Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
extract-zip
Advanced tools
The extract-zip npm package is a cross-platform library that allows users to extract the contents of ZIP archives. It provides a simple API to unzip files and directories, supporting both callback and promise-based workflows.
Extract entire ZIP archive
This feature allows users to extract all contents of a ZIP file to a specified directory. The code sample demonstrates how to use the package with async/await to extract an archive.
const extract = require('extract-zip');
async function extractZip(zipPath, outputPath) {
try {
await extract(zipPath, { dir: outputPath });
console.log('Extraction complete');
} catch (err) {
console.error('An error occurred:', err);
}
}
extractZip('path/to/archive.zip', 'path/to/extract');
Extract ZIP archive with options
This feature allows users to extract a ZIP file with additional options, such as providing a callback for each entry. The code sample shows how to skip a specific file during extraction.
const extract = require('extract-zip');
extract('path/to/archive.zip', { dir: 'path/to/extract', onEntry: (entry, zipfile) => {
if (entry.fileName === 'unwanted_file.txt') {
zipfile.readEntry();
}
}}, function (err) {
if (err) {
console.error('Error extracting zip', err);
return;
}
console.log('Extraction part of zip complete');
});
adm-zip is a JavaScript implementation for zip data compression for NodeJS. It provides functionalities to read and write zip files, similar to extract-zip, but also includes the ability to create zip files, which extract-zip does not offer.
unzipper is a small and fast streaming unzipper for NodeJS with added support for piping, which can be useful in scenarios where you want to process files as they are extracted. It is an alternative to extract-zip with a focus on streaming and parsing zip files.
yauzl is another NodeJS library for reading and extracting zip files. It aims to be a low-level and high-performance library for zip file I/O, and it's what extract-zip uses under the hood. Unlike extract-zip, yauzl does not provide a high-level API for extraction, requiring more boilerplate code to achieve similar results.
Unzip written in pure JavaScript. Extracts a zip into a directory. Available as a library or a command line program.
Uses the yauzl
ZIP parser.
Get the library:
npm install extract-zip --save
Install the command line program:
npm install extract-zip -g
var extract = require('extract-zip')
extract(source, {dir: target}, function (err) {
// extraction is complete. make sure to handle the err
})
dir
- defaults to process.cwd()
defaultDirMode
- integer - Directory Mode (permissions) will default to 493
(octal 0755
in integer)defaultFileMode
- integer - File Mode (permissions) will default to 420
(octal 0644
in integer)onEntry
- function - if present, will be called with (entry, zipfile)
, entry is every entry from the zip file forwarded from the entry
event from yauzl. zipfile
is the yauzl
instanceDefault modes are only used if no permissions are set in the zip file.
extract-zip foo.zip <targetDirectory>
If not specified, targetDirectory
will default to process.cwd()
.
FAQs
unzip a zip file into a directory using 100% javascript
We found that extract-zip demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.