# tldts-core@7.4.13 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-06T14:24:40.000Z
- Files reviewed: 36
- Findings: no findings
- Report: https://security.togoder.click/npm/tldts-core
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package tldts-core@7.4.13 on Oct 6, 2026. An AI review of 36 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

No findings.

## Files reviewed

- `dist/cjs/index.js` (safe): The code is a domain/hostname parsing library (tldts) with no network, filesystem, process, or dynamic-execution behavior; all logic is pure string manipulation and Public Suffix List lookups.
- `dist/cjs/src/domain-without-suffix.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/cjs/src/domain.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/cjs/src/extract-hostname.js` (safe): This file implements hostname extraction logic for URL parsing with inline validation; it contains no network, filesystem, process, credential, obfuscation, or dynamic execution patterns and is consistent with its stated purpose.
- `dist/cjs/src/factory.js` (safe): The code is a standard domain parsing factory from the tldts library with no malicious patterns, network activity, obfuscation, or environment manipulation.
- `dist/cjs/src/is-ip.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/cjs/src/is-special-use.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/cjs/src/is-valid.js` (safe): The code is a pure hostname validation utility with no network, filesystem, process execution, or obfuscated behavior detected.
- `dist/cjs/src/lookup/fast-path.js` (safe): No malicious patterns detected; the code is a benign fast-path optimization for public suffix lookup.
- `dist/cjs/src/lookup/interface.js` (safe): No malicious patterns detected
- `dist/cjs/src/options.js` (safe): No malicious patterns detected
- `dist/cjs/src/subdomain.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/src/domain-without-suffix.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/src/domain.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/src/extract-hostname.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/src/factory.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/src/is-ip.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/src/is-special-use.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/src/is-valid.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/src/lookup/fast-path.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/es6/src/lookup/interface.js` (safe): No malicious patterns detected
- `dist/es6/src/options.js` (safe): No malicious patterns detected; the file only defines and exports simple default option helpers with no I/O, network, process, or dynamic code execution.
- `dist/es6/src/subdomain.js` (safe): Cleared by Jev triage; no further analysis needed
- `index.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/domain-without-suffix.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/domain.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/extract-hostname.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/factory.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/is-ip.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/is-special-use.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/is-valid.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/lookup/fast-path.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/lookup/interface.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/options.ts` (safe): Cleared by Jev triage; no further analysis needed
- `src/subdomain.ts` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology