Extracting archives made easy
55%
Total Score
50
50
83
75
The package has 8 runtime dependencies, including several archive-format-specific packages. This is a moderate maintenance and transitive-risk burden for a small utility.
The package has 41 releases since August 2013, but its latest release was in April 2020 and it has had no releases in the last 12 months. That long release gap is a meaningful maintenance concern.
The repository recorded 0 commits and 0 active maintainers in the last 3 months, indicating no recent development activity. The repository was pushed in January 2023, which provides some historical activity but does not offset the current lull.
The repository has 48 open issues and 4 open pull requests, while the last month had 1 new issue and no closures or merged pull requests. This suggests a backlog with little recent issue resolution.
The repository reports no build tooling and no security scanning tools. For a package that handles archive extraction, the absence of automated security scanning is a hygiene gap.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-39243 decompress is vulnerable to Improper Link Resolution Before File Access ('Link Following') in versions 0.0.0 - 4.2.1. | 0.0.0 - 4.2.1 | Medium |
CVE-2026-10732 decompress is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 4.2.1. | 0.0.0 - 4.2.1 | Medium |
CVE-2020-12265 decompress is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 4.2.1. | 0.0.0 - 4.2.1 | Critical |
| Dependency | Last Release | Score |
|---|---|---|
pify Version ^2.3.0 | — | — |
make-dir Version ^1.0.0 | — | — |
strip-dirs Version ^2.0.0 | — | — |
graceful-fs Version ^4.1.10 | — | — |
decompress-tar Version ^4.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.