tar - npm Package Compare versions

Comparing version 7.5.6 to 7.5.7

dist/commonjs/unpack.js

@@ -257,2 +257,3 @@ "use strict";
         const p = entry[field];
+        const { type } = entry;
         if (!p || this.preservePaths)
@@ -268,3 +269,3 @@ return true;
             // For paths, they just simply may not ever use .. at all.
-            if (field === 'path') {
+            if (field === 'path' || type === 'Link') {
                 this.warn('TAR_ENTRY_ERROR', `${field} contains '..'`, {
@@ -271,0 +272,0 @@ entry,

dist/esm/unpack.js

@@ -218,2 +218,3 @@ // the PEND/UNPEND stuff tracks whether we're ready to emit end/close yet.
         const p = entry[field];
+        const { type } = entry;
         if (!p || this.preservePaths)
@@ -229,3 +230,3 @@ return true;
             // For paths, they just simply may not ever use .. at all.
-            if (field === 'path') {
+            if (field === 'path' || type === 'Link') {
                 this.warn('TAR_ENTRY_ERROR', `${field} contains '..'`, {
@@ -232,0 +233,0 @@ entry,

package.json

@@ -5,3 +5,3 @@ {
   "description": "tar for node",
-  "version": "7.5.6",
+  "version": "7.5.7",
   "repository": {
@@ -8,0 +8,0 @@ "type": "git",

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1256289

0.03%

Lines of code

11918

0.02%

No dependency changes