Post

vlt 1.0.5 just dropped 🚢 ⚓️ → Dependency-deduping cuts installs with duplicated deps 40% smaller → Warm cache skips the network entirely → Safe by default: tar decompression-bomb caps & path-traversal hardening before anything writes to disk github.com/vltpkg/vltpk...

26/8/26, 8:00 pm0 reposts4 likes

Are tar path traversals still a thing in npm? I might have a use for that 🫣

Are you talking about paths in a tar escaping the base path? A good package manager should prevent this. I know both npm and vlt do.

I thought so, but the announcement made me doubt if npm fixed it.

🤔 Imma bat this to @evertpot.com @ruyadorno.com who might know more