Is extract-zip safe to use?

extract-zip has 2 known vulnerabilities on the latest version (2.0.1). DepScope rates its health at 56/100 (high risk).

What is the latest version of extract-zip?

The latest version of extract-zip is 2.0.1, released 2020-06-10.

Does extract-zip have known vulnerabilities?

Yes. extract-zip has 2 known vulnerabilities. See depscope.dev/pkg/npm/extract-zip for details.

Is extract-zip deprecated?

No, extract-zip is actively maintained. Latest release: 2.0.1 (2020-06-10).

What are alternatives to extract-zip?

Popular alternatives to extract-zip in npm include: ?, semver, debug, minimatch.

What license does extract-zip use?

extract-zip is licensed under BSD-2-Clause.

extract-zip

npmv2.0.1

unzip a zip file into a directory using 100% javascript

License BSD-2-Clausepermissive24 versions2 maintainers4 deps18,332,087 weekly dl

maxogden/extract-zip

/ 100

Health

update required

[email protected] has vulnerabilities — update to latest

Moderate health score (56/100) — verify manually
2 high severity vulnerabilities

Health breakdown0 – 100

0/25

maintenance

20/20

popularity

15/25

security

15/15

maturity

6/15

community

0/15

popularity_floor

Vulnerabilities

2 high

Advisories (2)

Severity	ID	Summary	Fixed in
high	CVE-2026-19693	extract-zip allows arbitrary file writes through symlink archive entries	—
high	CVE-2026-56876	extract-zip unvalidated symlink path traversal	—

Bundle & TypeScript

🌟

TypeScript

10/10typed

bundled

Quality signals

OSS Criticality

0.76critical

Download trend

stable(+5.6%)

Publish security

npm signed

Health History

Dependency Tree

License Audit

Dependencies (4)

debug get-stream yauzl @types/yauzl

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/extract-zip