# yargs-parser@20.2.9 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:14:52.000Z
- Files reviewed: 7
- Findings: 2 medium, 4 low severity findings
- Report: https://security.togoder.click/npm/yargs-parser@20.2.9
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package yargs-parser@20.2.9 on Oct 6, 2026. An AI review of 7 source files produced 2 medium, 4 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Dynamic module loading

Finding ID: `NPS-5B94E2DC2FB2`

File: `build/index.cjs:1118`

The parser can dynamically require() arbitrary filesystem paths when config options are supplied (setConfig -> mixin.require -> require(path)). This is intended functionality for yargs-parser (loading JSON config files), but if an application passes untrusted config keys or config objects, it could load arbitrary modules, potentially leading to code execution outside the package scope.

### [medium] Dynamic module loading with computed path

Finding ID: `NPS-EE1163B72E0A`

File: `build/lib/index.js:36`

The `require` function passed to `YargsParser` dynamically loads a module using the `path` argument. If `path` is derived from untrusted input (e.g., config file paths), an attacker could potentially load arbitrary modules, leading to code execution. While this is a standard pattern for config loading, it represents a potential security risk if input validation is insufficient.

### [low] Prototype pollution mitigation (informational)

Finding ID: `NPS-4CCDD6E564FA`

File: `build/index.cjs:1147`

The sanitizeKey function explicitly replaces '__proto__' with '___proto___', indicating awareness of prototype pollution. This is a defensive measure, not a vulnerability, but it highlights that keys flow from untrusted input into object property assignment.

### [low] Top-level environment access

Finding ID: `NPS-7E6ADBE1F715`

File: `build/index.cjs:1157`

Reads process.env and process.version at import time. This is common and benign (used for version check and env var parsing), but it does expose environment variables to the parsing logic, which could surface sensitive env values into parsed argv.

### [low] Top-level environment variable access and parsing

Finding ID: `NPS-3F974BB88932`

File: `build/lib/index.js:12`

The code reads `process.env.YARGS_MIN_NODE_VERSION` at import time and parses it as a number. While not inherently malicious, it demonstrates that the module inspects environment variables and could be abused if the variable is manipulated. No credential harvesting is present.

### [low] Process version check at import time

Finding ID: `NPS-4B38DE2A5766`

File: `build/lib/index.js:16`

The module checks the Node.js version at import time and throws an error if it is below a minimum version. This is benign but represents top-level code execution on import.

## Files reviewed

- `build/index.cjs` (medium): This file is the standard yargs-parser library with no obvious malicious code, though its dynamic require() of config paths and env/argv handling warrant caution when used with untrusted input.
- `build/lib/index.js` (medium): The code is a legitimate argument parser with standard environment and version checks; the dynamic require of config paths presents a medium risk if input is not validated, but no overt malicious patterns were found.
- `browser.js` (safe): No malicious patterns detected; the file is a benign browser-specific entrypoint for yargs-parser with stubbed Node.js dependencies.
- `build/lib/string-utils.js` (safe): Cleared by Jev triage; no further analysis needed
- `build/lib/tokenize-arg-string.js` (safe): Cleared by Jev triage; no further analysis needed
- `build/lib/yargs-parser-types.js` (safe): Cleared by Jev triage; no further analysis needed
- `build/lib/yargs-parser.js` (safe): No malicious patterns detected; the code is a legitimate yargs argument parser with config/require handling and environment variable support that are part of its intended functionality.

## Version ranges

None of the 3 scanned versions of yargs-parser are flagged high or critical. The latest scanned version, 22.0.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 22.0.0 (`22.0.0`): medium (Dynamic module loading with external input +1 more)
- 21.1.1 (`21.1.1`): not scanned
- 20.2.9 (`20.2.9`): medium (Dynamic module loading +1 more)
- 20.2.4 (`20.2.4`): not scanned
- 18.1.3 (`18.1.3`): medium (Dynamic module loading with user-controlled path)
- 5.0.1 (`5.0.1`): not scanned

## Scanned versions

- [22.0.0](https://security.togoder.click/npm/yargs-parser@22.0.0): medium, 2026-10-06T14:25:28.000Z
- [20.2.9](https://security.togoder.click/npm/yargs-parser@20.2.9): medium, 2026-10-06T14:14:52.000Z
- [18.1.3](https://security.togoder.click/npm/yargs-parser@18.1.3): medium, 2026-10-04T16:47:11.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology