Summary
Togoder Security scanned the npm package yargs-parser@22.0.0 on Oct 6, 2026. An AI review of 6 source files produced 2 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 5
Dynamic module loading with external input
NPS-2B3E4E6EC455
The parser's require callback dynamically loads arbitrary modules via createRequire(import.meta.url). If an attacker can control the config path or opts, they could potentially load unintended modules. However, in the context of yargs-parser, this is used for loading .json config files and is part of the intended functionality. The risk is mitigated by the check for '.json' extension in the ESM fallback, but the CJS require path has no such restriction.
Dynamic module loading
NPS-5A33BF90381C
The setConfig function uses mixin.require(resolvedConfigPath) to dynamically load arbitrary files based on a config path provided on the command line. If the library is used with untrusted arguments, this could lead to loading/executing arbitrary files. This is a known risk in yargs-parser's config feature and should be constrained by callers.
File system read with dynamic path
NPS-D7ABDF3F75E1
readFileSync is called with a path that may be derived from user-controlled input when loading config files. This could allow reading arbitrary JSON files on the filesystem if an attacker can control the config path. This is a known pattern in yargs-parser and is somewhat expected, but still represents a file system access risk.
Prototype pollution mitigation present but worth noting
NPS-F91A52686400
sanitizeKey correctly guards against '__proto__' by mapping it to '___proto___', and many objects are created with Object.create(null). However, setKey still assigns user-controlled dot-notation keys into argv, and hasKey/setKey traverse nested objects. This is a common historical issue area, but the code appears to mitigate it. No direct exploit demonstrated in this file.
Environment variable harvesting with envPrefix
NPS-8D013C02E92A
applyEnvVars can read all environment variables matching opts.envPrefix and inject them into parsed argv. This is an intended feature, but if a caller sets envPrefix to an empty string, all environment variables are enumerated. No exfiltration occurs here; data stays local, so risk is low.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| build/lib/index.js | medium | The code is the legitimate yargs-parser entrypoint; it contains dynamic require and file read patterns inherent to its config-loading functionality, but no overt malicious behavior such as exfiltration, credential harvesting, or code execution beyond intended module loading. |
| build/lib/yargs-parser.js | medium | No outright malicious behavior detected; the only notable risk is dynamic file loading via mixin.require in config file handling, which is a legitimate but potentially dangerous feature if misused by callers. |
| browser.js | safe | No malicious patterns detected; the file is a benign browser-specific entrypoint for yargs-parser with stubbed Node.js dependencies. |
| build/lib/string-utils.js | safe | Cleared by Jev triage; no further analysis needed |
| build/lib/tokenize-arg-string.js | safe | Cleared by Jev triage; no further analysis needed |
| build/lib/yargs-parser-types.js | safe | Cleared by Jev triage; no further analysis needed |
Affected version ranges
None of the 3 scanned versions of yargs-parser are flagged high or critical. The latest scanned version, 22.0.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 22.0.0 | Needs review | 1 | 22.0.0 | Dynamic module loading with external input; Dynamic module loading |
| 21.1.1 | Not scanned | 1 | 21.1.1 | |
| 20.2.9 | Needs review | 1 | 20.2.9 | Dynamic module loading; Dynamic module loading with computed path |
| 20.2.4 | Not scanned | 1 | 20.2.4 | |
| 18.1.3 | Needs review | 1 | 18.1.3 | Dynamic module loading with user-controlled path |
| 5.0.1 | Not scanned | 1 | 5.0.1 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of yargs-parser
Frequently asked questions
Is yargs-parser safe to use?
No confirmed malware was found in yargs-parser@22.0.0, but the review flagged 2 medium, 3 low severity findings for risky patterns worth checking before you rely on it.
Does yargs-parser contain malware?
No malware was identified in yargs-parser@22.0.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was yargs-parser checked?
Togoder Security downloaded the published npm package and had an AI model read its 6 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan yargs-parser together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in yargs-parser@22.0.0, cost nothing.