# why-is-node-running@3.2.1 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:25:20.000Z
- Files reviewed: 3
- Findings: 4 medium, 4 low severity findings
- Report: https://security.togoder.click/npm/why-is-node-running
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package why-is-node-running@3.2.1 on Oct 6, 2026. An AI review of 3 source files produced 4 medium, 4 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] User-controlled command execution

Finding ID: `NPS-6034373097EB`

File: `cli.js:4`

The program name and arguments are taken directly from process.argv and passed to spawn without validation or sanitization. This allows arbitrary command execution (e.g., 'node cli.js malicious_script.js' or even 'node cli.js --eval ...' if the user supplies flags). While this is the intended purpose of a launcher, it can be exploited if the CLI is invoked by other software with untrusted input.

### [medium] Dynamic module loading via --import flag

Finding ID: `NPS-2C1166C05057`

File: `cli.js:10`

The script injects an 'include.js' module via the Node.js --import flag when spawning the child process. This causes the module to be loaded and executed before the target program runs. If include.js is malicious, it could perform arbitrary actions (data exfiltration, credential harvesting, etc.) with the same privileges as the user. The script itself only references a local file, but the behavior is a code injection mechanism.

### [medium] Spawning processes

Finding ID: `NPS-C8243046BE6A`

File: `cli.js:14`

The script uses child_process.spawn to launch a new Node.js process, which is a common pattern for wrappers but can be abused for malicious execution. The spawned process is a Node.js runtime with a user-supplied program and arguments, effectively acting as a command launcher. This is not inherently malicious but represents a security-relevant capability.

### [medium] Process signal handler / diagnostic hook

Finding ID: `NPS-75345273BE9E`

File: `include.js:3`

The file registers handlers for SIGINFO and SIGUSR1 that call whyIsNodeRunning() from './index.js', and logs the PID to the console. While this itself is not malicious, it executes at import time and imports an unspecified local module. The actual behavior depends entirely on index.js, which is not provided. If index.js performs data exfiltration, credential harvesting, shell execution, or other malicious actions, it would be triggered by sending SIGUSR1/SIGINFO to the process. The console.log leaks the process PID, which could aid an attacker in targeting the running process.

### [low] Top-level code execution on import

Finding ID: `NPS-EC562FF08961`

File: `include.js:1`

The code runs at module load time, attaching signal listeners and printing to stdout. Side effects on import are generally undesirable and can be abused as an activation mechanism for hidden functionality in a dependency.

### [low] Runtime hooking / async resource interception

Finding ID: `NPS-D7763374692C`

File: `index.js:14`

The code uses node:async_hooks createHook to intercept all async resource initialization and capture full stack traces for every async operation. This is global runtime instrumentation that persists for the lifetime of the process. While this is the intended functionality of a diagnostic tool, it constitutes broad runtime interception of all async activity in the host application.

### [low] Import-time side effects

Finding ID: `NPS-CC14E62CE04E`

File: `index.js:29`

hook.enable() is called at module top-level, meaning simply importing this module globally hooks async resource creation in the host process. This is an import-time side effect that modifies global runtime behavior without explicit user opt-in beyond the import.

### [low] File system access outside package scope

Finding ID: `NPS-506C7F6B3266`

File: `index.js:78`

The printStacks function calls readFileSync on file paths derived from stack traces. While this is intended to display source code context for debugging async handles, it reads arbitrary files referenced in stack traces. This is a legitimate debugging feature but does access files outside the package scope based on runtime stack data.

## Files reviewed

- `cli.js` (medium): The script is a wrapper that spawns a Node.js process with a user-supplied program and an injected import module, which could be abused for command execution or module injection, but no overt malicious patterns like data exfiltration or credential theft are present.
- `include.js` (medium): The file itself only sets up debug signal handlers, but it imports an unspecified index.js executed on import and exposes the PID, creating a potential activation vector for malicious behavior in that module.
- `index.js` (medium): This appears to be a legitimate debugging utility (similar to why-is-node-running) that uses async_hooks to track open handles, with only minor concerns around broad runtime instrumentation and reading files referenced in stack traces.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology