Summary
Togoder Security scanned the npm package iconv-lite@0.4.24 on Oct 4, 2026. An AI review of 13 source files produced 2 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
Monkey-patching of Node.js Buffer and Stream primitives
NPS-CAE31025BE65
The code overrides core Node.js Buffer.prototype.toString, Buffer.prototype.write, SlowBuffer.prototype.toString, SlowBuffer.prototype.write, Buffer.isEncoding, Buffer.byteLength, and Readable.prototype.setEncoding. This modifies global runtime behavior for all code in the process and can break other libraries or be abused to intercept/manipulate data flowing through Buffer and stream APIs.
Global state mutation / persistence
NPS-D33042E0F89C
The extendNodeEncodings function installs permanent global overrides on Node.js built-in objects. Once called, these patches affect every consumer of Buffer and stream encoding within the process, potentially enabling transparent interception or corruption of encoded data across the application.
Unsafe Buffer construction pattern
NPS-5ED361C4A758
The code uses new Buffer(0) which is deprecated and unsafe. While used here only for a feature check, the pattern indicates reliance on insecure legacy APIs.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/extend-node.js | medium | This file monkey-patches core Node.js Buffer and Readable stream prototypes globally, which is a significant runtime-integrity concern but appears consistent with the stated purpose of iconv-lite's Node encoding extension rather than clear malware. |
| encodings/dbcs-codec.js | safe | Cleared by Jev triage; no further analysis needed |
| encodings/dbcs-data.js | safe | Cleared by Jev triage; no further analysis needed |
| encodings/index.js | safe | No malicious patterns detected |
| encodings/internal.js | safe | No malicious patterns detected; the code is a legitimate internal encodings module from the iconv-lite package with no network, filesystem, process, or dynamic code execution behavior. |
| encodings/sbcs-codec.js | safe | Cleared by Jev triage; no further analysis needed |
| encodings/sbcs-data-generated.js | safe | No malicious patterns detected |
| encodings/sbcs-data.js | safe | Cleared by Jev triage; no further analysis needed |
| encodings/utf16.js | safe | Cleared by Jev triage; no further analysis needed |
| encodings/utf7.js | safe | No malicious patterns detected |
| lib/bom-handling.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/index.js | safe | No malicious patterns detected; the code is the legitimate iconv-lite character encoding library with no data exfiltration, obfuscation, dynamic code execution, or other suspicious behavior. |
| lib/streams.js | safe | Cleared by Jev triage; no further analysis needed |
Affected version ranges
None of the 3 scanned versions of iconv-lite are flagged high or critical. The latest scanned version, 0.7.3, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 0.7.2 – 0.7.3 | No issues | 2 | >=0.7.2 <=0.7.3 | |
| 0.6.3 | Not scanned | 1 | 0.6.3 | |
| 0.4.24 | Needs review | 1 | 0.4.24 | Monkey-patching of Node.js Buffer and Stream primitives; Global state mutation / persistence |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of iconv-lite
Frequently asked questions
Is iconv-lite safe to use?
No confirmed malware was found in iconv-lite@0.4.24, but the review flagged 2 medium, 1 low severity findings for risky patterns worth checking before you rely on it.
Does iconv-lite contain malware?
No malware was identified in iconv-lite@0.4.24 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was iconv-lite checked?
Togoder Security downloaded the published npm package and had an AI model read its 13 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan iconv-lite together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in iconv-lite@0.4.24, cost nothing.