pargs

DataDog's malicious-software-packages-dataset dataset includes in its manifest, with a value indicating "the package has malicious intent: all versions can be considered malicious". This dataset is used by tools like Socket Firewall in blocking installation of malicious packages. Though interestingly Socket's own overview of the package doesn't flag any issues. Practically speaking, this blocked me from running in for a contribution I was planning to that project, since I use Socket Firewall. I don't know exactly what the recourse is here for resolving this (e.g. if it can be disputed with DataDog), but wanted to flag as a potential barrier to using the package.

The readme says that always uses for , but that should be . https://github.com/ljharb/pargs/blob/c15ca12877fc53d57cbf022719c76269fa1379a9/README.md?plain=1#L65

Summary Any CLI built with fails with , even when no positional argument was actually passed — as long as Node.js is reached through a symlink or junction (e.g. Scoop's "current" version pointer on Windows, or nvm/fnm/volta depending on their setup). Environment (latest published at the time of this report) Node.js installed via a version manager that exposes a "current" pointer as a symlink/junction rather than a plain directory Reproduced identically under Git Bash and PowerShell — shell-independent Root cause In , the filter that is supposed to strip the node executable and the script path out of the real arguments: is resolved through before the comparison, but never is. When Node is invoked through a symlink/junction that the OS does not resolve at process start, stays the unresolved path while (for that very same , i.e. ) returns the real target — so the two are never equal, and the executable's path survives the filter and gets treated as an unexpected positional argument. Minimal reproduction Output on a machine with an active Scoop "current" symlink: Suggested fix Resolve once, the same way already is: Impact Affects every package that depends on (in my case, ) for anyone using a symlink/junction-based Node version manager instead of a directly-installed binary.