Summary
Togoder Security scanned the npm package tunnel@0.0.6 on Oct 6, 2026. An AI review of 2 source files produced 1 low severity finding. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 1
Dynamic module loading
NPS-3D53A4D10C81
The file re-exports a module from a relative path ('./lib/tunnel'). While this is a common pattern for package entry points, it delegates all functionality to an unseen file (lib/tunnel.js). The security of the package cannot be fully assessed without analyzing that file, as it could contain malicious code.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| index.js | medium | The index.js file simply re-exports another module, which is not inherently malicious but requires further inspection of the referenced file to ensure safety. |
| lib/tunnel.js | safe | No malicious patterns detected; the code implements a standard HTTP/HTTPS tunneling agent using CONNECT proxies and does not exhibit data exfiltration, credential harvesting, obfuscation, or unauthorized process/file access. |
Frequently asked questions
Is tunnel safe to use?
No confirmed malware was found in tunnel@0.0.6, but the review flagged 1 low severity finding for risky patterns worth checking before you rely on it.
Does tunnel contain malware?
No malware was identified in tunnel@0.0.6 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was tunnel checked?
Togoder Security downloaded the published npm package and had an AI model read its 2 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan tunnel together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in tunnel@0.0.6, cost nothing.