Summary
Togoder Security scanned the npm package proggy@4.0.0 on Oct 6, 2026. An AI review of 3 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
Potential listener leak
NPS-B8D0CEE4E278
The 'start' method adds a listener to the global process object, but if a Client instance is garbage collected without calling 'stop', the listener remains attached, potentially causing memory leaks or unexpected behavior. This is a resource management concern rather than a direct security vulnerability.
Global process event listener manipulation
NPS-B6307624AFAD
The Client class attaches and removes listeners on the global 'process' object via 'process.on("progress", ...)' and 'process.removeListener("progress", ...)'. This is a non-standard use of the global process emitter and could interfere with other modules or leak listeners if not properly cleaned up. It is a potential side effect but not inherently malicious.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/client.js | medium | The code is a utility for tracking progress bars with no obvious malicious patterns, but it manipulates global process events which could lead to resource leaks or interference. |
| lib/index.js | safe | No malicious patterns detected; the code is a simple utility for tracking progress with no exfiltration, obfuscation, or suspicious behavior. |
| lib/tracker.js | safe | No malicious patterns detected; the code is a simple event emitter wrapper for progress tracking with no network, filesystem, or process manipulation. |
Scanned versions of proggy
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 4.0.0 | Needs review | 3 | Oct 6, 2026 |
Frequently asked questions
Is proggy safe to use?
No confirmed malware was found in proggy@4.0.0, but the review flagged 2 low severity findings for risky patterns worth checking before you rely on it.
Does proggy contain malware?
No malware was identified in proggy@4.0.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was proggy checked?
Togoder Security downloaded the published npm package and had an AI model read its 3 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan proggy together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in proggy@4.0.0, cost nothing.