Minimist is a lightweight and dependency-free Node.js package designed for parsing command-line arguments with ease. Both versions 0.0.7 and 0.0.8 offer the same core functionality: converting a string of arguments into a structured JavaScript object, simplifying the process of accessing options passed to your Node.js scripts.
However, the difference between versions 0.0.7 and 0.0.8 is more than a simple bug fix or tiny improvement. If your project depends on the date of the package, it's important to know that Version 0.0.8 was released on Feb 21, 2014, while version 0.0.7 was released on Feb 09, 2014. Both versions are licensed under the permissive MIT license, making it suitable for use in a wide range of projects, both personal and commercial.
For developers, Minimist's strength lies in its simplicity and ease of integration. It avoids complex configurations and conventions, allowing you to quickly parse arguments and focus on your application's logic. The package relies on the tape and tap packages for development-time testing. To decide which version to use, consider it more like a question of which date you prefer to depend on, rather than on features of versioning since they offer the same features.
All the vulnerabilities related to the version 0.0.8 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
