# thread-stream@0.15.2 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:41:17.000Z
- Files reviewed: 5
- Findings: 6 low severity findings
- Report: https://security.togoder.click/npm/thread-stream@0.15.2
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package thread-stream@0.15.2 on Oct 4, 2026. An AI review of 5 source files produced 6 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] File system access outside package scope

Finding ID: `NPS-386A02EAA484`

File: `bench.js:9`

The benchmark script opens and writes to /dev/null, which is a system device file. While writing to /dev/null is typically harmless for benchmarks, it is a file system operation outside the package scope and could be considered a minor concern.

### [low] Dynamic module loading with computed path

Finding ID: `NPS-72B647111498`

File: `bench.js:17`

The code constructs a path using join(__dirname, 'test', 'to-file.js') and passes it to ThreadStream, which likely loads and executes this file in a worker thread. Although the path is derived from __dirname and hardcoded segments, the use of a dynamically computed path could be a vector if the file were modified or path traversal were possible.

### [low] Use of real-require to bypass require cache/modifications

Finding ID: `NPS-D5B92EB7DF2F`

File: `lib/worker.js:3`

The real-require package is used to invoke the original require/import functions, bypassing common monkey-patching. This is a known technique used to avoid instrumentation and could be abused, though here it appears intended to handle yarn PnP zip paths. Not inherently malicious, but notable.

### [low] Runtime require/import of ts-node and ts-node-dev

Finding ID: `NPS-ABD52DC4D257`

File: `lib/worker.js:25`

The code conditionally requires 'ts-node/register' or 'ts-node-dev' at runtime based on environment variables and file extensions. This can execute arbitrary code from those modules at import time. It is a legitimate use pattern for TypeScript support but increases the attack surface if those dependencies are compromised.

### [low] Dynamic module loading with computed input

Finding ID: `NPS-CD1075E2F058`

File: `lib/worker.js:33`

The worker dynamically loads a module using a filename provided via workerData. Depending on caller control, this could load unintended code. In this case the filename comes from the parent process, which is likely trusted, but the pattern is worth noting for supply-chain risk if untrusted input ever reaches workerData.

### [low] Worker thread dynamic code execution

Finding ID: `NPS-EF6FD0AF115A`

File: `lib/worker.js:38`

The file is designed to run in a worker thread and load and execute an external module using realImport/realRequire. This is core functionality of the ThreadStream worker and not exfiltration or backdoor behavior, but it is a dynamic code execution surface.

## Files reviewed

- `bench.js` (medium): The file is a benchmark script with no obvious malicious intent, but it includes minor red flags: writing to /dev/null and dynamically loading a worker script from a computed path.
- `lib/worker.js` (medium): No clear malicious patterns found; code is a worker-thread log writer that dynamically loads a module from parent-provided metadata, which is expected behavior but introduces dynamic execution and bypass-require concerns.
- `index.js` (safe): No malicious patterns detected
- `lib/indexes.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/wait.js` (safe): Cleared by Jev triage; no further analysis needed

## Version ranges

None of the 2 scanned versions of thread-stream are flagged high or critical. The latest scanned version, 4.0.0, is not scanned. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 4.0.0 (`4.0.0`): not scanned
- 3.2.0 (`3.2.0`): medium (dynamic module loading +2 more)
- 3.1.0 (`3.1.0`): not scanned
- 0.15.2 (`0.15.2`): medium

## Scanned versions

- [3.2.0](https://security.togoder.click/npm/thread-stream@3.2.0): medium, 2026-10-04T21:18:00.000Z
- [0.15.2](https://security.togoder.click/npm/thread-stream@0.15.2): medium, 2026-10-04T16:41:17.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology