extension-from-store 0.2.3 → 0.2.5

package/README.md

@@ -107,7 +107,23 @@ When extraction is disabled, the archive is saved as:
 
 - `.crx`: strip CRX header, extract ZIP payload
 - `.xpi`: treat as ZIP
-- No normalization, no rewriting, no formatting
+- No content normalization, no rewriting, no formatting
+- Unix permission bits from the archive are not preserved: directories come
+  out `0755` and files come out `0644` (`0755` when the archive marked them
+  executable). Some store packages ship entries with modes like `0204` that
+  the owner cannot read back after extraction; browsers ignore archive modes
+  when installing, so this package does too.
+
+## When the store refuses to serve an extension
+
+Stores sometimes decline to serve a listed extension for download. The Chrome
+Web Store update endpoint answers `HTTP 204 No Content` instead of a CRX when
+an extension is blocked, for example when its update check reports
+`_malware="true"` (observed live with ModHeader,
+`idgpnmonknjnojddfkpgkljpfnnfcklj`, on 2026-08-02). This is a store-side
+refusal, not a truncated download: real Chrome clients get the same empty
+response. extension-from-store surfaces it as a `NotPublic` error that names
+the URL that returned no content.
 
 ## `extension.meta.json`
 

package/dist/browser.js

@@ -1,5 +1,5 @@
 import { strFromU8, unzipSync } from "fflate";
-import { createLogger, resolveDownload, extensionFromStoreError, stripCrxHeader, validateInput, parseManifestInfo } from "./588.js";
+import { createLogger, resolveDownload, extensionFromStoreError, stripCrxHeader, validateInput, parseManifestInfo } from "./614.js";
 const TEXT_FILE_PATTERN = /(^|\/)(?:[^/]+\.(?:txt|md|mdx|json|js|jsx|mjs|cjs|ts|tsx|css|scss|sass|less|html|xml|svg|yml|yaml|toml|ini|conf|map)|\.(?:gitignore|npmrc|editorconfig|prettierrc|eslintrc))$/i;
 function getDefaultFetch() {
     if ('function' != typeof globalThis.fetch) throw new extensionFromStoreError('DownloadFailed', 'No fetch implementation was provided');

package/dist/core.js

@@ -1 +1 @@
-export { asExtensionFromStoreError, createLogger, detectStoreFromUrl, extensionFromStoreError, extractChromeIdFromUrl, extractEdgeIdFromUrl, extractFirefoxSlugFromUrl, getChromeDownloadUrl, getEdgeDownloadUrl, normalizeChromePlatformInfo, parseManifestInfo, resolveDownload, resolveFirefoxDownload, sanitizeSegment, stripCrxHeader, validateInput } from "./588.js";
+export { asExtensionFromStoreError, createLogger, detectStoreFromUrl, extensionFromStoreError, extractChromeIdFromUrl, extractEdgeIdFromUrl, extractFirefoxSlugFromUrl, getChromeDownloadUrl, getEdgeDownloadUrl, normalizeChromePlatformInfo, parseManifestInfo, resolveDownload, resolveFirefoxDownload, sanitizeSegment, stripCrxHeader, validateInput } from "./614.js";

package/dist/extract.d.ts

@@ -1,3 +1,3 @@
 export { stripCrxHeader } from './crx';
-export declare function extractCrx(crxPath: string, extractDir: string, workDir: string): Promise<void>;
+export declare function extractCrx(crxPath: string, extractDir: string, _workDir?: string): Promise<void>;
 export declare function extractZipArchive(zipPath: string, extractDir: string): Promise<void>;

package/dist/index.cjs

@@ -63,8 +63,7 @@ class errors_extensionFromStoreError extends Error {
         this.cause = cause;
     }
 }
-const external_extract_zip_namespaceObject = require("extract-zip");
-var external_extract_zip_default = /*#__PURE__*/ __webpack_require__.n(external_extract_zip_namespaceObject);
+const external_fflate_namespaceObject = require("fflate");
 function readUInt32LE(bytes, offset) {
     const view = new DataView(bytes.buffer, bytes.byteOffset + offset, Uint32Array.BYTES_PER_ELEMENT);
     return view.getUint32(0, true);
@@ -92,20 +91,53 @@ function stripCrxHeader(buffer) {
     }
     throw new errors_extensionFromStoreError('ExtractionFailed', `Unsupported CRX version ${version}`);
 }
-async function extractCrx(crxPath, extractDir, workDir) {
+async function normalizeExtractedModes(dir) {
+    await promises_default().chmod(dir, 493);
+    const entries = await promises_default().readdir(dir, {
+        withFileTypes: true
+    });
+    for (const entry of entries){
+        const target = external_node_path_default().join(dir, entry.name);
+        if (entry.isDirectory()) await normalizeExtractedModes(target);
+        else if (entry.isFile()) {
+            const { mode } = await promises_default().stat(target);
+            await promises_default().chmod(target, 73 & mode ? 493 : 420);
+        }
+    }
+}
+async function writeZipEntries(zipData, extractDir) {
+    const root = external_node_path_default().resolve(extractDir);
+    const entries = (0, external_fflate_namespaceObject.unzipSync)(zipData);
+    await promises_default().mkdir(root, {
+        recursive: true
+    });
+    for (const [name, data] of Object.entries(entries)){
+        const normalized = name.replace(/\\/g, '/');
+        const target = external_node_path_default().resolve(root, normalized);
+        const relative = external_node_path_default().relative(root, target);
+        if (!relative || relative.startsWith('..') || external_node_path_default().isAbsolute(relative)) throw new Error(`Refusing to extract zip entry outside the extraction dir: ${name}`);
+        if (normalized.endsWith('/')) {
+            await promises_default().mkdir(target, {
+                recursive: true
+            });
+            continue;
+        }
+        await promises_default().mkdir(external_node_path_default().dirname(target), {
+            recursive: true
+        });
+        await promises_default().writeFile(target, data);
+    }
+}
+async function extractCrx(crxPath, extractDir, _workDir) {
     const crxBuffer = await promises_default().readFile(crxPath);
     const zipBuffer = Buffer.from(stripCrxHeader(crxBuffer));
-    const zipPath = external_node_path_default().join(workDir, 'payload.zip');
-    await promises_default().writeFile(zipPath, zipBuffer);
-    await external_extract_zip_default()(zipPath, {
-        dir: extractDir
-    });
-    await promises_default().unlink(zipPath).catch(()=>void 0);
+    await writeZipEntries(new Uint8Array(zipBuffer), extractDir);
+    await normalizeExtractedModes(extractDir);
 }
 async function extractZipArchive(zipPath, extractDir) {
-    await external_extract_zip_default()(zipPath, {
-        dir: extractDir
-    });
+    const zipBuffer = await promises_default().readFile(zipPath);
+    await writeZipEntries(new Uint8Array(zipBuffer), extractDir);
+    await normalizeExtractedModes(extractDir);
 }
 const external_node_fs_namespaceObject = require("node:fs");
 var external_node_fs_default = /*#__PURE__*/ __webpack_require__.n(external_node_fs_namespaceObject);
@@ -166,7 +198,13 @@ async function downloadToFile(url, filePath, options, maxRedirects = 5) {
         if (401 === statusCode || 403 === statusCode) throw new errors_extensionFromStoreError('NotPublic', 'Extension is not publicly downloadable');
         throw new errors_extensionFromStoreError('DownloadFailed', `Failed to download ${url} (HTTP ${statusCode})`);
     }
+    if (204 === statusCode) {
+        stream.resume();
+        throw new errors_extensionFromStoreError('NotPublic', `Store returned no content for ${url}; the extension is not being served for download`);
+    }
     await (0, external_node_stream_promises_namespaceObject.pipeline)(stream, external_node_fs_default().createWriteStream(filePath));
+    const { size } = await external_node_fs_default().promises.stat(filePath);
+    if (0 === size) throw new errors_extensionFromStoreError('DownloadFailed', `Downloaded file from ${url} is empty`);
 }
 async function requestJson(url, options, maxRedirects = 5) {
     const { statusCode, headers, stream } = await request(url, options);

package/dist/index.js

@@ -1,27 +1,60 @@
 import promises from "node:fs/promises";
 import node_os from "node:os";
 import node_path from "node:path";
-import extract_zip from "extract-zip";
+import { unzipSync } from "fflate";
 import node_fs from "node:fs";
 import node_http from "node:http";
 import node_https from "node:https";
 import { pipeline } from "node:stream/promises";
 import { URL } from "node:url";
-import { createLogger, stripCrxHeader, extensionFromStoreError as errors_extensionFromStoreError, resolveDownload, sanitizeSegment, validateInput, parseManifestInfo } from "./588.js";
-async function extractCrx(crxPath, extractDir, workDir) {
+import { createLogger, stripCrxHeader, extensionFromStoreError as errors_extensionFromStoreError, resolveDownload, sanitizeSegment, validateInput, parseManifestInfo } from "./614.js";
+async function normalizeExtractedModes(dir) {
+    await promises.chmod(dir, 493);
+    const entries = await promises.readdir(dir, {
+        withFileTypes: true
+    });
+    for (const entry of entries){
+        const target = node_path.join(dir, entry.name);
+        if (entry.isDirectory()) await normalizeExtractedModes(target);
+        else if (entry.isFile()) {
+            const { mode } = await promises.stat(target);
+            await promises.chmod(target, 73 & mode ? 493 : 420);
+        }
+    }
+}
+async function writeZipEntries(zipData, extractDir) {
+    const root = node_path.resolve(extractDir);
+    const entries = unzipSync(zipData);
+    await promises.mkdir(root, {
+        recursive: true
+    });
+    for (const [name, data] of Object.entries(entries)){
+        const normalized = name.replace(/\\/g, '/');
+        const target = node_path.resolve(root, normalized);
+        const relative = node_path.relative(root, target);
+        if (!relative || relative.startsWith('..') || node_path.isAbsolute(relative)) throw new Error(`Refusing to extract zip entry outside the extraction dir: ${name}`);
+        if (normalized.endsWith('/')) {
+            await promises.mkdir(target, {
+                recursive: true
+            });
+            continue;
+        }
+        await promises.mkdir(node_path.dirname(target), {
+            recursive: true
+        });
+        await promises.writeFile(target, data);
+    }
+}
+async function extractCrx(crxPath, extractDir, _workDir) {
     const crxBuffer = await promises.readFile(crxPath);
     const zipBuffer = Buffer.from(stripCrxHeader(crxBuffer));
-    const zipPath = node_path.join(workDir, 'payload.zip');
-    await promises.writeFile(zipPath, zipBuffer);
-    await extract_zip(zipPath, {
-        dir: extractDir
-    });
-    await promises.unlink(zipPath).catch(()=>void 0);
+    await writeZipEntries(new Uint8Array(zipBuffer), extractDir);
+    await normalizeExtractedModes(extractDir);
 }
 async function extractZipArchive(zipPath, extractDir) {
-    await extract_zip(zipPath, {
-        dir: extractDir
-    });
+    const zipBuffer = await promises.readFile(zipPath);
+    await writeZipEntries(new Uint8Array(zipBuffer), extractDir);
+    await normalizeExtractedModes(extractDir);
 }
 const DEFAULT_USER_AGENT = 'extension-from-store';
 function request(url, options) {
@@ -67,7 +100,13 @@ async function downloadToFile(url, filePath, options, maxRedirects = 5) {
         if (401 === statusCode || 403 === statusCode) throw new errors_extensionFromStoreError('NotPublic', 'Extension is not publicly downloadable');
         throw new errors_extensionFromStoreError('DownloadFailed', `Failed to download ${url} (HTTP ${statusCode})`);
     }
+    if (204 === statusCode) {
+        stream.resume();
+        throw new errors_extensionFromStoreError('NotPublic', `Store returned no content for ${url}; the extension is not being served for download`);
+    }
     await pipeline(stream, node_fs.createWriteStream(filePath));
+    const { size } = await node_fs.promises.stat(filePath);
+    if (0 === size) throw new errors_extensionFromStoreError('DownloadFailed', `Downloaded file from ${url} is empty`);
 }
 async function requestJson(url, options, maxRedirects = 5) {
     const { statusCode, headers, stream } = await request(url, options);
@@ -203,5 +242,5 @@ async function fetchExtensionFromStore(url, options = {}) {
         }).catch(()=>void 0);
     }
 }
-export { extensionFromStoreError } from "./588.js";
+export { extensionFromStoreError } from "./614.js";
 export { fetchExtensionFromStore };

package/package.json

@@ -9,7 +9,7 @@
   },
   "engineStrict": false,
   "name": "extension-from-store",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Download public browser extensions from official stores",
   "homepage": "https://www.npmjs.com/package/extension-from-store",
   "type": "module",
@@ -79,7 +79,6 @@
     "extension-download"
   ],
   "dependencies": {
-    "extract-zip": "^2.0.1",
     "fflate": "^0.8.3"
   },
   "pnpm": {
@@ -97,12 +96,12 @@
     }
   },
   "devDependencies": {
-    "@rslib/core": "^0.23.0",
-    "@types/node": "^25.9.3",
-    "eslint": "^10.5.0",
-    "eslint-config-auditor": "^2.3.1",
+    "@rslib/core": "^0.23.2",
+    "@types/node": "^26.1.1",
+    "eslint": "^10.8.0",
+    "eslint-config-auditor": "^3.0.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10"
   },
   "packageManager": "pnpm@9.9.0+sha512.60c18acd138bff695d339be6ad13f7e936eea6745660d4cc4a776d5247c540d0edee1a563695c183a66eb917ef88f2b4feb1fc25f32a7adcadc7aaf3438e99c1",
   "bugs": "https://github.com/cezaraugusto/extension-from-store/issues",