# uint8arrays@3.1.1 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T21:17:53.000Z
- Files reviewed: 21
- Findings: 2 medium severity findings
- Report: https://security.togoder.click/npm/uint8arrays
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package uint8arrays@3.1.1 on Oct 4, 2026. An AI review of 21 source files produced 2 medium severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] missing input validation

Finding ID: `NPS-F1613054D1FD`

File: `esm/src/concat.js:2`

The length parameter is not validated against the total size of the input arrays. A caller-supplied length greater than the actual data length results in uninitialized data being returned, and a negative or non-integer length could cause unexpected behavior in allocUnsafe.

### [medium] uninitialized memory exposure

Finding ID: `NPS-7802E859CD53`

File: `esm/src/concat.js:5`

allocUnsafe allocates uninitialized memory. When an explicit length larger than the sum of the input array lengths is provided, the returned buffer will contain uninitialized heap memory bytes after the copied data. This can leak sensitive process memory (e.g., credentials, keys) to callers or consumers of the output.

## Files reviewed

- `esm/src/concat.js` (medium): Function uses allocUnsafe with an unvalidated caller-supplied length, potentially exposing uninitialized memory; no exfiltration, execution, or backdoor patterns found.
- `cjs/src/alloc.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/src/compare.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/src/concat.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/src/equals.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/src/from-string.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/src/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/src/to-string.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/src/util/as-uint8array.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/src/util/bases.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/src/xor.js` (safe): Cleared by Jev triage; no further analysis needed
- `esm/src/alloc.js` (safe): Cleared by Jev triage; no further analysis needed
- `esm/src/compare.js` (safe): Cleared by Jev triage; no further analysis needed
- `esm/src/equals.js` (safe): Cleared by Jev triage; no further analysis needed
- `esm/src/from-string.js` (safe): Cleared by Jev triage; no further analysis needed
- `esm/src/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `esm/src/to-string.js` (safe): Cleared by Jev triage; no further analysis needed
- `esm/src/util/as-uint8array.js` (safe): Cleared by Jev triage; no further analysis needed
- `esm/src/util/bases.js` (safe): Cleared by Jev triage; no further analysis needed
- `esm/src/xor.js` (safe): Cleared by Jev triage; no further analysis needed
- `index.js` (safe): Cleared by Jev triage; no further analysis needed

## Version ranges

None of the 2 scanned versions of uint8arrays are flagged high or critical. The latest scanned version, 3.1.1, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 3.1.1 (`3.1.1`): medium (uninitialized memory exposure +1 more)
- 3.1.0 (`3.1.0`): clean
- 2.1.5 (`2.1.5`): not scanned

## Scanned versions

- [3.1.1](https://security.togoder.click/npm/uint8arrays@3.1.1): medium, 2026-10-04T21:17:53.000Z
- [3.1.0](https://security.togoder.click/npm/uint8arrays@3.1.0): safe, 2026-10-04T16:41:50.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology