Critical Vulnerability in yargs-help-output: Malicious Code Injection
Summary
MAL-2025-47366: Malicious code in yargs-help-output (npm). Affects yargs-help-output versions 5.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yargs-help-output package is a popular npm module that enhances the command-line interface by providing help output for yargs-based applications. It is widely used for its simplicity and effectiveness in improving user experience. However, this package has been compromised, leading to the introduction of malicious code that poses significant security risks to users and their systems.
Vulnerability Detail
The vulnerability stems from the compromise of the yargs-help-output package, which has been embedded with malicious code. This code is designed to steal tokens and credentials, subsequently publishing them to GitHub and propagating itself to other npm packages owned by the user. The malicious payload can lead to a complete compromise of any computer running the affected package, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall yargs-help-outputIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the yargs-help-output package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The yargs-help-output package has been compromised, leading to the injection of malicious code that poses serious security threats. Users must take immediate action to remove the package and secure their systems. Utilizing tools like Vulert can help monitor for vulnerabilities and ensure the safety of your applications.
See every vulnerability recorded for yargs-help-output →
FAQ
yargs-help-output is an npm package that enhances command-line applications by providing help output for users, making it easier to understand available commands and options.
The package was compromised by the Shai-Hulud NPM worm, which injected malicious code into the package, allowing it to steal sensitive information from users.
If you have the affected version of yargs-help-output installed, you should remove it immediately and rotate any sensitive information stored on your computer.
Yes, you can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
Failing to address this vulnerability can lead to unauthorized access to sensitive information, potential data breaches, and the propagation of malicious code to other packages you own.
