Summary
Togoder Security scanned the npm package node-fetch@2.7.0 on Oct 4, 2026. An AI review of 4 source files produced 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
Dynamic module loading
NPS-F3F026B2DD06
Uses require('encoding').convert inside a try/catch. This is a common pattern but loads an optional dependency at runtime, which could be a vector if the dependency is hijacked.
Network request functionality
NPS-3B5E0893BFFD
This is the node-fetch package which makes HTTP/HTTPS requests. While this is the intended functionality, it can be used for data exfiltration if misused or if the package is compromised.
Stream processing and compression
NPS-457BF2466F70
Handles gzip, deflate, and brotli decompression via zlib. This is standard for HTTP clients but decompression bombs are a potential concern.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/index.mjs | medium | This appears to be a legitimate copy of the node-fetch library with no obvious malicious patterns, though its network request capabilities warrant standard supply-chain scrutiny. |
| browser.js | safe | The code is a standard polyfill for the fetch API, safely exposing global fetch, Headers, Request, and Response without any malicious patterns. |
| lib/index.es.js | safe | No malicious patterns detected; the file is a legitimate deprecated build artifact of node-fetch with standard HTTP fetch functionality. |
| lib/index.js | safe | No malicious patterns detected; the code appears to be a legitimate implementation of the node-fetch library. |
Frequently asked questions
Is node-fetch safe to use?
No confirmed malware was found in node-fetch@2.7.0, but the review flagged 3 low severity findings for risky patterns worth checking before you rely on it.
Does node-fetch contain malware?
No malware was identified in node-fetch@2.7.0 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was node-fetch checked?
Togoder Security downloaded the published npm package and had an AI model read its 4 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan node-fetch together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in node-fetch@2.7.0, cost nothing.