# node-fetch@2.7.0 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:35:43.000Z
- Files reviewed: 4
- Findings: 3 low severity findings
- Report: https://security.togoder.click/npm/node-fetch
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package node-fetch@2.7.0 on Oct 4, 2026. An AI review of 4 source files produced 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] Dynamic module loading

Finding ID: `NPS-F3F026B2DD06`

File: `lib/index.mjs`

Uses require('encoding').convert inside a try/catch. This is a common pattern but loads an optional dependency at runtime, which could be a vector if the dependency is hijacked.

### [low] Network request functionality

Finding ID: `NPS-3B5E0893BFFD`

File: `lib/index.mjs`

This is the node-fetch package which makes HTTP/HTTPS requests. While this is the intended functionality, it can be used for data exfiltration if misused or if the package is compromised.

### [low] Stream processing and compression

Finding ID: `NPS-457BF2466F70`

File: `lib/index.mjs`

Handles gzip, deflate, and brotli decompression via zlib. This is standard for HTTP clients but decompression bombs are a potential concern.

## Files reviewed

- `lib/index.mjs` (medium): This appears to be a legitimate copy of the node-fetch library with no obvious malicious patterns, though its network request capabilities warrant standard supply-chain scrutiny.
- `browser.js` (safe): The code is a standard polyfill for the fetch API, safely exposing global fetch, Headers, Request, and Response without any malicious patterns.
- `lib/index.es.js` (safe): No malicious patterns detected; the file is a legitimate deprecated build artifact of node-fetch with standard HTTP fetch functionality.
- `lib/index.js` (safe): No malicious patterns detected; the code appears to be a legitimate implementation of the node-fetch library.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology