I created a benchmark to see which unzip module is the fastest.

modules

• adm-zip (currently this project uses)
• decompress-zip
• extract-zip
• node-unzip

benchmark script

(Using matcha)

'use strict';

var fs = require('fs');

var rimraf = require('rimraf');

var AdmZip = require('adm-zip');
var DecompressZip = require('decompress-zip');
var extractZip = require('extract-zip');
var unzip = require('unzip');

var FIXTURE_PATH = 'fixture.zip'; // path to a ZIP file

suite('Extract all files from a ZIP archive', function() {
  set('iterations', 10);

  before(rimraf.bind(null, 'tmp'));

  bench('adm-zip', function() {
    new AdmZip(FIXTURE_PATH).extractAllTo('tmp/adm-zip', true);
  });

  bench('decompress-zip', function(next) {
    new DecompressZip(FIXTURE_PATH)
    .on('extract', next)
    .on('error', next)
    .extract({path: 'tmp/decompress-zip'});
  });

  bench('extract-zip', function(next) {
    extractZip(FIXTURE_PATH, {dir: 'tmp/extract-zip'}, next);
  });

  bench('node-unzip', function(next) {
    var extract = new unzip.Extract({path: 'tmp/unzip/'})
    .on('finish', next)
    .on('error', next);

    fs.createReadStream(FIXTURE_PATH).pipe(extract);
  });
});

result

                      Extract all files from a ZIP archive
              43 op/s » adm-zip
             112 op/s » decompress-zip
              70 op/s » extract-zip
              49 op/s » node-unzip

I think we should replace adm-zip with another module.

[email protected] is affected by CVE-2022-36313 - please use a safe version instead.

I'm getting the error in that description after I upgrade file-type dependency for security reasons. So I'm no longer able to decompress zip or tarz files.

"file-type": "^16.5.4",

This is the package with the fix for the vulnerabilities.

var Decompress = require('decompress'),
    unzip = require('decompress-unzip');

new Decompress()
    .src('master.zip')
    .use(unzip({ strip: 1 }))
    .run(function (err, files) {
        files.forEach(function (file) {
            console.log(file.stat.isFile(), file.path);
        });
    });

master.zip here

I've encountered an error unzipping an archive that appears to be a special case. I'm actually using gulp-decompress but the cause appears to be in this module.

Symptoms:

1. One of the directories within the zip file is incorrectly identified as a file instead of a directory.
2. An empty file is created instead of a directory.
3. The unzip operation fails when it then attempts to unzip the files within that directory as the OS attempts to create a directory of the same name as the file.

Possible cause:

1. The entry in question has a externalFileAttributes value of 0x00110000. This fails the equality comparison with16 because 0x00100000 is set.

I don't know enough about what the 0x00100000 bit is for to know if getType(entry, mode) should really be just checking for 0x00010000 being set, rather than an exact equality.

I tested using new zip archives that I created with 7zip and Windows right-click > Send to > Compressed (zipped) folder. Both of them worked correctly.

I am unable to share the zip file here as it's an installer for licensed software. I also have no idea how it was produced. However, I am happy to answer any questions or run additional tests as needed.

Need to add default permission mode for prevent files blocking

var mode = new Mode(file.stat)
// 755
mode.owner.read = true;
mode.owner.write = true;
mode.owner.execute = true;
mode.group.read = true;
mode.group.execute = true;
mode.others.read = true;
mode.others.execute = true;

https://github.com/nmrugg/LZMA-JS
or
https://www.npmjs.org/package/lzma-purejs

None of the above support 7z which, from what I know, is based on LZMA2. Are you against using binaries to decompress?

Of the default decompress plugins, this seems to be the only one that doesn't seem to support streamed input.

Is there a particular reason why streaming is not supported for unzip? There is already a dependency on get-stream, so it seems reasonable to just put that in front of the yauzl call.