The risk of using abandoned packages in the age of LLMs
%20copy.jpg)
.png)
This post is an unfortunate affirmation of our prior research into abandoned open-source packages, where we found that 11% of the most-downloaded packages have been abandoned and not actively maintained, becoming invisible vulnerabilities to your scanner.
Today we share a zip-slip vulnerability we found in extract-zip (CVE-2026-19693), an npm package with over 20 million weekly downloads. Despite numerous attempts to contact the maintainer, as part of our responsible disclosure policy, we received no reply and are now reluctantly publishing this information publicly in hope users move away from this package.
All published versions of extract-zip are affected by an arbitrary file write vulnerability when extracting a non-trusted archive file. We implore everyone to move away from this package or apply our publicly available fix.
If you are affected by vulnerable dependencies you cannot drop, Seal Security ships this same fix as a patched, version-compatible build that goes straight into your dependency tree.
Sad stroll down memory lane
Using our abandoned-check skill on the repository for extract-zip clearly demonstrates that it is not maintained:
- The maintainer was looking for replacements back in 2018!
- There have been no commits for the past 5 years
- The latest release on npm/GitHub was even earlier, in 2020
We probably weren't the first to notice this, as scouring over the issue page of the repository yields several older complaints:
- since 2023: symlinks inside an archive reach a zip-slip-equivalent
- since 2025: request for security policy, claims to have found an issue
- this year: reports lack of defense against zip bombs
- this year: reports arbitrary file write via symlink, removed technical details
None of these reports ever received a CVE identifier, as this relies on either the maintainer or a third-party to assign. Without a CNA taking initiative - the issues don't make their way to your scanners, giving a false sense of security.
It's just too easy
The asymmetry of vulnerability research leveraged by LLMs, while could be used for good, it allows anyone to quickly find and exploit vulnerabilities. It's now pointless to hide any technical information in a public disclosure, especially for open source code.
Even without any guidance, no exploit-finding skills, and without using the new Mythos model, a short prompt found the vulnerability in question and created a PoC within minutes while I was making coffee:
"perform a security audit on the npm package extract-zip"
yielded:
## Finding 1 — Arbitrary file write via symlink final component (HIGH)
**Root cause.** For every entry, `extract()` guards the **parent directory** of the destination: it `realpath`s `path.dirname(dest)` and rejects it if it resolves outside `opts.dir` (`index.js:53-63`). This correctly stops writes *through* a symlinked directory. But the **final path component is never `lstat`'d or checked**. The write happens with:
...How the escape works
extract-zip does have some protections - for every entry it checks the directory and throws if that resolves outside the destination directory, which was added in 1.6.1 in 2017.
However, only the directory name of each entry is actually checked, while the write operation on the full path dest (index.js:132) points to an existing symlink. Therefore to exploit this an archive only needs 2 entries:
- a symlink file
<in-archive-folder>/pwn->/tmp/pwn - a normal file
<in-archive-folder>/pwn
As long as they are correctly ordered in the archive's central directory, they will be written without issue.
Impact
Luckily, most of the usage of extract-zip comes from older @puppeteer/browsers, which has wisely removed it by version 3.0.0 and denounced it for security and stability concerns:
Recent surges in vulnerabilities in the ecosystem and the data corruption issue with extract-zip led us to re-consider using community packages for extracting archives for now...
However, any codebase using this package that tries to extract a user-supplied archive is susceptible to an arbitrary file write vulnerability.
Affected versions
All published versions of extract-zip are vulnerable.
Remediation
We opened a pull request with a fix including a regression test.
Waiting on that to be merged seems pointless, so we're sharing a patch you can apply to your on-disk dependency for version 2.0.1:
steps:
- save the file as
CVE-2026-19693.patch - cd into the extract-zip folder inside your
node_modules - run
patch -p1 < PATCH_FILE_PATH
diff --git a/index.js b/index.js
--- a/index.js
+++ b/index.js
@@ -129,7 +129,12 @@
debug('creating symlink', link, dest)
await fs.symlink(link, dest)
} else {
+ const existing = await fs.lstat(dest).catch(() => null)
+ if (existing && existing.isSymbolicLink()) {
+ throw new Error(`Out of bound path "${dest}" found while processing file ${entry.fileName}`)
+ }
+
await pipeline(readStream, createWriteStream(dest, { mode: procMode }))
}
}How Seal Security can help
extract-zip is a perfect example of a transitive dependency you're usually stuck being unable to upgrade. Seal Security ships the backwards-compatible patched version straight into your dependency tree that can be used in your projects without having to upgrade anything.
Disclosure timeline
- 2026-04-11: first contact attempt with maintainer via mail
- 2026-04-30: second contact attempt via GitHub issue
- 2026-08-13: Seal Security assigned a CVE
- 2026-08-17: public disclosure
.png)
