Summary
Togoder Security scanned the npm package thread-stream@3.2.0 on Oct 4, 2026. An AI review of 5 source files produced 5 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 7
dynamic module loading
NPS-6B9FC4DDC5CF
The createWorker function constructs a Worker thread path using a global override ('__bundlerPathsOverrides') that can replace the thread-stream-worker path. If an attacker can influence globalThis.__bundlerPathsOverrides (e.g., via prototype pollution or bundler config injection), arbitrary code could be executed in a worker thread. However, this is a legitimate feature for bundlers and not inherently malicious.
worker thread dynamic execution
NPS-BC4A672C854B
The Worker is instantiated with a file path derived from 'join(__dirname, 'lib', 'worker.js')' or an overridden path. While the default path is safe, the override mechanism introduces a potential risk for code execution if the global override is controlled by an attacker.
Dynamic module loading with computed input
NPS-4DEBE496CA95
The code dynamically loads a module from a filename provided via workerData using realImport and realRequire. The filename is decoded and passed directly to the module loader, which could execute arbitrary code if an attacker can control the workerData filename.
Dynamic module loading with computed input
NPS-5F9C9F5E8A9F
Similar dynamic loading using realRequire with a decoded filename in the catch block. This further increases the risk of arbitrary code execution from external input.
Dynamic module loading with computed input
NPS-B3E349AA1C4D
Fallback dynamic loading using realRequire with a decoded filename when import fails with specific errors. Again, this allows execution of arbitrary code from the provided filename.
no obvious malicious patterns
NPS-AA49ED892A39
No data exfiltration, credential harvesting, obfuscation, dynamic eval, process spawning, or file system manipulation outside package scope was detected. The code appears to be a legitimate implementation of a thread-based stream (thread-stream).
shared array buffer usage
NPS-0D50EF428E89
Uses SharedArrayBuffer and Atomics for inter-thread communication, which is a legitimate performance feature but could be exploited for side-channel attacks if untrusted code runs in the same process. Not malicious by itself.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| index.js | medium | The code is a legitimate thread-stream implementation with a potential risk from a global override for worker path, but no malicious patterns were detected. |
| lib/worker.js | medium | The code dynamically loads and executes modules based on a filename from workerData, which could be exploited for arbitrary code execution if an attacker controls the input. |
| bench.js | safe | No malicious patterns detected |
| lib/indexes.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/wait.js | safe | Cleared by Jev triage; no further analysis needed |
Affected version ranges
None of the 2 scanned versions of thread-stream are flagged high or critical. The latest scanned version, 4.0.0, is not scanned. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 4.0.0 | Not scanned | 1 | 4.0.0 | |
| 3.2.0 | Needs review | 1 | 3.2.0 | dynamic module loading; worker thread dynamic execution |
| 3.1.0 | Not scanned | 1 | 3.1.0 | |
| 0.15.2 | Needs review | 1 | 0.15.2 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of thread-stream
Frequently asked questions
Is thread-stream safe to use?
No confirmed malware was found in thread-stream@3.2.0, but the review flagged 5 medium, 2 low severity findings for risky patterns worth checking before you rely on it.
Does thread-stream contain malware?
No malware was identified in thread-stream@3.2.0 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was thread-stream checked?
Togoder Security downloaded the published npm package and had an AI model read its 5 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan thread-stream together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in thread-stream@3.2.0, cost nothing.