The only finding is a benign version metadata mismatch in package-support.json (uses '*' for a support/donation file). No malicious code, sinks, or behavior present in the provided sources. This is the legitimate commander package.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Commander is a library for building Node.js command-line programs, providing argument parsing, command definition, and help generation. The package includes lib/ modules for arguments, commands, options, and related functionality, with index.js as the entry point. No runtime dependencies are declared.
Capabilities
- Parses command-line arguments and options
- Defines CLI commands and subcommands
- Generates help text and usage info
- Runs development checks via npm scripts (lint, type, format, test)
Data access
- None observed
Network
- No network access observed
Standard CLI utility library with no declared dependencies or network activity; the reported version metadata mismatch is a minor packaging anomaly that warrants verifying the installed files against the official source.
Security findings (1)
Static analysis rule matches, with the exact code that triggered them.
Version mismatch in package-support.json
Files in package (24)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/commander