Summary
Togoder Security scanned the npm package make-asynchronous@1.0.1 on Oct 6, 2026. An AI review of 1 source file produced 2 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
Dynamic code execution
NPS-8DA4D2121490
The code serializes a user-provided function via function_.toString() and executes it inside a Web Worker using a data URL (Node) or blob URL (browser). This is dynamic code execution from a string, which could allow arbitrary code execution if the function argument is untrusted, though it is the intended behavior of this library.
Dynamic code execution
NPS-67513085A9FE
Similar to makeContent, makeIterableContent serializes and executes a user-supplied function inside a worker via string concatenation into executable JavaScript.
Obfuscation / encoded payload
NPS-7BD582C47930
The makeDataUrl function base64-encodes JavaScript content to form a data URL worker. While this is a legitimate workaround for a known web-worker issue, base64-encoded dynamic script execution resembles obfuscation techniques often used to hide malicious payloads.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| index.js | medium | The package dynamically constructs and executes worker scripts from serialized user functions via data/blob URLs and base64 encoding, which is intentional functionality but presents code execution risks if input is untrusted; no exfiltration, credential harvesting, backdoors, or network calls to external hosts were detected. |
Scanned versions of make-asynchronous
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 1.0.1 | Needs review | 1 | Oct 6, 2026 |
Frequently asked questions
Is make-asynchronous safe to use?
No confirmed malware was found in make-asynchronous@1.0.1, but the review flagged 2 medium, 1 low severity findings for risky patterns worth checking before you rely on it.
Does make-asynchronous contain malware?
No malware was identified in make-asynchronous@1.0.1 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was make-asynchronous checked?
Togoder Security downloaded the published npm package and had an AI model read its 1 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan make-asynchronous together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in make-asynchronous@1.0.1, cost nothing.