@patrickdk77/archive-defuse 0.0.0-stage → 0.1.0

package/dist/zipcrypt.d.ts

@@ -0,0 +1,47 @@
+/** The three keys of PKWARE's traditional encryption. */
+export declare class ZipCryptoKeys {
+    private k0;
+    private k1;
+    private k2;
+    constructor(password: Uint8Array);
+    private update;
+    /** Decrypts `data` into a new buffer, moving the keys along. */
+    decrypt(data: Uint8Array): Uint8Array;
+    /** Encrypts `data` into a new buffer, moving the keys along. */
+    encrypt(data: Uint8Array): Uint8Array;
+}
+/** True when the 12-byte header decrypts with `password` to end in `check`, the byte a writer puts there. */
+export declare function zipCryptoOpens(header: Uint8Array, password: Uint8Array, check: number): boolean;
+/** The stored bytes of a traditionally encrypted entry, decrypted, without the 12-byte header. */
+export declare function zipCryptoDecrypt(chunks: AsyncIterable<Uint8Array>, password: Uint8Array): AsyncGenerator<Uint8Array>;
+/** Salt length by AES strength, as WinZip's AE-1 and AE-2 define them. */
+export declare const AES_SALT: Record<number, number>;
+export declare const aesBits: (strength: number) => 128 | 192 | 256 | undefined;
+/** PBKDF2 with HMAC-SHA1, as RFC 8018 defines it. */
+export declare function pbkdf2Sha1(password: Uint8Array, salt: Uint8Array, iterations: number, length: number): Buffer;
+export interface AesKeys {
+    key: Buffer;
+    hmacKey: Buffer;
+    verifier: Buffer;
+}
+/** WinZip's keys from a password and salt: 1,000 rounds of PBKDF2 with HMAC-SHA1. */
+export declare function aesKeys(password: Uint8Array, salt: Uint8Array, bits: 128 | 192 | 256): AesKeys;
+/** AES in counter mode with WinZip's counter, a 128-bit little-endian number that starts at 1, built on AES-ECB. */
+export declare class AesCtr {
+    private readonly counter;
+    private pad;
+    private readonly ecb;
+    constructor(key: Buffer);
+    private nextBlocks;
+    /** XORs `data` with the key stream, which is how this mode both encrypts and decrypts. */
+    apply(data: Uint8Array): Buffer;
+}
+/**
+ * The encrypted data of an AES entry, already without its salt, verifier and authentication code, decrypted. The
+ * HMAC-SHA1 of the encrypted bytes must match the first ten bytes of `mac`.
+ */
+export declare function aesDecrypt(chunks: AsyncIterable<Uint8Array>, keys: AesKeys, mac: Uint8Array): AsyncGenerator<Uint8Array>;
+/** True when the HMAC-SHA1 of the encrypted bytes matches `mac`, without decrypting them. */
+export declare function aesAuthentic(chunks: AsyncIterable<Uint8Array>, hmacKey: Buffer, mac: Uint8Array): Promise<boolean>;
+/** The ways a password's text can become the bytes a writer used: UTF-8, and Latin-1 when that differs. */
+export declare function passwordBytes(password: string): Uint8Array[];

package/dist/zipcrypt.js

@@ -0,0 +1,233 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AesCtr = exports.aesBits = exports.AES_SALT = exports.ZipCryptoKeys = void 0;
+exports.zipCryptoOpens = zipCryptoOpens;
+exports.zipCryptoDecrypt = zipCryptoDecrypt;
+exports.pbkdf2Sha1 = pbkdf2Sha1;
+exports.aesKeys = aesKeys;
+exports.aesDecrypt = aesDecrypt;
+exports.aesAuthentic = aesAuthentic;
+exports.passwordBytes = passwordBytes;
+// The two ways a ZIP entry is commonly encrypted: PKWARE's traditional stream cipher, which is our own code, and
+// WinZip's AES, built only from what OpenSSL's default provider keeps: AES-ECB for the counter mode and HMAC-SHA1
+// for the key derivation and the authentication code.
+const crypto = __importStar(require("node:crypto"));
+const errors_1 = require("./errors");
+const CRC = new Uint32Array(256);
+for (let n = 0; n < 256; n++) {
+    let c = n;
+    for (let k = 0; k < 8; k++)
+        c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+    CRC[n] = c >>> 0;
+}
+const crcByte = (crc, b) => (CRC[(crc ^ b) & 0xff] ^ (crc >>> 8)) >>> 0;
+/** The three keys of PKWARE's traditional encryption. */
+class ZipCryptoKeys {
+    k0 = 0x12345678;
+    k1 = 0x23456789;
+    k2 = 0x34567890;
+    constructor(password) {
+        for (const b of password)
+            this.update(b);
+    }
+    update(b) {
+        this.k0 = crcByte(this.k0, b);
+        this.k1 = (Math.imul((this.k1 + (this.k0 & 0xff)) >>> 0, 134775813) + 1) >>> 0;
+        this.k2 = crcByte(this.k2, this.k1 >>> 24);
+    }
+    /** Decrypts `data` into a new buffer, moving the keys along. */
+    decrypt(data) {
+        const out = new Uint8Array(data.length);
+        for (let i = 0; i < data.length; i++) {
+            const t = (this.k2 | 2) & 0xffff;
+            const p = data[i] ^ ((Math.imul(t, t ^ 1) >>> 8) & 0xff);
+            out[i] = p;
+            this.update(p);
+        }
+        return out;
+    }
+    /** Encrypts `data` into a new buffer, moving the keys along. */
+    encrypt(data) {
+        const out = new Uint8Array(data.length);
+        for (let i = 0; i < data.length; i++) {
+            const t = (this.k2 | 2) & 0xffff;
+            out[i] = data[i] ^ ((Math.imul(t, t ^ 1) >>> 8) & 0xff);
+            this.update(data[i]);
+        }
+        return out;
+    }
+}
+exports.ZipCryptoKeys = ZipCryptoKeys;
+/** True when the 12-byte header decrypts with `password` to end in `check`, the byte a writer puts there. */
+function zipCryptoOpens(header, password, check) {
+    return new ZipCryptoKeys(password).decrypt(header)[11] === check;
+}
+/** The stored bytes of a traditionally encrypted entry, decrypted, without the 12-byte header. */
+async function* zipCryptoDecrypt(chunks, password) {
+    const keys = new ZipCryptoKeys(password);
+    let header = 12;
+    for await (const c of chunks) {
+        const plain = keys.decrypt(c);
+        if (header >= plain.length) {
+            header -= plain.length;
+            continue;
+        }
+        yield plain.subarray(header);
+        header = 0;
+    }
+    if (header)
+        throw new errors_1.DataError('An encrypted entry is shorter than its encryption header', true);
+}
+/** Salt length by AES strength, as WinZip's AE-1 and AE-2 define them. */
+exports.AES_SALT = { 1: 8, 2: 12, 3: 16 };
+const AES_BITS = { 1: 128, 2: 192, 3: 256 };
+/** The only cipher names this module hands to OpenSSL, by key size. */
+const AES_ECB = { 128: 'aes-128-ecb', 192: 'aes-192-ecb', 256: 'aes-256-ecb' };
+const aesBits = (strength) => AES_BITS[strength];
+exports.aesBits = aesBits;
+/**
+ * HMAC-SHA1 with the key's two padded blocks hashed once, as RFC 2104 defines it. Each message then costs two copies
+ * of the started hashes instead of a new HMAC that hashes the key again.
+ */
+class HmacSha1 {
+    inner;
+    outer;
+    constructor(key) {
+        const k = Buffer.alloc(64);
+        (key.length > 64 ? crypto.createHash('sha1').update(key).digest() : Buffer.from(key)).copy(k);
+        this.inner = crypto.createHash('sha1').update(Buffer.from(k.map(b => b ^ 0x36)));
+        this.outer = crypto.createHash('sha1').update(Buffer.from(k.map(b => b ^ 0x5c)));
+    }
+    digest(...parts) {
+        const inner = this.inner.copy();
+        for (const p of parts)
+            inner.update(p);
+        return this.outer.copy().update(inner.digest()).digest();
+    }
+}
+/** PBKDF2 with HMAC-SHA1, as RFC 8018 defines it. */
+function pbkdf2Sha1(password, salt, iterations, length) {
+    const hmac = new HmacSha1(password);
+    const blocks = Math.ceil(length / 20);
+    const out = Buffer.alloc(blocks * 20);
+    for (let i = 1; i <= blocks; i++) {
+        const index = Buffer.alloc(4);
+        index.writeUInt32BE(i);
+        let u = hmac.digest(salt, index);
+        const t = Buffer.from(u);
+        for (let j = 1; j < iterations; j++) {
+            u = hmac.digest(u);
+            for (let k = 0; k < 20; k++)
+                t[k] ^= u[k];
+        }
+        t.copy(out, (i - 1) * 20);
+    }
+    return out.subarray(0, length);
+}
+/** WinZip's keys from a password and salt: 1,000 rounds of PBKDF2 with HMAC-SHA1. */
+function aesKeys(password, salt, bits) {
+    const n = bits / 8;
+    const k = pbkdf2Sha1(password, salt, 1000, n * 2 + 2);
+    return { key: k.subarray(0, n), hmacKey: k.subarray(n, n * 2), verifier: k.subarray(n * 2) };
+}
+/** AES in counter mode with WinZip's counter, a 128-bit little-endian number that starts at 1, built on AES-ECB. */
+class AesCtr {
+    counter = Buffer.alloc(16);
+    pad = Buffer.alloc(0);
+    ecb;
+    constructor(key) {
+        const name = AES_ECB[key.length * 8];
+        if (name === undefined)
+            throw new Error(`No AES cipher for a ${key.length}-byte key`);
+        this.ecb = crypto.createCipheriv(name, key, null);
+        this.ecb.setAutoPadding(false);
+    }
+    nextBlocks(count) {
+        const blocks = Buffer.alloc(count * 16);
+        for (let b = 0; b < count; b++) {
+            for (let i = 0; i < 16; i++) {
+                this.counter[i] = (this.counter[i] + 1) & 0xff;
+                if (this.counter[i] !== 0)
+                    break;
+            }
+            this.counter.copy(blocks, b * 16);
+        }
+        return this.ecb.update(blocks);
+    }
+    /** XORs `data` with the key stream, which is how this mode both encrypts and decrypts. */
+    apply(data) {
+        if (this.pad.length < data.length)
+            this.pad = Buffer.concat([this.pad, this.nextBlocks(Math.ceil((data.length - this.pad.length) / 16))]);
+        const out = Buffer.alloc(data.length);
+        for (let i = 0; i < data.length; i++)
+            out[i] = data[i] ^ this.pad[i];
+        this.pad = this.pad.subarray(data.length);
+        return out;
+    }
+}
+exports.AesCtr = AesCtr;
+/**
+ * The encrypted data of an AES entry, already without its salt, verifier and authentication code, decrypted. The
+ * HMAC-SHA1 of the encrypted bytes must match the first ten bytes of `mac`.
+ */
+async function* aesDecrypt(chunks, keys, mac) {
+    const ctr = new AesCtr(keys.key);
+    const hmac = crypto.createHmac('sha1', keys.hmacKey);
+    for await (const c of chunks) {
+        hmac.update(c);
+        yield ctr.apply(c);
+    }
+    if (Buffer.compare(hmac.digest().subarray(0, 10), Buffer.from(mac)) !== 0)
+        throw new errors_1.DataError('An AES entry does not match its authentication code, so its data or the password is wrong');
+}
+/** True when the HMAC-SHA1 of the encrypted bytes matches `mac`, without decrypting them. */
+async function aesAuthentic(chunks, hmacKey, mac) {
+    const hmac = crypto.createHmac('sha1', hmacKey);
+    for await (const c of chunks)
+        hmac.update(c);
+    return Buffer.compare(hmac.digest().subarray(0, 10), Buffer.from(mac)) === 0;
+}
+/** The ways a password's text can become the bytes a writer used: UTF-8, and Latin-1 when that differs. */
+function passwordBytes(password) {
+    const utf8 = Buffer.from(password, 'utf8');
+    const out = [utf8];
+    if ([...password].every(ch => ch.charCodeAt(0) < 0x100)) {
+        const latin1 = Buffer.from(password, 'latin1');
+        if (!latin1.equals(utf8))
+            out.push(latin1);
+    }
+    return out;
+}

package/dist/zstd.d.ts

@@ -0,0 +1,25 @@
+export interface ZstdFrame {
+    start: number;
+    end: number;
+    /** A skippable frame, whose content every decoder ignores. */
+    skippable: boolean;
+    /** Decompressed size, when the frame header gives it. */
+    contentSize?: number;
+}
+export interface ZstdLayout {
+    frames: ZstdFrame[];
+    /** Bytes after the last frame that start no frame. */
+    trailing: number;
+    trailingZeros: boolean;
+}
+type Read = (offset: number, length: number) => Promise<Uint8Array>;
+export declare const isZstdMagic: (b: Uint8Array) => boolean;
+/**
+ * Walks the frames in [start, end). With `single`, the data must be one frame or more and nothing else, as in a
+ * ZIP entry, and anything that is not a frame is an error. Otherwise the walk stops at the first bytes that are not a
+ * frame, which count as trailing data.
+ */
+export declare function zstdLayout(read: Read, start: number, end: number, single: boolean, check: () => void): Promise<ZstdLayout>;
+/** Compresses `chunks` as one zstd frame with a content checksum. */
+export declare function zstdEncode(chunks: AsyncIterable<Uint8Array>): AsyncGenerator<Uint8Array>;
+export {};

package/dist/zstd.js

@@ -0,0 +1,160 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isZstdMagic = void 0;
+exports.zstdLayout = zstdLayout;
+exports.zstdEncode = zstdEncode;
+// zstd frames. The frame and block headers are read here, so the size of every frame is known without decoding it.
+// Decoding is Node's, and a Node without zstd reads none.
+const zlib = __importStar(require("node:zlib"));
+const codecs_1 = require("./codecs");
+const errors_1 = require("./errors");
+const MAGIC = 0xfd2fb528;
+const MAX_BLOCK = 128 * 1024;
+/** zstd decoders refuse a larger window unless told to allow it, and so does Node's. */
+const MAX_WINDOW = 2 ** 27;
+const u32 = (b, at) => (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+const isZstdMagic = (b) => b.length >= 4 && (u32(b, 0) === MAGIC || (u32(b, 0) & 0xfffffff0) === 0x184d2a50);
+exports.isZstdMagic = isZstdMagic;
+/**
+ * Walks the frames in [start, end). With `single`, the data must be one frame or more and nothing else, as in a
+ * ZIP entry, and anything that is not a frame is an error. Otherwise the walk stops at the first bytes that are not a
+ * frame, which count as trailing data.
+ */
+async function zstdLayout(read, start, end, single, check) {
+    const frames = [];
+    let pos = start;
+    while (pos < end) {
+        check();
+        const head = await read(pos, Math.min(18, end - pos));
+        if (head.length < 4 || !(0, exports.isZstdMagic)(head)) {
+            if (single || frames.length === 0)
+                throw new errors_1.DataError('Data that is not a zstd frame');
+            break;
+        }
+        if (u32(head, 0) !== MAGIC) {
+            if (head.length < 8)
+                throw new errors_1.DataError('A skippable zstd frame ends early', true);
+            const frameEnd = pos + 8 + u32(head, 4);
+            if (frameEnd > end)
+                throw new errors_1.DataError('A skippable zstd frame ends early', true);
+            frames.push({ start: pos, end: frameEnd, skippable: true });
+            pos = frameEnd;
+            continue;
+        }
+        const fhd = head[4];
+        if (fhd === undefined)
+            throw new errors_1.DataError('A zstd frame header ends early', true);
+        if (fhd & 0x08)
+            throw new errors_1.DataError('A zstd frame header sets its reserved bit');
+        const fcsFlag = fhd >> 6;
+        const singleSegment = (fhd >> 5) & 1;
+        const checksum = (fhd >> 2) & 1;
+        const dictFlag = fhd & 3;
+        let p = 5;
+        let window = 0;
+        if (!singleSegment) {
+            const wd = head[p++];
+            const base = 2 ** (10 + (wd >> 3));
+            window = base + (base / 8) * (wd & 7);
+        }
+        const dictBytes = [0, 1, 2, 4][dictFlag];
+        let dictId = 0;
+        for (let i = 0; i < dictBytes; i++)
+            dictId += head[p + i] * 2 ** (8 * i);
+        p += dictBytes;
+        const fcsBytes = [singleSegment ? 1 : 0, 2, 4, 8][fcsFlag];
+        if (p + fcsBytes > head.length)
+            throw new errors_1.DataError('A zstd frame header ends early', true);
+        let contentSize;
+        if (fcsBytes) {
+            contentSize = 0;
+            for (let i = 0; i < fcsBytes; i++)
+                contentSize += head[p + i] * 2 ** (8 * i);
+            if (fcsBytes === 2)
+                contentSize += 256;
+        }
+        p += fcsBytes;
+        if (singleSegment)
+            window = contentSize ?? 0;
+        if (dictId !== 0)
+            throw new errors_1.UnsupportedError('A zstd frame needs a dictionary');
+        if (window > MAX_WINDOW)
+            throw new errors_1.UnsupportedError(`A zstd frame needs a ${window}-byte window, more than decoders allow by default`);
+        const blockMax = Math.min(MAX_BLOCK, Math.max(window, 1));
+        let at = pos + p;
+        for (;;) {
+            check();
+            const bh = await read(at, 3);
+            if (bh.length < 3)
+                throw new errors_1.DataError('A zstd frame ends early', true);
+            const h = bh[0] | (bh[1] << 8) | (bh[2] << 16);
+            const type = (h >> 1) & 3;
+            const size = h >> 3;
+            if (type === 3)
+                throw new errors_1.DataError('A zstd block of the reserved type');
+            if (type !== 1 && size > blockMax)
+                throw new errors_1.DataError('A zstd block is larger than its frame allows');
+            at += 3 + (type === 1 ? 1 : size);
+            if (at > end)
+                throw new errors_1.DataError('A zstd frame ends early', true);
+            if (h & 1)
+                break;
+        }
+        if (checksum)
+            at += 4;
+        if (at > end)
+            throw new errors_1.DataError('A zstd frame ends early', true);
+        frames.push({ start: pos, end: at, skippable: false, contentSize });
+        pos = at;
+    }
+    let trailing = 0;
+    let zeros = true;
+    for (let at = pos; at < end; at += 65536) {
+        const b = await read(at, Math.min(65536, end - at));
+        trailing += b.length;
+        if (zeros && b.some(x => x !== 0))
+            zeros = false;
+    }
+    return { frames, trailing, trailingZeros: zeros };
+}
+/** Compresses `chunks` as one zstd frame with a content checksum. */
+function zstdEncode(chunks) {
+    const make = codecs_1.zstdCompressor;
+    const checksumFlag = zlib.constants.ZSTD_c_checksumFlag;
+    if (!make || checksumFlag === undefined)
+        throw new errors_1.UnsupportedError('This Node has no zstd');
+    return (0, codecs_1.through)(make({ params: { [checksumFlag]: 1 } }), chunks);
+}

package/package.json

@@ -1,6 +1,96 @@
 {
   "name": "@patrickdk77/archive-defuse",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Sanitize zip, tar, gzip, bzip2, zstd, Brotli, cab, 7z, xz and lzma archives. Detects path traversal, links out of the tree, device files, duplicate names, overlapping entries, hidden and prepended data, encrypted entries and compression bombs, hands every entry to file plugins, scores the risk, and writes a defused archive in the same format with no runtime dependencies.",
+  "license": "MIT AND Apache-2.0",
+  "author": "patrickdk77",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "archive-defuse": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true});require('fs').rmSync('build-test',{recursive:true,force:true})\"",
+    "build": "tsc -p tsconfig.json && node scripts/write-esm-wrapper.js && node scripts/copy-notices.js",
+    "build:test": "tsc -p tsconfig.test.json",
+    "lint": "biome check .",
+    "format": "biome format --write .",
+    "test": "npm run lint && npm run build && npm run build:test && mocha --timeout 120000 \"build-test/test/**/*.test.js\"",
+    "prepare": "husky || true",
+    "prepublishOnly": "npm run clean && npm test",
+    "fixtures": "node scripts/make-fixtures.js && node scripts/make-lzma-fixtures.js && node scripts/make-deflate64-fixtures.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/patrickdk77/archive-defuse.git"
+  },
+  "bugs": {
+    "url": "https://github.com/patrickdk77/archive-defuse/issues"
+  },
+  "homepage": "https://github.com/patrickdk77/archive-defuse",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "zip",
+    "tar",
+    "gzip",
+    "bzip2",
+    "zstd",
+    "brotli",
+    "cab",
+    "archive",
+    "sanitize",
+    "sanitise",
+    "scrub",
+    "disarm",
+    "defuse",
+    "cdr",
+    "zip-slip",
+    "path-traversal",
+    "zip-bomb",
+    "security",
+    "inspect",
+    "scanner",
+    "detect",
+    "7z",
+    "7zip",
+    "xz",
+    "lzma",
+    "lzma2",
+    "txz",
+    "deflate64"
+  ],
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.15",
+    "@types/chai": "^5.2.3",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^18.19.130",
+    "chai": "^6.3.0",
+    "husky": "^9.1.7",
+    "lint-staged": "^17.6.0",
+    "mocha": "^12.0.3",
+    "typescript": "^7.0.2"
+  },
+  "lint-staged": {
+    "*.{ts,js,mjs,cjs,json,jsonc}": "biome check --write --no-errors-on-unmatched --files-ignore-unknown=true"
+  }
+}