Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
unzip-simple
Advanced tools
A super-simple unzip API that simplifies file extraction...
import unzip from 'unzip-simple';
const [file] = await unzip('single-file-example.zip');
console.log(file.buffer.toString());
Filter files by applying a file globbing pattern...
const files = await unzip({input: 'multi-file-example.zip', filter: '*.txt'});
import unzip from 'unzip-simple';
const files = await unzip('example.zip');
for (const file of files)
console.log(file.name, file.buffer.toString());
import unzip from 'unzip-simple';
import fetch from 'node-fetch';
const response = await fetch('https://github.com/davetemplin/unzip-simple/raw/master/test/example1.zip');
const buffer = await response.buffer();
const files = await unzip(buffer);
import unzip from 'unzip-simple';
const files = await unzip({input: 'example.zip', extract: false});
for (const file of files)
console.log(file.name, file.compressed, file.uncompressed);
foo.txt 208 330
bar.txt 148 213
...
const files = await unzip({input: 'example.zip', filter: 'foo/bar.txt'});
const files = await unzip({input: 'example.zip', filter: '*.txt'});
const files = await unzip({input: 'example.zip', filter: '!*.jpg'});
The API for this library is defined by a single function that accepts a set of options and returns an array of files in the ZIP archive. Alternatively, just the path or buffer of the ZIP archive can be passed as the input.
unzip(options: UnzipOptions|string|Buffer|number): Promise<UnzipFile[]>
The options specify the input ZIP archive file, an optional filter to target specific files, and a flag that determines whether to extract files.
option | type | description |
---|---|---|
input | `string | Buffer |
extract | boolean | Determines whether files are to be extracted from the ZIP archive. Use true to extract files or false to obtain a directory listing of the ZIP archive. (default=true) |
filter | string | Filters files from the ZIP archive. Any valid file globbing pattern can be used. If not specified, all files are included by default. |
The API returns an array of files, where each file contains the name and content for each extracted file along with the compressed and uncompressed file size.
attribute | type | description |
---|---|---|
name | string | File-name of the file within the ZIP archive. |
buffer | Buffer | A buffer containing the data extracted from the file in the ZIP archive. Use buffer.toString() to convert to text. |
compressed | number | Compressed size of the file (in bytes). |
uncompressed | number | Uncompressed size of the file (in bytes). |
This API is intended for handling light-weight data extraction that can be easily held in-memory. If dealing with very large archives is a requirement, a lower level streaming interface like the one provided in yauzl should be used instead.
FAQs
Super-simple unzip-to-memory API with file globbing
We found that unzip-simple demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.