Summary
Togoder Security scanned the npm package xmlchars@2.2.0 on Oct 6, 2026. An AI review of 5 source files produced 1 low severity finding. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
Findings 1
deprecation warning
NPS-64FDAACEAD0D
The module logs a deprecation warning via console.warn at import time. This is benign and expected behavior for a deprecated package.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| xml/1.0/ed4.js | safe | No malicious patterns detected; the file only defines XML 1.0 character class constants and corresponding regular expressions. |
| xml/1.0/ed5.js | safe | Cleared by Jev triage; no further analysis needed |
| xml/1.1/ed2.js | safe | Cleared by Jev triage; no further analysis needed |
| xmlchars.js | safe | No malicious patterns detected; the file only defines XML character class utilities and emits a benign deprecation warning. |
| xmlns/1.0/ed3.js | safe | Cleared by Jev triage; no further analysis needed |
Scanned versions of xmlchars
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 2.2.0 | No issues | 5 | Oct 6, 2026 |
Frequently asked questions
Is xmlchars safe to use?
Our AI source review of xmlchars@2.2.0 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does xmlchars contain malware?
No malware was identified in xmlchars@2.2.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was xmlchars checked?
Togoder Security downloaded the published npm package and had an AI model read its 5 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan xmlchars together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in xmlchars@2.2.0, cost nothing.