# iconv-lite@0.4.24 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:51:33.000Z
- Files reviewed: 13
- Findings: 2 medium, 1 low severity findings
- Report: https://security.togoder.click/npm/iconv-lite@0.4.24
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package iconv-lite@0.4.24 on Oct 4, 2026. An AI review of 13 source files produced 2 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Monkey-patching of Node.js Buffer and Stream primitives

Finding ID: `NPS-CAE31025BE65`

File: `lib/extend-node.js:1`

The code overrides core Node.js Buffer.prototype.toString, Buffer.prototype.write, SlowBuffer.prototype.toString, SlowBuffer.prototype.write, Buffer.isEncoding, Buffer.byteLength, and Readable.prototype.setEncoding. This modifies global runtime behavior for all code in the process and can break other libraries or be abused to intercept/manipulate data flowing through Buffer and stream APIs.

### [medium] Global state mutation / persistence

Finding ID: `NPS-D33042E0F89C`

File: `lib/extend-node.js:14`

The extendNodeEncodings function installs permanent global overrides on Node.js built-in objects. Once called, these patches affect every consumer of Buffer and stream encoding within the process, potentially enabling transparent interception or corruption of encoded data across the application.

### [low] Unsafe Buffer construction pattern

Finding ID: `NPS-5ED361C4A758`

File: `lib/extend-node.js:10`

The code uses `new Buffer(0)` which is deprecated and unsafe. While used here only for a feature check, the pattern indicates reliance on insecure legacy APIs.

## Files reviewed

- `lib/extend-node.js` (medium): This file monkey-patches core Node.js Buffer and Readable stream prototypes globally, which is a significant runtime-integrity concern but appears consistent with the stated purpose of iconv-lite's Node encoding extension rather than clear malware.
- `encodings/dbcs-codec.js` (safe): Cleared by Jev triage; no further analysis needed
- `encodings/dbcs-data.js` (safe): Cleared by Jev triage; no further analysis needed
- `encodings/index.js` (safe): No malicious patterns detected
- `encodings/internal.js` (safe): No malicious patterns detected; the code is a legitimate internal encodings module from the iconv-lite package with no network, filesystem, process, or dynamic code execution behavior.
- `encodings/sbcs-codec.js` (safe): Cleared by Jev triage; no further analysis needed
- `encodings/sbcs-data-generated.js` (safe): No malicious patterns detected
- `encodings/sbcs-data.js` (safe): Cleared by Jev triage; no further analysis needed
- `encodings/utf16.js` (safe): Cleared by Jev triage; no further analysis needed
- `encodings/utf7.js` (safe): No malicious patterns detected
- `lib/bom-handling.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/index.js` (safe): No malicious patterns detected; the code is the legitimate iconv-lite character encoding library with no data exfiltration, obfuscation, dynamic code execution, or other suspicious behavior.
- `lib/streams.js` (safe): Cleared by Jev triage; no further analysis needed

## Version ranges

None of the 3 scanned versions of iconv-lite are flagged high or critical. The latest scanned version, 0.7.3, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 0.7.2 – 0.7.3 (`>=0.7.2 <=0.7.3`): clean
- 0.6.3 (`0.6.3`): not scanned
- 0.4.24 (`0.4.24`): medium (Monkey-patching of Node.js Buffer and Stream primitives +1 more)

## Scanned versions

- [0.7.3](https://security.togoder.click/npm/iconv-lite@0.7.3): safe, 2026-10-04T14:41:40.000Z
- [0.7.2](https://security.togoder.click/npm/iconv-lite@0.7.2): safe, 2026-10-06T14:23:08.000Z
- [0.4.24](https://security.togoder.click/npm/iconv-lite@0.4.24): medium, 2026-10-04T16:51:33.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology