The decompress npm package (version prior to 4.2.2) contains a path traversal vulnerability (CWE‑22) caused by using String.indexOf() without enforcing a path separator boundary during extraction. This flaw allows an attacker to craft archive entries such as "/tmp/app_config" that bypass containment checks and are extracted outside the intended output directory. When combined with unvalidated symbolic‑link creation, an attacker can write arbitrary files to locations adjacent to the extraction target, potentially overwriting configuration files or deploying malicious code.

Any Node.js application that uses the decompress package version 4.2.1 or earlier and performs archive extraction without additional sanitization or sandboxing is vulnerable. The issue exists in the default installation of the package unless the code has been modified to use a stricter path check.

The CVSS score of 6.2 indicates moderate severity, and the EPSS score of <1% suggests a low probability of widespread exploitation at this time. The flaw is not listed in the CISA KEV catalog. The likely attack vector is an attacker supplying a crafted archive to a vulnerable decompress invocation; if extraction is performed with elevated privileges or the environment permits overwrites of critical system files, the arbitrary file write could compromise those files.