mirror of
https://github.com/lancedikson/bowser
synced 2026-09-22 20:14:20 +00:00
Replaces the external tar process with zlib.gunzipSync plus a minimal ustar reader, so the smoke test spawns nothing but Node and behaves identically on every OS and Node version in the matrix. npm tarballs are gzipped ustar archives of regular files only, which is the one shape the reader accepts; a path-escape guard rejects anything else.