fix: tolerate malformed bundled entry names when listing tarball contents

[ManoharPaturi]

Problem

getContents in lib/utils/tar.js inspects every tar entry under package/node_modules/ to collect bundled dependency names:

if (p.startsWith('package/node_modules/') && p !== 'package/node_modules/') {
  const name = p.match(/^package\\/node_modules\\///+((?:@[^\\/]+\\/)?[^\\/]+)/)[1]
  bundled.add(name)
}

The match is indexed without a null check. An entry such as package/node_modules//evil (a doubled separator, so nothing follows the prefix that the name group can consume) fails the match and the whole listing dies with:

TypeError: Cannot read properties of null (reading '1')

getContents runs for npm pack <pkg>, npm publish and npm stage download, so a single crafted entry in a registry tarball takes down all three commands before any output. Tarballs fetched from a registry or the staging endpoint are not built by npm, so their entry names cannot be assumed to match the shapes npm generates. The existing tests only feed getContents tarballs produced by libnpmpack, which always normalize entry paths, so the crash never showed up in the suite.

Solution

Check the match before using it. An entry whose bundled name cannot be parsed is skipped for the bundled set while still being counted and listed in the file output, matching how the rest of the function treats unexpected entries.

Test Evidence

Added a test in test/lib/utils/tar.js that feeds getContents a hand assembled tarball (raw ustar headers, because both the filesystem and the tar package collapse doubled separators in entry paths) containing package/node_modules//evil. It asserts the command completes, the malformed entry contributes no bundled name, and both entries are still counted and listed. On the previous code the test fails with the TypeError above; with this change the full file is green: npx tap test/lib/utils/tar.js.

References

• Other guards treating registry tarball fields as untrusted: fix(arborist): strip path separators from version in store key #9758

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.