yargs-parser 22.0.0

Source: https://github.com/yargs/yargs-parser
Artifact scanned: yargs-parser-22.0.0.tgz (npm tarball · 21.2 KB · SHA-256 2b640247b9ca…)
Compared with: yargs-parser-21.1.1.tgz (0 signals introduced since)
Files: 10 scanned, 0 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 2.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 16:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import build/lib/index.js:41:20

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
        if (typeof require !== 'undefined') {
            return require(path);
        }
        else if (path.match(/\.json$/)) {
```
likely benign LLM, confidence 0.80 A build output module calls require with a runtime-computed path inside a loader that also handles JSON files.
Reasoning
The require call uses a variable path, which is a common pattern in universal/bundled JS modules that resolve paths at runtime. The surrounding code checks for a JSON suffix and handles require availability, consistent with a generic loader. Nothing in the snippet shows decoding, network access, or process spawning. It is a warn-level dynamic require in a build artifact, so it merits a note but looks benign.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o yargs-parser-22.0.0.tgz https://registry.npmjs.org/yargs-parser/-/yargs-parser-22.0.0.tgz
printf '%s  %s\n' 2b640247b9ca6f540c708dfea99bafeae59a46db66f491fb5b6d55fce1614d65 yargs-parser-22.0.0.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf yargs-parser-22.0.0.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg