Summary
Togoder Security scanned the npm package yargs-parser@18.1.3 on Oct 4, 2026. An AI review of 2 source files produced 1 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
Dynamic module loading with user-controlled path
NPS-701F1BB4FFFC
In setConfig(), the code calls require(resolvedConfigPath) where resolvedConfigPath is derived from CLI arguments or environment variables (configKey). This allows loading and executing arbitrary JavaScript files from any path on the filesystem, which could lead to arbitrary code execution if an attacker can control the config path argument or environment variables.
Function invocation from configuration
NPS-C6AA170914CA
flags.configs[configKey] may be a function supplied by the caller, which is invoked with the resolved config path. This is dynamic code execution controlled by the options object. While not malicious by itself, it enables execution of arbitrary functions if the parser is used with untrusted options.
Environment variable harvesting
NPS-AA9418707A8A
The applyEnvVars function iterates over all process.env entries and, when envPrefix is configured, reads environment variables and injects them into the parsed argv. This is intended behavior for a CLI parser, but it broadly reads all environment variables (including potentially sensitive ones) and makes them accessible via the returned argv object. If a consuming application uses this parser with an envPrefix and later logs or exposes argv, sensitive environment values could be leaked.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| index.js | medium | The yargs-parser code is a legitimate argument parser but contains a require() of a user-influenced config path, which could be abused for arbitrary code execution if config paths are attacker-controlled. |
| lib/tokenize-arg-string.js | safe | Cleared by Jev triage; no further analysis needed |
Affected version ranges
None of the 3 scanned versions of yargs-parser are flagged high or critical. The latest scanned version, 22.0.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 22.0.0 | Needs review | 1 | 22.0.0 | Dynamic module loading with external input; Dynamic module loading |
| 21.1.1 | Not scanned | 1 | 21.1.1 | |
| 20.2.9 | Needs review | 1 | 20.2.9 | Dynamic module loading; Dynamic module loading with computed path |
| 20.2.4 | Not scanned | 1 | 20.2.4 | |
| 18.1.3 | Needs review | 1 | 18.1.3 | Dynamic module loading with user-controlled path |
| 5.0.1 | Not scanned | 1 | 5.0.1 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of yargs-parser
Frequently asked questions
Is yargs-parser safe to use?
No confirmed malware was found in yargs-parser@18.1.3, but the review flagged 1 medium, 2 low severity findings for risky patterns worth checking before you rely on it.
Does yargs-parser contain malware?
No malware was identified in yargs-parser@18.1.3 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was yargs-parser checked?
Togoder Security downloaded the published npm package and had an AI model read its 2 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan yargs-parser together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in yargs-parser@18.1.3, cost nothing.