# yargs-parser@22.0.0 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:25:28.000Z
- Files reviewed: 6
- Findings: 2 medium, 3 low severity findings
- Report: https://security.togoder.click/npm/yargs-parser@22.0.0
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package yargs-parser@22.0.0 on Oct 6, 2026. An AI review of 6 source files produced 2 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Dynamic module loading with external input

Finding ID: `NPS-2B3E4E6EC455`

File: `build/lib/index.js:39`

The parser's require callback dynamically loads arbitrary modules via createRequire(import.meta.url). If an attacker can control the config path or opts, they could potentially load unintended modules. However, in the context of yargs-parser, this is used for loading .json config files and is part of the intended functionality. The risk is mitigated by the check for '.json' extension in the ESM fallback, but the CJS require path has no such restriction.

### [medium] Dynamic module loading

Finding ID: `NPS-5A33BF90381C`

File: `build/lib/yargs-parser.js`

The setConfig function uses mixin.require(resolvedConfigPath) to dynamically load arbitrary files based on a config path provided on the command line. If the library is used with untrusted arguments, this could lead to loading/executing arbitrary files. This is a known risk in yargs-parser's config feature and should be constrained by callers.

### [low] File system read with dynamic path

Finding ID: `NPS-D7ABDF3F75E1`

File: `build/lib/index.js:44`

readFileSync is called with a path that may be derived from user-controlled input when loading config files. This could allow reading arbitrary JSON files on the filesystem if an attacker can control the config path. This is a known pattern in yargs-parser and is somewhat expected, but still represents a file system access risk.

### [low] Prototype pollution mitigation present but worth noting

Finding ID: `NPS-F91A52686400`

File: `build/lib/yargs-parser.js`

sanitizeKey correctly guards against '__proto__' by mapping it to '___proto___', and many objects are created with Object.create(null). However, setKey still assigns user-controlled dot-notation keys into argv, and hasKey/setKey traverse nested objects. This is a common historical issue area, but the code appears to mitigate it. No direct exploit demonstrated in this file.

### [low] Environment variable harvesting with envPrefix

Finding ID: `NPS-8D013C02E92A`

File: `build/lib/yargs-parser.js`

applyEnvVars can read all environment variables matching opts.envPrefix and inject them into parsed argv. This is an intended feature, but if a caller sets envPrefix to an empty string, all environment variables are enumerated. No exfiltration occurs here; data stays local, so risk is low.

## Files reviewed

- `build/lib/index.js` (medium): The code is the legitimate yargs-parser entrypoint; it contains dynamic require and file read patterns inherent to its config-loading functionality, but no overt malicious behavior such as exfiltration, credential harvesting, or code execution beyond intended module loading.
- `build/lib/yargs-parser.js` (medium): No outright malicious behavior detected; the only notable risk is dynamic file loading via mixin.require in config file handling, which is a legitimate but potentially dangerous feature if misused by callers.
- `browser.js` (safe): No malicious patterns detected; the file is a benign browser-specific entrypoint for yargs-parser with stubbed Node.js dependencies.
- `build/lib/string-utils.js` (safe): Cleared by Jev triage; no further analysis needed
- `build/lib/tokenize-arg-string.js` (safe): Cleared by Jev triage; no further analysis needed
- `build/lib/yargs-parser-types.js` (safe): Cleared by Jev triage; no further analysis needed

## Version ranges

None of the 3 scanned versions of yargs-parser are flagged high or critical. The latest scanned version, 22.0.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 22.0.0 (`22.0.0`): medium (Dynamic module loading with external input +1 more)
- 21.1.1 (`21.1.1`): not scanned
- 20.2.9 (`20.2.9`): medium (Dynamic module loading +1 more)
- 20.2.4 (`20.2.4`): not scanned
- 18.1.3 (`18.1.3`): medium (Dynamic module loading with user-controlled path)
- 5.0.1 (`5.0.1`): not scanned

## Scanned versions

- [22.0.0](https://security.togoder.click/npm/yargs-parser@22.0.0): medium, 2026-10-06T14:25:28.000Z
- [20.2.9](https://security.togoder.click/npm/yargs-parser@20.2.9): medium, 2026-10-06T14:14:52.000Z
- [18.1.3](https://security.togoder.click/npm/yargs-parser@18.1.3): medium, 2026-10-04T16:47:11.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology