# use-sync-external-store@1.2.0 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-04T16:42:39.000Z
- Files reviewed: 10
- Findings: 4 low severity findings
- Report: https://security.togoder.click/npm/use-sync-external-store@1.2.0
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package use-sync-external-store@1.2.0 on Oct 4, 2026. An AI review of 10 source files produced 4 low severity findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

### [low] environment variable usage

Finding ID: `NPS-B4DCCE038CD9`

File: `cjs/use-sync-external-store-shim.development.js:10`

The code checks process.env.NODE_ENV to determine development vs production mode, which is a standard practice in React packages.

### [low] devtools hook access

Finding ID: `NPS-8434CF299D25`

File: `cjs/use-sync-external-store-shim.development.js:18`

Accesses __REACT_DEVTOOLS_GLOBAL_HOOK__ for integration with React DevTools, a standard debugging interface, not a security concern.

### [low] internal React API access

Finding ID: `NPS-46A0989B6A57`

File: `cjs/use-sync-external-store-shim.development.js:25`

Uses React.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED for accessing ReactDebugCurrentFrame for stack traces in warnings, which is an internal React API but not malicious.

### [low] console output

Finding ID: `NPS-FD763111ADCA`

File: `cjs/use-sync-external-store-shim.development.js:51`

Uses console.error/warning for development warnings via Function.prototype.apply.call, which is standard for React warnings.

## Files reviewed

- `cjs/use-sync-external-store-shim.development.js` (safe): The code is the official React use-sync-external-store shim for development, containing only standard React development warnings and no malicious patterns.
- `cjs/use-sync-external-store-shim.native.development.js` (safe): This is the official React use-sync-external-store shim library for React Native; it contains no malicious patterns, network calls, or dynamic code execution.
- `cjs/use-sync-external-store-shim/with-selector.development.js` (safe): Cleared by Jev triage; no further analysis needed
- `cjs/use-sync-external-store-with-selector.development.js` (safe): No malicious patterns detected
- `cjs/use-sync-external-store.development.js` (safe): No malicious patterns detected; the code is a legitimate React development build for use-sync-external-store with only console warnings and safe module-level hooks.
- `index.js` (safe): Standard conditional module export based on NODE_ENV with no malicious patterns detected
- `shim/index.js` (safe): No malicious patterns detected
- `shim/index.native.js` (safe): No malicious patterns detected; the file is a standard conditional module export for React's use-sync-external-store shim.
- `shim/with-selector.js` (safe): No malicious patterns detected; the file is a standard environment-based module re-export shim for a well-known React use-sync-external-store package.
- `with-selector.js` (safe): The wrapper file simply re-exports a production or development build based on NODE_ENV, with no malicious patterns.

## Version ranges

None of the 3 scanned versions of use-sync-external-store are flagged high or critical. The latest scanned version, 1.6.0, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 1.2.0 – 1.6.0 (`>=1.2.0 <=1.6.0`): clean

## Scanned versions

- [1.6.0](https://security.togoder.click/npm/use-sync-external-store@1.6.0): safe, 2026-10-06T14:24:49.000Z
- [1.4.0](https://security.togoder.click/npm/use-sync-external-store@1.4.0): safe, 2026-10-04T16:42:11.000Z
- [1.2.0](https://security.togoder.click/npm/use-sync-external-store@1.2.0): safe, 2026-10-04T16:42:39.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology