# js-yaml@4.1.0 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-05-15T12:32:29.000Z
- Files reviewed: 26
- Findings: no findings
- Report: https://security.togoder.click/npm/js-yaml@4.1.0
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package js-yaml@4.1.0 on May 15, 2026. An AI review of 26 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

No findings.

## Files reviewed

- `binary.js` (safe): No malicious patterns detected; the code is a legitimate implementation for YAML binary data resolution, construction, and representation using standard base64 encoding logic.
- `bool.js` (safe): No malicious patterns detected
- `common.js` (safe): No malicious patterns detected
- `core.js` (safe): The code is a standard module re-export from a legitimate YAML parsing library with no malicious patterns detected.
- `default.js` (safe): No malicious patterns detected
- `dumper.js` (safe): The code is a standard YAML serialization utility that safely processes and formats JavaScript objects into YAML strings without any network calls, process spawning, or obfuscation.
- `exception.js` (safe): No malicious patterns detected
- `failsafe.js` (safe): No malicious patterns detected
- `float.js` (safe): No malicious patterns detected
- `index.js` (safe): No malicious patterns detected
- `int.js` (safe): No malicious patterns detected
- `js-yaml.js` (safe): No malicious patterns detected
- `json.js` (safe): No malicious patterns detected
- `loader.js` (safe): No malicious patterns detected
- `map.js` (safe): No malicious patterns detected
- `merge.js` (safe): No malicious patterns detected
- `null.js` (safe): No malicious patterns detected
- `omap.js` (safe): No malicious patterns detected
- `pairs.js` (safe): No malicious patterns detected
- `schema.js` (safe): No malicious patterns detected
- `seq.js` (safe): No malicious patterns detected
- `set.js` (safe): No malicious patterns detected
- `snippet.js` (safe): The code is a legitimate snippet generation utility for displaying source code context around a position, with no security concerns detected.
- `str.js` (safe): The code is a standard, benign YAML scalar type definition with no suspicious or malicious patterns detected.
- `timestamp.js` (safe): No malicious patterns detected
- `type.js` (safe): No malicious patterns detected

## Version ranges

None of the 2 scanned versions of js-yaml are flagged high or critical. The latest scanned version, 4.3.2, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 4.3.2 (`4.3.2`): clean
- 4.1.1 – 4.3.0 (`>=4.1.1 <=4.3.0`): not scanned
- 4.1.0 (`4.1.0`): clean
- 3.15.0 – 3.15.2 (`>=3.15.0 <=3.15.2`): not scanned

## Scanned versions

- [4.3.2](https://security.togoder.click/npm/js-yaml@4.3.2): safe, 2026-10-06T14:17:11.000Z
- [4.1.0](https://security.togoder.click/npm/js-yaml@4.1.0): safe, 2026-05-15T12:32:29.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology