yargs@18.0.0 security report

The mergeDeep function uses Object.assign and recursive merging but does not explicitly protect against prototype pollution (e.g., __proto__, constructor, prototype keys). An attacker-controlled config could potentially pollute Object.prototype.

The module imports readFileSync and readdirSync from node:fs and exports them. This provides file system access to consumers of this module. While not malicious by itself, it could be a vector if the library is used by untrusted code. The y18n initialization also reads locale files from a resolved path outside the package's immediate directory (../../../locales), which is a relative path traversal outside the package scope. However, this is a common pattern for i18n libraries and the updateFiles option is set to false, preventing writes.

The code computes mainFilename by taking __dirname and truncating it at the last occurrence of 'node_modules'. This logic assumes the package is installed inside node_modules. If the package is installed outside node_modules or in a symlinked environment (e.g., pnpm, yarn PnP, or globally), mainFilename may resolve to an unexpected path or be empty. This is not directly malicious but could lead to incorrect behavior or information disclosure about the filesystem structure. It also reveals the package expects to run within a specific directory structure.

The code uses createRequire to create a require function relative to the current module. This is a common pattern in ESM modules to access CommonJS modules. While dynamic require can be a red flag for dynamic code execution, here it is used statically and does not accept external input. It is exported as part of the default object, which could be misused by consumers, but the module itself does not perform any dynamic loading with computed paths.

The exported getEnv function allows reading arbitrary environment variables via process.env[key]. While this is a common utility, it could be leveraged by an attacker if the consumer of this module passes untrusted input to getEnv, potentially exposing sensitive environment variables. However, this is a standard pattern in many CLI libraries and not inherently malicious.

The getCallerFile function uses getCallerFile(3) to determine the calling file and normalizes file:// URLs. This is a common pattern for libraries that need to resolve paths relative to the caller. It does not execute code or access sensitive information directly, but it does inspect the call stack, which could be used for reconnaissance if the library is compromised. In this context, it appears benign.