Security: isaacs/node-tar

Security

Report a vulnerability

SECURITY.md

Security Policy

This document covers the policy and procedures for reporting security vulnerabilities in all of my repositories.

If your report does not comply with the guidance here, then it may be summarily closed. Doing this is a waste of your time as a security researcher, and mine as a maintainer, and thus makes the entire ecosystem slightly less secure, as that effort could be better spent.

Read the README.md FIRST

Many libraries are designed in a way that is fundamentally impossible to harden against malicious input, and it is called out as the user's responsibility to only provide trusted input to these.

For example, libraries that generate regular expressions will generally always be subject to ReDOS attacks. The rimraf library is a module for use in deleting files, and so can be used to delete files.

If you are using my libraries in a way that is known to be insecure, then you are exposing yourself and your users to risks that I cannot help prevent.

Please do not waste your time and mine reporting vulnerabilities at are already explicitly called out as known risks in the README.md.

Supported Versions

While reports for any version are allowed and may be accepted if valid, typically only the most recent version of a library is supported for fixing security vulnerabilities.

In rare cases, especially when the most recent major version is very new and has not diverged much from the prior major version branch, security fixes may be backported. But this is not the norm.

It is not my responsibility to backport fixes. It is your responsibility to stay up to date.

If you are using unsupported versions of libraries in a security-sensitive application, then you are exposing yourself and your users to risks that I cannot help prevent.

Please do not waste your time and mine reporting security vulnerabilities that apply to old versions, when they were already reported and fixed in the latest version. If a backport was not provided, that's because it will not be provided.

Report Vulnerabilities via GitHub Security Advisories

Please report all security vulnerabilities through GitHub Security Advisories. This allows us to collaborate on investigation, remediation, and correction, while maintaining confidentiality until it is safe to disclose responsibly and accurately.

Reports via email are likely to be missed, ignored, or flagged as spam.

Reports via normal GitHub issues are public, and this is not responsible disclosure. These issues will be deleted.

To report a vulnerability (docs):

  1. Visit the Security tab of the affected repository on GitHub.
  2. Click Report a vulnerability and follow the provided steps.
Learn more about advisories related to isaacs/node-tar in the GitHub Advisory Database
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: isaacs/node-tar
Security
Report a vulnerability

SECURITY.md

Security Policy
This document covers the policy and procedures for reporting
security vulnerabilities in all of my repositories.
If your report does not comply with the guidance here, then it
may be summarily closed. Doing this is a waste of your time as a
security researcher, and mine as a maintainer, and thus makes the
entire ecosystem slightly less secure, as that effort could be
better spent.
Read the README.md FIRST
Many libraries are designed in a way that is fundamentally
impossible to harden against malicious input, and it is called
out as the user's responsibility to only provide trusted input to
these.
For example, libraries that generate regular expressions will
generally always be subject to ReDOS attacks. The
rimraf library is a module
for use in deleting files, and so can be used to delete files.
If you are using my libraries in a way that is known to be
insecure, then you are exposing yourself and your users to risks
that I cannot help prevent.
Please do not waste your time and mine reporting
vulnerabilities at are already explicitly called out as known
risks in the README.md.
Supported Versions
While reports for any version are allowed and may be accepted if
valid, typically only the most recent version of a library is
supported for fixing security vulnerabilities.
In rare cases, especially when the most recent major version is
very new and has not diverged much from the prior major version
branch, security fixes may be backported. But this is not the
norm.
It is not my responsibility to backport fixes. It is your
responsibility to stay up to date.
If you are using unsupported versions of libraries in a
security-sensitive application, then you are exposing yourself
and your users to risks that I cannot help prevent.
Please do not waste your time and mine reporting security
vulnerabilities that apply to old versions, when they were
already reported and fixed in the latest version. If a backport
was not provided, that's because it will not be provided.
Report Vulnerabilities via GitHub Security Advisories
Please report all security vulnerabilities through
GitHub Security Advisories.
This allows us to collaborate on investigation, remediation, and
correction, while maintaining confidentiality until it is safe to
disclose responsibly and accurately.
Reports via email are likely to be missed, ignored, or flagged as
spam.
Reports via normal GitHub issues are public, and this is not
responsible disclosure. These issues will be deleted.
To report a vulnerability
(docs):
  1. Visit the Security tab of the affected repository on
GitHub.
  2. Click Report a vulnerability and follow the provided
steps.
 Learn more about advisories related to isaacs/node-tar in the GitHub Advisory Database

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: isaacs/node-tar
Security
Report a vulnerability

SECURITY.md

Security Policy
This document covers the policy and procedures for reporting
security vulnerabilities in all of my repositories.
If your report does not comply with the guidance here, then it
may be summarily closed. Doing this is a waste of your time as a
security researcher, and mine as a maintainer, and thus makes the
entire ecosystem slightly less secure, as that effort could be
better spent.
Read the README.md FIRST
Many libraries are designed in a way that is fundamentally
impossible to harden against malicious input, and it is called
out as the user's responsibility to only provide trusted input to
these.
For example, libraries that generate regular expressions will
generally always be subject to ReDOS attacks. The
rimraf library is a module
for use in deleting files, and so can be used to delete files.
If you are using my libraries in a way that is known to be
insecure, then you are exposing yourself and your users to risks
that I cannot help prevent.
Please do not waste your time and mine reporting
vulnerabilities at are already explicitly called out as known
risks in the README.md.
Supported Versions
While reports for any version are allowed and may be accepted if
valid, typically only the most recent version of a library is
supported for fixing security vulnerabilities.
In rare cases, especially when the most recent major version is
very new and has not diverged much from the prior major version
branch, security fixes may be backported. But this is not the
norm.
It is not my responsibility to backport fixes. It is your
responsibility to stay up to date.
If you are using unsupported versions of libraries in a
security-sensitive application, then you are exposing yourself
and your users to risks that I cannot help prevent.
Please do not waste your time and mine reporting security
vulnerabilities that apply to old versions, when they were
already reported and fixed in the latest version. If a backport
was not provided, that's because it will not be provided.
Report Vulnerabilities via GitHub Security Advisories
Please report all security vulnerabilities through
GitHub Security Advisories.
This allows us to collaborate on investigation, remediation, and
correction, while maintaining confidentiality until it is safe to
disclose responsibly and accurately.
Reports via email are likely to be missed, ignored, or flagged as
spam.
Reports via normal GitHub issues are public, and this is not
responsible disclosure. These issues will be deleted.
To report a vulnerability
(docs):
  1. Visit the Security tab of the affected repository on
GitHub.
  2. Click Report a vulnerability and follow the provided
steps.
 Learn more about advisories related to isaacs/node-tar in the GitHub Advisory Database

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: isaacs/node-tar
Security
Report a vulnerability

SECURITY.md

Security Policy
This document covers the policy and procedures for reporting
security vulnerabilities in all of my repositories.
If your report does not comply with the guidance here, then it
may be summarily closed. Doing this is a waste of your time as a
security researcher, and mine as a maintainer, and thus makes the
entire ecosystem slightly less secure, as that effort could be
better spent.
Read the README.md FIRST
Many libraries are designed in a way that is fundamentally
impossible to harden against malicious input, and it is called
out as the user's responsibility to only provide trusted input to
these.
For example, libraries that generate regular expressions will
generally always be subject to ReDOS attacks. The
rimraf library is a module
for use in deleting files, and so can be used to delete files.
If you are using my libraries in a way that is known to be
insecure, then you are exposing yourself and your users to risks
that I cannot help prevent.
Please do not waste your time and mine reporting
vulnerabilities at are already explicitly called out as known
risks in the README.md.
Supported Versions
While reports for any version are allowed and may be accepted if
valid, typically only the most recent version of a library is
supported for fixing security vulnerabilities.
In rare cases, especially when the most recent major version is
very new and has not diverged much from the prior major version
branch, security fixes may be backported. But this is not the
norm.
It is not my responsibility to backport fixes. It is your
responsibility to stay up to date.
If you are using unsupported versions of libraries in a
security-sensitive application, then you are exposing yourself
and your users to risks that I cannot help prevent.
Please do not waste your time and mine reporting security
vulnerabilities that apply to old versions, when they were
already reported and fixed in the latest version. If a backport
was not provided, that's because it will not be provided.
Report Vulnerabilities via GitHub Security Advisories
Please report all security vulnerabilities through
GitHub Security Advisories.
This allows us to collaborate on investigation, remediation, and
correction, while maintaining confidentiality until it is safe to
disclose responsibly and accurately.
Reports via email are likely to be missed, ignored, or flagged as
spam.
Reports via normal GitHub issues are public, and this is not
responsible disclosure. These issues will be deleted.
To report a vulnerability
(docs):
  1. Visit the Security tab of the affected repository on
GitHub.
  2. Click Report a vulnerability and follow the provided
steps.
 Learn more about advisories related to isaacs/node-tar in the GitHub Advisory Database

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: isaacs/node-tar
Security
Report a vulnerability

SECURITY.md

Security Policy
This document covers the policy and procedures for reporting
security vulnerabilities in all of my repositories.
If your report does not comply with the guidance here, then it
may be summarily closed. Doing this is a waste of your time as a
security researcher, and mine as a maintainer, and thus makes the
entire ecosystem slightly less secure, as that effort could be
better spent.
Read the README.md FIRST
Many libraries are designed in a way that is fundamentally
impossible to harden against malicious input, and it is called
out as the user's responsibility to only provide trusted input to
these.
For example, libraries that generate regular expressions will
generally always be subject to ReDOS attacks. The
rimraf library is a module
for use in deleting files, and so can be used to delete files.
If you are using my libraries in a way that is known to be
insecure, then you are exposing yourself and your users to risks
that I cannot help prevent.
Please do not waste your time and mine reporting
vulnerabilities at are already explicitly called out as known
risks in the README.md.
Supported Versions
While reports for any version are allowed and may be accepted if
valid, typically only the most recent version of a library is
supported for fixing security vulnerabilities.
In rare cases, especially when the most recent major version is
very new and has not diverged much from the prior major version
branch, security fixes may be backported. But this is not the
norm.
It is not my responsibility to backport fixes. It is your
responsibility to stay up to date.
If you are using unsupported versions of libraries in a
security-sensitive application, then you are exposing yourself
and your users to risks that I cannot help prevent.
Please do not waste your time and mine reporting security
vulnerabilities that apply to old versions, when they were
already reported and fixed in the latest version. If a backport
was not provided, that's because it will not be provided.
Report Vulnerabilities via GitHub Security Advisories
Please report all security vulnerabilities through
GitHub Security Advisories.
This allows us to collaborate on investigation, remediation, and
correction, while maintaining confidentiality until it is safe to
disclose responsibly and accurately.
Reports via email are likely to be missed, ignored, or flagged as
spam.
Reports via normal GitHub issues are public, and this is not
responsible disclosure. These issues will be deleted.
To report a vulnerability
(docs):
  1. Visit the Security tab of the affected repository on
GitHub.
  2. Click Report a vulnerability and follow the provided
steps.
 Learn more about advisories related to isaacs/node-tar in the GitHub Advisory Database

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: isaacs/node-tar
Security
Report a vulnerability

SECURITY.md

Security Policy
This document covers the policy and procedures for reporting
security vulnerabilities in all of my repositories.
If your report does not comply with the guidance here, then it
may be summarily closed. Doing this is a waste of your time as a
security researcher, and mine as a maintainer, and thus makes the
entire ecosystem slightly less secure, as that effort could be
better spent.
Read the README.md FIRST
Many libraries are designed in a way that is fundamentally
impossible to harden against malicious input, and it is called
out as the user's responsibility to only provide trusted input to
these.
For example, libraries that generate regular expressions will
generally always be subject to ReDOS attacks. The
rimraf library is a module
for use in deleting files, and so can be used to delete files.
If you are using my libraries in a way that is known to be
insecure, then you are exposing yourself and your users to risks
that I cannot help prevent.
Please do not waste your time and mine reporting
vulnerabilities at are already explicitly called out as known
risks in the README.md.
Supported Versions
While reports for any version are allowed and may be accepted if
valid, typically only the most recent version of a library is
supported for fixing security vulnerabilities.
In rare cases, especially when the most recent major version is
very new and has not diverged much from the prior major version
branch, security fixes may be backported. But this is not the
norm.
It is not my responsibility to backport fixes. It is your
responsibility to stay up to date.
If you are using unsupported versions of libraries in a
security-sensitive application, then you are exposing yourself
and your users to risks that I cannot help prevent.
Please do not waste your time and mine reporting security
vulnerabilities that apply to old versions, when they were
already reported and fixed in the latest version. If a backport
was not provided, that's because it will not be provided.
Report Vulnerabilities via GitHub Security Advisories
Please report all security vulnerabilities through
GitHub Security Advisories.
This allows us to collaborate on investigation, remediation, and
correction, while maintaining confidentiality until it is safe to
disclose responsibly and accurately.
Reports via email are likely to be missed, ignored, or flagged as
spam.
Reports via normal GitHub issues are public, and this is not
responsible disclosure. These issues will be deleted.
To report a vulnerability
(docs):
  1. Visit the Security tab of the affected repository on
GitHub.
  2. Click Report a vulnerability and follow the provided
steps.
 Learn more about advisories related to isaacs/node-tar in the GitHub Advisory Database

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: isaacs/node-tar
Security
Report a vulnerability

SECURITY.md

Security Policy
This document covers the policy and procedures for reporting
security vulnerabilities in all of my repositories.
If your report does not comply with the guidance here, then it
may be summarily closed. Doing this is a waste of your time as a
security researcher, and mine as a maintainer, and thus makes the
entire ecosystem slightly less secure, as that effort could be
better spent.
Read the README.md FIRST
Many libraries are designed in a way that is fundamentally
impossible to harden against malicious input, and it is called
out as the user's responsibility to only provide trusted input to
these.
For example, libraries that generate regular expressions will
generally always be subject to ReDOS attacks. The
rimraf library is a module
for use in deleting files, and so can be used to delete files.
If you are using my libraries in a way that is known to be
insecure, then you are exposing yourself and your users to risks
that I cannot help prevent.
Please do not waste your time and mine reporting
vulnerabilities at are already explicitly called out as known
risks in the README.md.
Supported Versions
While reports for any version are allowed and may be accepted if
valid, typically only the most recent version of a library is
supported for fixing security vulnerabilities.
In rare cases, especially when the most recent major version is
very new and has not diverged much from the prior major version
branch, security fixes may be backported. But this is not the
norm.
It is not my responsibility to backport fixes. It is your
responsibility to stay up to date.
If you are using unsupported versions of libraries in a
security-sensitive application, then you are exposing yourself
and your users to risks that I cannot help prevent.
Please do not waste your time and mine reporting security
vulnerabilities that apply to old versions, when they were
already reported and fixed in the latest version. If a backport
was not provided, that's because it will not be provided.
Report Vulnerabilities via GitHub Security Advisories
Please report all security vulnerabilities through
GitHub Security Advisories.
This allows us to collaborate on investigation, remediation, and
correction, while maintaining confidentiality until it is safe to
disclose responsibly and accurately.
Reports via email are likely to be missed, ignored, or flagged as
spam.
Reports via normal GitHub issues are public, and this is not
responsible disclosure. These issues will be deleted.
To report a vulnerability
(docs):
  1. Visit the Security tab of the affected repository on
GitHub.
  2. Click Report a vulnerability and follow the provided
steps.
 Learn more about advisories related to isaacs/node-tar in the GitHub Advisory Database

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: isaacs/node-tar
Security
Report a vulnerability

SECURITY.md

Security Policy
This document covers the policy and procedures for reporting
security vulnerabilities in all of my repositories.
If your report does not comply with the guidance here, then it
may be summarily closed. Doing this is a waste of your time as a
security researcher, and mine as a maintainer, and thus makes the
entire ecosystem slightly less secure, as that effort could be
better spent.
Read the README.md FIRST
Many libraries are designed in a way that is fundamentally
impossible to harden against malicious input, and it is called
out as the user's responsibility to only provide trusted input to
these.
For example, libraries that generate regular expressions will
generally always be subject to ReDOS attacks. The
rimraf library is a module
for use in deleting files, and so can be used to delete files.
If you are using my libraries in a way that is known to be
insecure, then you are exposing yourself and your users to risks
that I cannot help prevent.
Please do not waste your time and mine reporting
vulnerabilities at are already explicitly called out as known
risks in the README.md.
Supported Versions
While reports for any version are allowed and may be accepted if
valid, typically only the most recent version of a library is
supported for fixing security vulnerabilities.
In rare cases, especially when the most recent major version is
very new and has not diverged much from the prior major version
branch, security fixes may be backported. But this is not the
norm.
It is not my responsibility to backport fixes. It is your
responsibility to stay up to date.
If you are using unsupported versions of libraries in a
security-sensitive application, then you are exposing yourself
and your users to risks that I cannot help prevent.
Please do not waste your time and mine reporting security
vulnerabilities that apply to old versions, when they were
already reported and fixed in the latest version. If a backport
was not provided, that's because it will not be provided.
Report Vulnerabilities via GitHub Security Advisories
Please report all security vulnerabilities through
GitHub Security Advisories.
This allows us to collaborate on investigation, remediation, and
correction, while maintaining confidentiality until it is safe to
disclose responsibly and accurately.
Reports via email are likely to be missed, ignored, or flagged as
spam.
Reports via normal GitHub issues are public, and this is not
responsible disclosure. These issues will be deleted.
To report a vulnerability
(docs):
  1. Visit the Security tab of the affected repository on
GitHub.
  2. Click Report a vulnerability and follow the provided
steps.
 Learn more about advisories related to isaacs/node-tar in the GitHub Advisory Database