Summary
Togoder Security scanned the npm package immer@11.1.18 on Oct 6, 2026. An AI review of 22 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
Findings
No findings. The reviewer saw nothing malicious or risky in this version.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/cjs/immer.cjs.development.js | safe | No malicious patterns detected; the code is a legitimate, unmodified build of the Immer immutability library. |
| dist/cjs/immer.cjs.production.js | safe | No malicious patterns detected; this is the legitimate Immer library production bundle with no signs of data exfiltration, obfuscation, or unauthorized system access. |
| dist/cjs/index.js | safe | No malicious patterns detected |
| dist/immer.legacy-esm.js | safe | No malicious patterns detected; the code is the legitimate Immer library implementation for immutable state management with no data exfiltration, credential harvesting, dynamic code execution, or other security concerns. |
| dist/immer.mjs | safe | No malicious patterns detected; this is a legitimate build of the Immer immutability library with no data exfiltration, credential harvesting, obfuscated payloads, or dynamic code execution. |
| dist/immer.production.mjs | safe | This is a legitimate minified production build of the Immer immutable state library; no malicious patterns, data exfiltration, credential harvesting, obfuscated payloads, process spawning, or other security concerns were detected. |
| src/core/current.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/core/finalize.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/core/immerClass.ts | safe | No malicious patterns detected; the code is a legitimate implementation of the Immer immutable state library with no external data exfiltration, credential harvesting, obfuscation, or suspicious runtime behavior. |
| src/core/proxy.ts | safe | No malicious patterns detected |
| src/core/scope.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/immer.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/internal.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/plugins/arrayMethods.ts | safe | No malicious patterns detected; the file is a legitimate Immer plugin implementing optimized array method handling for draft proxies. |
| src/plugins/mapset.ts | safe | This is the legitimate Immer MapSet plugin implementation with no malicious patterns detected. |
| src/plugins/patches.ts | safe | No malicious patterns detected; the code is part of the Immer patch plugin and contains only legitimate patching logic with built-in prototype pollution protections. |
| src/types/types-external.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/types/types-internal.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/utils/common.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/utils/env.ts | safe | Cleared by Jev triage; no further analysis needed |
| src/utils/errors.ts | safe | No malicious patterns detected; the file is a standard Immer error-message utility with no network, filesystem, process, or dynamic-execution behavior. |
| src/utils/plugins.ts | safe | Cleared by Jev triage; no further analysis needed |
Scanned versions of immer
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 11.1.18 | No issues | 22 | Oct 6, 2026 |
Frequently asked questions
Is immer safe to use?
Our AI source review of immer@11.1.18 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does immer contain malware?
No malware was identified in immer@11.1.18 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was immer checked?
Togoder Security downloaded the published npm package and had an AI model read its 22 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan immer together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in immer@11.1.18, cost nothing.