# object.assign@4.1.7 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:23:39.000Z
- Files reviewed: 7
- Findings: 3 medium, 1 low severity findings
- Report: https://security.togoder.click/npm/object.assign
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package object.assign@4.1.7 on Oct 6, 2026. An AI review of 7 source files produced 3 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Indirect code execution via module import

Finding ID: `NPS-318DDDE6592A`

File: `auto.js:3`

The file immediately invokes the exported function from './shim' at top-level (require-time). Since './shim' is not shown, this shim module can execute arbitrary code upon loading, including installing hooks, monkey-patching globals, harvesting environment variables/credentials, or performing network requests. Top-level execution on import is a common vector for malicious npm packages.

### [medium] Potential global environment modification

Finding ID: `NPS-33F10DD11C56`

File: `auto.js:3`

The term 'shim' typically implies modifying global objects or built-ins (e.g. patching process, console, require, or other prototypes). Such behavior can silently alter runtime semantics for the entire application, enabling interception of sensitive data or stealthy execution.

### [medium] Opaque dependency

Finding ID: `NPS-1B651997C6D0`

File: `auto.js:3`

The actual behavior cannot be verified from this file alone — all logic resides in './shim'. The entry point provides no indication of what the shim does, which is a common obfuscation/encapsulation pattern in malicious packages.

### [low] Harmless-looking but potentially deceptive shim implementation

Finding ID: `NPS-2B361BBDE2D2`

File: `shim.js:5`

The function `define` is called but never imported or defined in the visible scope. In the original `es-abstract` / `es-shim` pattern, `define` is usually obtained via `require('define-properties')`. Here, it appears as a bare global or an implicitly resolved function, which could be intentionally done to obfuscate an abnormal dependency or a global monkey-patch. While not overtly malicious in isolation, this missing import is a notable inconsistency that could hide unexpected behavior.

## Files reviewed

- `auto.js` (medium): The file is a thin wrapper that immediately executes an unspecified shim module at require-time, which is a potential vector for hidden malicious behavior such as credential harvesting, monkey-patching, or code execution, though no direct malicious code is visible.
- `shim.js` (medium): No direct malicious patterns such as exfiltration, code execution, or credential harvesting are present, but the unexplained `define` call introduces a minor integrity concern.
- `dist/browser.js` (safe): No malicious patterns detected; the code is a standard browserify bundle of the well-known object.assign polyfill package with no suspicious network, filesystem, or dynamic execution activity.
- `hasSymbols.js` (safe): Cleared by Jev triage; no further analysis needed
- `implementation.js` (safe): This is a legitimate implementation of Object.assign polyfill with no malicious patterns detected.
- `index.js` (safe): No malicious patterns detected; this is a standard polyfill wrapper for Object.assign with no network, filesystem, process, or dynamic code execution activity.
- `polyfill.js` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology