# just-diff-apply@5.5.0 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:23:17.000Z
- Files reviewed: 4
- Findings: 1 medium, 2 low severity findings
- Report: https://security.togoder.click/npm/just-diff-apply
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package just-diff-apply@5.5.0 on Oct 6, 2026. An AI review of 4 source files produced 1 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] dynamic module loading with external input

Finding ID: `NPS-587047D36888`

File: `rollup.config.js:1`

The config file requires a module from a relative path (../../config/createRollupConfig) and passes __dirname to it. While this is a common pattern for monorepos, the actual behavior depends entirely on the implementation of createRollupConfig, which is not included. If this file were packaged independently or the referenced module is outside the package scope, it could execute arbitrary code from an unexpected location. Additionally, requiring a module at the top level means code executes at import time.

### [low] Prototype Pollution Protection

Finding ID: `NPS-BE788F48DD48`

File: `index.mjs:150`

The code includes explicit protection against prototype pollution by checking for '__proto__', 'constructor', and 'prototype' properties in paths (prototypeCheck function). This is a security hardening measure rather than a vulnerability.

### [low] code execution at import time

Finding ID: `NPS-81C2EC8E32B1`

File: `rollup.config.js:3`

The module executes createRollupConfig(__dirname) immediately upon import. If an attacker can influence the contents of ../../config/createRollupConfig or if this file is used in an unexpected context, it could lead to arbitrary code execution during build or import.

## Files reviewed

- `rollup.config.js` (medium): The file appears to be a standard Rollup configuration that delegates to a shared config module, but the relative require and top-level execution introduce moderate risk depending on the trustedness and location of the referenced module.
- `index.cjs` (safe): No malicious patterns detected; the code implements JSON Patch diff/apply logic with prototype pollution protection.
- `index.mjs` (safe): The code is a legitimate JSON diff/patch utility that includes prototype pollution protections and shows no evidence of malicious behavior.
- `index.tests.ts` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology