Summary
Togoder Security scanned the npm package ws@7.5.10 on Oct 4, 2026. An AI review of 14 source files produced 1 low severity finding. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
Findings 1
dynamic require of optional dependency
NPS-CA84C3BEF4C1
The module conditionally requires 'utf-8-validate' at import time using a try/catch. This is a legitimate optional native binding for fast UTF-8 validation and falls back to a pure-JS implementation if unavailable. The require target is a hardcoded, well-known package name and is not influenced by external input.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| browser.js | safe | Cleared by Jev triage; no further analysis needed |
| index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/buffer-util.js | safe | The file contains standard buffer manipulation utilities with no malicious patterns detected. |
| lib/constants.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/event-target.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/extension.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/limiter.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/permessage-deflate.js | safe | No malicious patterns detected; the code is a legitimate permessage-deflate implementation using zlib with concurrency limiting and payload size checks. |
| lib/receiver.js | safe | No malicious patterns detected; this is a legitimate WebSocket frame receiver implementation with proper validation and no suspicious behavior. |
| lib/sender.js | safe | The code implements a legitimate WebSocket message sender (HyBi framing) with standard masking, compression, and queueing behavior; no malicious patterns or unauthorized network, file, or process activity detected. |
| lib/stream.js | safe | No malicious patterns detected; the code is a legitimate WebSocket-to-Duplex stream adapter with no data exfiltration, credential harvesting, obfuscation, or process spawning. |
| lib/validation.js | safe | The code is a standard WebSocket validation utility with a benign optional native dependency; no malicious patterns were identified. |
| lib/websocket-server.js | safe | No malicious patterns detected |
| lib/websocket.js | safe | No malicious patterns detected; the code is a legitimate WebSocket client implementation from the 'ws' library. |
Affected version ranges
None of the 5 scanned versions of ws are flagged high or critical. The latest scanned version, 8.21.3, is not scanned. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 8.21.0 – 8.21.3 | Not scanned | 2 | >=8.21.0 <=8.21.3 | |
| 7.5.13 – 8.18.3 | No issues | 4 | >=7.5.13 <=8.18.3 | |
| 7.5.11 | Not scanned | 1 | 7.5.11 | |
| 7.5.10 | No issues | 1 | 7.5.10 | |
| 6.2.4 | Not scanned | 1 | 6.2.4 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of ws
Frequently asked questions
Is ws safe to use?
Our AI source review of ws@7.5.10 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does ws contain malware?
No malware was identified in ws@7.5.10 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was ws checked?
Togoder Security downloaded the published npm package and had an AI model read its 14 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan ws together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in ws@7.5.10, cost nothing.