Summary
Togoder Security scanned the npm package just-diff-apply@5.5.0 on Oct 6, 2026. An AI review of 4 source files produced 1 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
dynamic module loading with external input
NPS-587047D36888
The config file requires a module from a relative path (../../config/createRollupConfig) and passes __dirname to it. While this is a common pattern for monorepos, the actual behavior depends entirely on the implementation of createRollupConfig, which is not included. If this file were packaged independently or the referenced module is outside the package scope, it could execute arbitrary code from an unexpected location. Additionally, requiring a module at the top level means code executes at import time.
Prototype Pollution Protection
NPS-BE788F48DD48
The code includes explicit protection against prototype pollution by checking for '__proto__', 'constructor', and 'prototype' properties in paths (prototypeCheck function). This is a security hardening measure rather than a vulnerability.
code execution at import time
NPS-81C2EC8E32B1
The module executes createRollupConfig(__dirname) immediately upon import. If an attacker can influence the contents of ../../config/createRollupConfig or if this file is used in an unexpected context, it could lead to arbitrary code execution during build or import.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| rollup.config.js | medium | The file appears to be a standard Rollup configuration that delegates to a shared config module, but the relative require and top-level execution introduce moderate risk depending on the trustedness and location of the referenced module. |
| index.cjs | safe | No malicious patterns detected; the code implements JSON Patch diff/apply logic with prototype pollution protection. |
| index.mjs | safe | The code is a legitimate JSON diff/patch utility that includes prototype pollution protections and shows no evidence of malicious behavior. |
| index.tests.ts | safe | Cleared by Jev triage; no further analysis needed |
Frequently asked questions
Is just-diff-apply safe to use?
No confirmed malware was found in just-diff-apply@5.5.0, but the review flagged 1 medium, 2 low severity findings for risky patterns worth checking before you rely on it.
Does just-diff-apply contain malware?
No malware was identified in just-diff-apply@5.5.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was just-diff-apply checked?
Togoder Security downloaded the published npm package and had an AI model read its 4 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan just-diff-apply together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in just-diff-apply@5.5.0, cost nothing.