yargs is a legitimate, widely-used CLI argument parser. The flagged files are standard TypeScript-compiled output using private fields (via __classPrivateFieldGet/Set helpers) and internal Symbols for method keys. No malicious behavior present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Yargs is a command-line argument parsing library for Node.js, described as the modern successor to optimist. It includes TypeScript source that compiles to build/lib/*.js files plus locale JSON files and depends on standard CLI utilities.
Capabilities
- Compiles TypeScript via prepare/compile scripts
- Runs linting, testing, and coverage via npm scripts
- Provides argument parsing and command handling
Data access
- Filesystem (build outputs and locales)
- None observed beyond standard package files
Network
- No network access observed
Standard CLI library with build/test tooling; two static findings flag obfuscated source files, though sample files appear as normal compiled JavaScript.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (2)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in build/lib/yargs-factory.js
Multiple obfuscation patterns in package/build/lib/yargs-factory.js
Package metadata
yargs the modern, pirate-themed, successor to optimist.
Files in package (118)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/yargs