Summary
Togoder Security scanned the npm package web-worker@1.2.0 on Oct 6, 2026. An AI review of 4 source files produced 5 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 8
Dynamic module loading with computed input
NPS-8A1A4D6BCB08
The workerThread function calls import(mod) and require(mod) where 'mod' comes from threads.workerData. If an attacker can influence the worker URL passed to the Worker constructor, they could load arbitrary modules or execute code from external locations.
Dynamic code execution
NPS-25B9555A330B
The evaluateDataUrl function uses VM.runInThisContext to execute arbitrary JavaScript from data: URLs. While intended for Web Worker compatibility, this pattern allows code execution if an attacker can control the worker URL, and data: URLs are treated as trusted input without sandboxing.
Dynamic module loading with computed input
NPS-D1CCEFFBCFF8
The workerThread function uses dynamic import(mod) and require(mod) where mod is derived from workerData. If an attacker can influence the worker URL, they could load and execute arbitrary modules or code.
Dynamic code execution
NPS-866FBD08E55D
The evaluateDataUrl function uses VM.runInThisContext to execute arbitrary JavaScript code from a data URL. This allows execution of any code supplied in a data: URL, which can be abused if an attacker can control the worker URL. While this is part of the intended Web Worker polyfill, it still represents a dynamic code execution surface.
Potential data URL code execution
NPS-994D477545B9
The parseDataUrl and evaluateDataUrl functions decode and execute base64-encoded JavaScript from a data URL. This could be used to run obfuscated payloads if the URL is attacker-controlled.
File system path resolution
NPS-FEB1A700638C
The baseUrl is derived from process.cwd() and used to resolve worker module paths. Depending on the working directory, this could allow loading modules from unintended locations if relative paths are used.
Environment/global object manipulation
NPS-33CCE63985E5
The code modifies the global object prototype and binds core functions (postMessage, addEventListener, etc.) to the global scope. This could interfere with other modules and potentially be exploited if combined with other vulnerabilities.
Top-level code execution on import
NPS-A95E3209F44F
The module executes code at import time, including determining whether it is the main thread or worker thread and constructing the base URL from process.cwd(). This is typical for this polyfill but still means side effects occur upon import.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| cjs/node.js | medium | This is a legitimate Google Web Worker polyfill for Node.js, but it contains dynamic code execution via VM.runInThisContext and dynamic module loading that could be risky if worker URLs are attacker-controlled. |
| node.js | medium | The code is a legitimate Web Worker polyfill for Node.js that uses dynamic code execution and module loading, which are inherent to its functionality but could pose security risks if worker URLs are attacker-controlled. |
| browser.js | safe | Cleared by Jev triage; no further analysis needed |
| cjs/browser.js | safe | Cleared by Jev triage; no further analysis needed |
Scanned versions of web-worker
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 1.2.0 | Needs review | 4 | Oct 6, 2026 |
Frequently asked questions
Is web-worker safe to use?
No confirmed malware was found in web-worker@1.2.0, but the review flagged 5 medium, 3 low severity findings for risky patterns worth checking before you rely on it.
Does web-worker contain malware?
No malware was identified in web-worker@1.2.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was web-worker checked?
Togoder Security downloaded the published npm package and had an AI model read its 4 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan web-worker together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in web-worker@1.2.0, cost nothing.