yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.