Summary
Togoder Security scanned the npm package once@1.4.0 on Oct 4, 2026. An AI review of 1 source file produced 1 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
Global prototype pollution
NPS-A803DEB8E12B
The once.proto() function modifies Function.prototype by adding once and onceStrict methods. This is a global mutation that can affect all functions in the runtime, potentially interfering with other libraries or applications. While not inherently malicious, it is an intrusive anti-pattern and could be exploited or cause unexpected side effects.
Non-standard API surface
NPS-047E9FBB98D9
The module exposes an optional proto() method that extends global built-ins. This code runs when invoked, not automatically, but it represents an invasive capability that goes beyond the expected behavior of a simple once utility.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| once.js | medium | The package is a legitimate utility for function memoization but includes an optional global prototype augmentation that poses a moderate risk of runtime interference. |
Frequently asked questions
Is once safe to use?
No confirmed malware was found in once@1.4.0, but the review flagged 1 medium, 1 low severity findings for risky patterns worth checking before you rely on it.
Does once contain malware?
No malware was identified in once@1.4.0 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was once checked?
Togoder Security downloaded the published npm package and had an AI model read its 1 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan once together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in once@1.4.0, cost nothing.