# proggy@4.0.0 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:23:28.000Z
- Files reviewed: 3
- Findings: 2 low severity findings
- Report: https://security.togoder.click/npm/proggy
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package proggy@4.0.0 on Oct 6, 2026. An AI review of 3 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] Potential listener leak

Finding ID: `NPS-B8D0CEE4E278`

File: `lib/client.js:42`

The 'start' method adds a listener to the global process object, but if a Client instance is garbage collected without calling 'stop', the listener remains attached, potentially causing memory leaks or unexpected behavior. This is a resource management concern rather than a direct security vulnerability.

### [low] Global process event listener manipulation

Finding ID: `NPS-B6307624AFAD`

File: `lib/client.js:44`

The Client class attaches and removes listeners on the global 'process' object via 'process.on("progress", ...)' and 'process.removeListener("progress", ...)'. This is a non-standard use of the global process emitter and could interfere with other modules or leak listeners if not properly cleaned up. It is a potential side effect but not inherently malicious.

## Files reviewed

- `lib/client.js` (medium): The code is a utility for tracking progress bars with no obvious malicious patterns, but it manipulates global process events which could lead to resource leaks or interference.
- `lib/index.js` (safe): No malicious patterns detected; the code is a simple utility for tracking progress with no exfiltration, obfuscation, or suspicious behavior.
- `lib/tracker.js` (safe): No malicious patterns detected; the code is a simple event emitter wrapper for progress tracking with no network, filesystem, or process manipulation.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology