Gathering detailed insights and metrics for unzip-stream
Gathering detailed insights and metrics for unzip-stream
Gathering detailed insights and metrics for unzip-stream
Gathering detailed insights and metrics for unzip-stream
npm install unzip-stream
Typescript
Module System
Node Version
NPM Version
JavaScript (100%)
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
MIT License
79 Stars
141 Commits
31 Forks
1 Watchers
3 Branches
1 Contributors
Updated on Jun 23, 2025
Latest Version
0.3.4
Package Id
unzip-stream@0.3.4
Unpacked Size
39.27 kB
Size
9.75 kB
File Count
9
NPM Version
9.5.1
Node Version
18.16.0
Published on
Apr 20, 2024
Cumulative downloads
Total Downloads
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Streaming cross-platform unzip tool written in node.js.
This package is based on unzip (and its fork unzipper) and provides simple APIs for parsing and extracting zip files. It uses new streaming engine which allows it to process also files which would fail with unzip. There are no added compiled dependencies - inflation is handled by node.js's built in zlib support.
Please note that the zip file format isn't really meant to be processed by streaming, though this library should succeed in most cases, if you do have complete zip file available, you should consider using other libraries which read zip files from the end - as originally intended (for example yauzl or decompress-zip).
1$ npm install unzip-stream
Process each zip file entry or pipe entries to another stream.
Important: If you do not intend to consume an entry stream's raw data, call autodrain() to dispose of the entry's contents. Otherwise the stream will get stuck.
1fs.createReadStream('path/to/archive.zip') 2 .pipe(unzip.Parse()) 3 .on('entry', function (entry) { 4 var filePath = entry.path; 5 var type = entry.type; // 'Directory' or 'File' 6 var size = entry.size; // might be undefined in some archives 7 if (filePath === "this IS the file I'm looking for") { 8 entry.pipe(fs.createWriteStream('output/path')); 9 } else { 10 entry.autodrain(); 11 } 12 });
If you pipe
from unzip-stream the downstream components will receive each entry
for further processing. This allows for clean pipelines transforming zipfiles into unzipped data.
Example using stream.Transform
:
1fs.createReadStream('path/to/archive.zip')
2 .pipe(unzip.Parse())
3 .pipe(stream.Transform({
4 objectMode: true,
5 transform: function(entry,e,cb) {
6 var filePath = entry.path;
7 var type = entry.type; // 'Directory' or 'File'
8 var size = entry.size;
9 if (filePath === "this IS the file I'm looking for") {
10 entry.pipe(fs.createWriteStream('output/path'))
11 .on('finish',cb);
12 } else {
13 entry.autodrain();
14 cb();
15 }
16 }
17 }
18 }));
1fs.createReadStream('path/to/archive.zip').pipe(unzip.Extract({ path: 'output/path' }));
Extract will emit the 'close' event when the archive is fully extracted, do NOT use the 'finish' event, which can be emitted before the writing finishes.
The Parse
and Extract
methods allow passing an object with decodeString
property which will be used to decode non-utf8 file names in the archive. If not specified a fallback will be used.
1let parser = unzip.Parse({ decodeString: (buffer) => { return iconvLite.decode(buffer, 'iso-8859-2'); } }); 2input.pipe(parser).pipe(...);
Currently ZIP files up to version 4.5 are supported (which includes Zip64 support - archives with 4GB+ files). There's no support for encrypted (password protected) zips, or symlinks.
7.5/10
Summary
unzip-stream allows Arbitrary File Write via artifact extraction
Affected Versions
< 0.3.2
Patched Versions
0.3.2
Reason
no binaries found in the repo
Reason
license file detected
Details
Reason
0 existing vulnerabilities detected
Reason
Found 5/24 approved changesets -- score normalized to 2
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
Reason
project is not fuzzed
Details
Reason
branch protection not enabled on development/release branches
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Score
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More