Download Latest Version v4.3.1 source code.zip (1.2 MB) Google Add to Preferred Sources
Home / v4.2.1
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-07-21 2.3 kB
v4.2.1 source code.tar.gz 2026-07-21 1.1 MB
v4.2.1 source code.zip 2026-07-21 1.2 MB
Totals: 3 Items   2.3 MB 0

4.2.1 (2026-07-21)

Bug Fixes

  • add circular symlink detection and depth limit protection (#423) (fd0fcd8)
  • add DoS validation for asar archive headers and file entries (#419) (51cd188)
  • add header validation for ASAR archives (#421) (00e5293)
  • add offset validation to readFileSync to prevent out-of-bounds reads (#420) (97c09cc)
  • add path validation to prevent directory traversal attacks (#418) (de0689b)
  • compute integrity over transformed bytes when a transform is applied (#450) (8c9be01), closes #277
  • constrain extractFile reads to the unpacked directory (#451) (1f4b01d)
  • improve symlink validation to prevent directory traversal attacks (#422) (c43f92b)
  • replace commander with native Node.js parseArgs (#416) (42b25d0)
  • resolve absolute symlink targets correctly when packing (#452) (0087cfa), closes #366
Source: README.md, updated 2026-07-21