Summary
Togoder Security scanned the npm package just-diff@6.0.2 on Oct 6, 2026. An AI review of 4 source files produced 1 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
dynamic module loading with external input
NPS-FC4D35FC43F2
The config file requires a module from a relative path (../../config/createRollupConfig) and passes __dirname to it. While this is a common pattern for monorepos, the actual behavior depends entirely on the implementation of createRollupConfig, which is not included. If this file were packaged independently or the referenced module is outside the package scope, it could execute arbitrary code from an unexpected location. Additionally, requiring a module at the top level means code executes at import time.
code execution at import time
NPS-0C404F029628
The module executes createRollupConfig(__dirname) immediately upon import. If an attacker can influence the contents of ../../config/createRollupConfig or if this file is used in an unexpected context, it could lead to arbitrary code execution during build or import.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| rollup.config.js | medium | The file appears to be a standard Rollup configuration that delegates to a shared config module, but the relative require and top-level execution introduce moderate risk depending on the trustedness and location of the referenced module. |
| index.cjs | safe | Cleared by Jev triage; no further analysis needed |
| index.mjs | safe | Cleared by Jev triage; no further analysis needed |
| index.tests.ts | safe | Cleared by Jev triage; no further analysis needed |
Frequently asked questions
Is just-diff safe to use?
No confirmed malware was found in just-diff@6.0.2, but the review flagged 1 medium, 1 low severity findings for risky patterns worth checking before you rely on it.
Does just-diff contain malware?
No malware was identified in just-diff@6.0.2 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was just-diff checked?
Togoder Security downloaded the published npm package and had an AI model read its 4 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan just-diff together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in just-diff@6.0.2, cost nothing.