# process-warning@1.0.0 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:39:30.000Z
- Files reviewed: 3
- Findings: 2 low severity findings
- Report: https://security.togoder.click/npm/process-warning@1.0.0
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package process-warning@1.0.0 on Oct 4, 2026. An AI review of 3 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] Global event listener registration

Finding ID: `NPS-0301830BF575`

File: `test.js`

The test adds listeners to process.on('warning', ...) during test execution. This is expected test behavior but demonstrates the package interacts with Node.js process-level warning events, which is the module's intended functionality rather than a malicious pattern.

### [low] Global side effect / event listener manipulation

Finding ID: `NPS-F250E595CDAD`

File: `test.js:7`

The test file calls process.removeAllListeners('warning') at module load time, which removes all existing 'warning' event listeners from the Node.js process globally. This is a side effect that occurs on import and could interfere with other modules or applications relying on warning listeners. While this is a test file and likely intentional for test isolation, it modifies global process state without user consent and is a suspicious pattern in third-party packages.

## Files reviewed

- `test.js` (medium): This is a test file for a warning utility package that manipulates global process warning listeners at import time but contains no malicious patterns such as exfiltration, credential harvesting, or code execution.
- `index.js` (safe): Cleared by Jev triage; no further analysis needed
- `index.test-d.ts` (safe): Cleared by Jev triage; no further analysis needed

## Version ranges

None of the 2 scanned versions of process-warning are flagged high or critical. The latest scanned version, 5.1.0, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 5.1.0 (`5.1.0`): clean
- 5.0.0 (`5.0.0`): not scanned
- 1.0.0 (`1.0.0`): medium

## Scanned versions

- [5.1.0](https://security.togoder.click/npm/process-warning@5.1.0): safe, 2026-10-04T21:17:56.000Z
- [1.0.0](https://security.togoder.click/npm/process-warning@1.0.0): medium, 2026-10-04T16:39:30.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology