minimist

parse argument options

Latest 1.2.8

NPM

70%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is available, reducing publication transparency, although this is a transparency gap rather than evidence that the package is malicious.

Lifecycle scripts

The package uses prepack and prepublish lifecycle scripts, which add install or publication behavior that deserves review, though these scripts are not by themselves evidence of an unsafe release.

Release history

The package has been published since 2013 with 31 releases, showing substantial maturity, but version 1.2.8 was released over three years ago and there were no releases in the last 12 months.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful sign of currently limited maintenance activity.

Vulnerabilities

Title	Versions	Severity
CVE-2021-44906 minimist is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 1.0.0 - 1.2.6 and 0.0.0 - 0.2.4.	0.0.0 - 0.2.41.0.0 - 1.2.6	Critical
CVE-2020-7598 minimist is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 0.2.1 and 1.0.0 - 1.2.3.	0.0.0 - 0.2.11.0.0 - 1.2.3	Medium