# jsx-ast-utils@3.3.5 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-06T14:17:42.000Z
- Files reviewed: 84
- Findings: 1 low severity finding
- Report: https://security.togoder.click/npm/jsx-ast-utils
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package jsx-ast-utils@3.3.5 on Oct 6, 2026. An AI review of 84 source files produced 1 low severity finding. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

### [low] debug logging

Finding ID: `NPS-CF9EC07B06BB`

File: `lib/values/index.js:52`

A console.log statement exists in getValue that logs the value type if it is not found in the TYPES map. This is not malicious but could leak AST type information to console during use.

## Files reviewed

- `elementType.js` (safe): Cleared by Jev triage; no further analysis needed
- `eventHandlers.js` (safe): Cleared by Jev triage; no further analysis needed
- `eventHandlersByType.js` (safe): Cleared by Jev triage; no further analysis needed
- `getLiteralPropValue.js` (safe): Cleared by Jev triage; no further analysis needed
- `getProp.js` (safe): Cleared by Jev triage; no further analysis needed
- `getPropValue.js` (safe): Cleared by Jev triage; no further analysis needed
- `hasAnyProp.js` (safe): Cleared by Jev triage; no further analysis needed
- `hasEveryProp.js` (safe): Cleared by Jev triage; no further analysis needed
- `hasProp.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/elementType.js` (safe): No malicious patterns detected
- `lib/eventHandlers.js` (safe): No malicious patterns detected
- `lib/getProp.js` (safe): No malicious patterns detected; the code is a benign utility for finding JSX props in AST nodes with no network, file system, process, or dynamic code execution activity.
- `lib/getPropValue.js` (safe): No malicious patterns detected; the code is a standard utility for extracting JSX attribute values from AST nodes.
- `lib/hasProp.js` (safe): No malicious patterns detected; the code is a straightforward utility for checking JSX props and performs no network, filesystem, process, or dynamic code execution operations.
- `lib/index.js` (safe): No malicious patterns detected
- `lib/propName.js` (safe): No malicious patterns detected
- `lib/values/JSXElement.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/JSXFragment.js` (safe): The code is a simple value extractor for JSX fragments with no malicious patterns such as data exfiltration, code execution, or network activity.
- `lib/values/JSXText.js` (safe): No malicious patterns detected
- `lib/values/Literal.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/ArrayExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/AssignmentExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/BinaryExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/BindExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/CallExpression.js` (safe): No malicious patterns detected; the code is a legitimate AST value extractor for CallExpression nodes with no network, filesystem, process, or dynamic execution behavior.
- `lib/values/expressions/ChainExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/ConditionalExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/FunctionExpression.js` (safe): No malicious patterns detected; the code is a simple AST value extractor that returns a closure without executing external code or accessing sensitive resources.
- `lib/values/expressions/Identifier.js` (safe): No malicious patterns detected; the code simply extracts AST identifier values with no network, filesystem, process, or dynamic execution activity.
- `lib/values/expressions/LogicalExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/MemberExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/NewExpression.js` (safe): No malicious patterns detected; the module simply returns an empty object for NewExpression AST nodes.
- `lib/values/expressions/ObjectExpression.js` (safe): No malicious patterns detected; the file is a standard AST utility for extracting values from object expressions.
- `lib/values/expressions/OptionalCallExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/OptionalMemberExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/SequenceExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/SpreadElement.js` (safe): No malicious patterns detected; the file is a simple AST helper that returns undefined for SpreadElement nodes.
- `lib/values/expressions/TSNonNullExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/TaggedTemplateExpression.js` (safe): No malicious patterns detected; the code is a simple utility that delegates to TemplateLiteral for extracting tagged template expression values.
- `lib/values/expressions/TemplateLiteral.js` (safe): No malicious patterns detected; the code is a pure AST utility for template literals with no network, filesystem, process, or dynamic code execution behavior.
- `lib/values/expressions/ThisExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/TypeCastExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/UnaryExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/UpdateExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/values/expressions/index.js` (safe): No malicious patterns detected
- `lib/values/index.js` (safe): No malicious patterns detected; the code is a standard AST value extractor with only a minor debug logging concern.
- `propName.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/elementType.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/eventHandlers.js` (safe): No malicious patterns detected
- `src/getProp.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/getPropValue.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/hasProp.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/propName.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/JSXElement.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/JSXFragment.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/JSXText.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/Literal.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/ArrayExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/AssignmentExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/BinaryExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/BindExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/CallExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/ChainExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/ConditionalExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/FunctionExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/Identifier.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/LogicalExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/MemberExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/NewExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/ObjectExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/OptionalCallExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/OptionalMemberExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/SequenceExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/SpreadElement.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/TSNonNullExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/TaggedTemplateExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/TemplateLiteral.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/ThisExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/TypeCastExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/UnaryExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/UpdateExpression.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/expressions/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `src/values/index.js` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology