Package Health

decompress

Extracting archives made easy

Latest 4.2.1NPMNPM

55%

Total Score

Maintainer Stability
Maintainer Stability
Assesses the consistency and reliability of package maintainers

50

Dependencies
Dependencies
Evaluates the health and security of package dependencies

50

Maturity
Maturity
Indicates package age, release frequency, and adoption metrics

83

Supply Chain
Supply Chain
Evaluates supply chain security practices and risks

75

Are you affected? Scan for Free

Health Score Breakdown

Dependency profilecaution

The package has 8 runtime dependencies, including several archive-format-specific packages. This is a moderate maintenance and transitive-risk burden for a small utility.

Release historycaution

The package has 41 releases since August 2013, but its latest release was in April 2020 and it has had no releases in the last 12 months. That long release gap is a meaningful maintenance concern.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, indicating no recent development activity. The repository was pushed in January 2023, which provides some historical activity but does not offset the current lull.

Repo issue activitycaution

The repository has 48 open issues and 4 open pull requests, while the last month had 1 new issue and no closures or merged pull requests. This suggests a backlog with little recent issue resolution.

Repo toolingcaution

The repository reports no build tooling and no security scanning tools. For a package that handles archive extraction, the absence of automated security scanning is a hygiene gap.

Vulnerabilities

TitleVersionsSeverity
CVE-2026-39243
decompress is vulnerable to Improper Link Resolution Before File Access ('Link Following') in versions 0.0.0 - 4.2.1.
0.0.0 - 4.2.1
Medium
CVE-2026-10732
decompress is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 4.2.1.
0.0.0 - 4.2.1
Medium
CVE-2020-12265
decompress is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 4.2.1.
0.0.0 - 4.2.1
Critical

Package versions

Direct Dependencies

DependencyLast ReleaseScore
pify
Version ^2.3.0
—
—
make-dir
Version ^1.0.0
—
—
strip-dirs
Version ^2.0.0
—
—
graceful-fs
Version ^4.1.10
—
—
decompress-tar
Version ^4.0.0
—
—

Weekly Downloads

Info

Last Published
6 years ago
Created
13 years ago
Unpacked Size
0.1 MB

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform