/actionscript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/ada.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/angelscript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/apache.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/applescript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/arcade.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/arduino.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/armasm.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/asciidoc.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/aspectj.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/autohotkey.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/autoit.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/avrasm.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/awk.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/axapta.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/bash.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/basic.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/bnf.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/brainfuck.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/c-like.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/c.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/cal.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/capnproto.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/ceylon.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/clean.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/clojure-repl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/clojure.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/cmake.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/coffeescript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/coq.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/cos.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/cpp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/crmsh.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/crystal.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/csharp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/csp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/css.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/d.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/dart.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/delphi.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/diff.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/django.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/dns.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/dockerfile.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/dos.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/dsconfig.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/dts.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/dust.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/ebnf.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/elixir.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/elm.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/erb.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/erlang-repl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/erlang.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/excel.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/fix.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/flix.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/fortran.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/fsharp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/gams.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/gauss.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/gcode.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/gherkin.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/glsl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/gml.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/go.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/golo.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/gradle.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/groovy.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/haml.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/handlebars.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/haskell.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/haxe.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/hsp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/htmlbars.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/http.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/hy.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/inform7.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/ini.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/irpf90.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/java.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/javascript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/jboss-cli.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/json.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/julia-repl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/julia.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/kotlin.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/lasso.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/latex.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/ldif.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/leaf.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/less.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/lisp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/livecodeserver.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/livescript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/llvm.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/lsl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/lua.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/makefile.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/markdown.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/matlab.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/maxima.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/mel.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/mercury.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/mipsasm.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/mizar.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/mojolicious.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/monkey.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/moonscript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/n1ql.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/nginx.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/nim.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/nix.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/node-repl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/nsis.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/objectivec.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/ocaml.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/openscad.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/oxygene.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/parser3.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/perl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/pf.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/pgsql.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/php-template.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/php.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/plaintext.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/pony.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/powershell.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/processing.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/profile.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/prolog.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/properties.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/protobuf.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/puppet.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/purebasic.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/python-repl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/python.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/q.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/qml.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/r.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/reasonml.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/rib.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/roboconf.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/routeros.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/rsl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/ruby.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/ruleslanguage.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/rust.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/sas.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/scala.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/scheme.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/scilab.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/scss.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/shell.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/smali.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/smalltalk.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/sml.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/sqf.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/sql.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/sql_more.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/stan.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/stata.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/step21.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/stylus.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/subunit.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/swift.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/taggerscript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/tap.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/tcl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/thrift.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/tp.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/twig.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/typescript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/vala.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/vbnet.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/vbscript-html.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/vbscript.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/verilog.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/vhdl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/vim.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/x86asm.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/xl.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/xml.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/xquery.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/yaml.js` (safe): Cleared by Jev triage; no further analysis needed - `lib/languages/zephir.js` (safe): Cleared by Jev triage; no further analysis needed AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology