title: npm "decompress" package Arbitrary File Write Error when including @truffle/contract package
body: <p>I'm currently trying to get a Project to run. When I try to install the packages with <code>npm install</code> i get <code>found 12 vulnerabilities (8 low, 4 high) in 68482 scanned packages</code>. It seems to be a problem with the package <code>decompress</code> used in <code>@truffle/contract</code>, because this is the audit report:</p>
  
  <pre><code>  High            Arbitrary File Write
  
    Package         decompress
  
    Patched in      No patch available
  
    Dependency of   @truffle/contract [dev]
  
    Path            @truffle/contract &gt; @truffle/interface-adapter &gt; web3 &gt;
                    web3-bzz &gt; swarm-js &gt; decompress
  
    More info       https://npmjs.com/advisories/1217
  
  
    High            Arbitrary File Write
  
    Package         decompress
  
    Patched in      No patch available
  
    Dependency of   @truffle/contract [dev]
  
    Path            @truffle/contract &gt; ethereum-ens &gt; web3 &gt; web3-bzz &gt;
                    swarm-js &gt; decompress
  
    More info       https://npmjs.com/advisories/1217
  
  
    High            Arbitrary File Write
  
    Package         decompress
  
    Patched in      No patch available
  
    Dependency of   @truffle/contract [dev]
  
    Path            @truffle/contract &gt; web3 &gt; web3-bzz &gt; swarm-js &gt; decompress
  
    More info       https://npmjs.com/advisories/1217
  
  
    High            Arbitrary File Write
  
    Package         decompress
  
    Patched in      No patch available
  
    Dependency of   decompress [dev]
  
    Path            decompress
  
    More info       https://npmjs.com/advisories/1217
  </code></pre>
  
  <p><em>I copied only the report part with the high vulnerabilities.</em> </p>
  
  <p>Unfortunately the help link ("<a href="https://npmjs.com/advisories/1217" rel="nofollow noreferrer">https://npmjs.com/advisories/1217</a>") has also no solution. </p>
  
  <p>I get the problem with the <code>decompress</code> package when I include the <code>@truffle/contract</code> package. These are my dependencies: </p>
  
  <pre><code>    "dependencies": {
      "@angular/animations": "9.0.7",
      "@angular/common": "9.0.7",
      "@angular/compiler": "9.0.7",
      "@angular/compiler-cli": "9.0.7",
      "@angular/core": "9.0.7",
      "@angular/forms": "9.0.7",
      "@angular/platform-browser": "9.0.7",
      "@angular/platform-browser-dynamic": "9.0.7",
      "@ionic-native/core": "5.22.0",
      "@ionic-native/qr-scanner": "5.22.0",
      "@ionic-native/splash-screen": "5.22.0",
      "@ionic-native/status-bar": "5.22.0",
      "@ionic/storage": "2.2.0",
      "angular": "1.7.9",
      "cordova-android": "^8.1.0",
      "cordova-browser": "5.0.4",
      "cordova-plugin-device": "^2.0.2",
      "cordova-plugin-ionic-keyboard": "^2.1.3",
      "cordova-plugin-ionic-webview": "^4.1.3",
      "cordova-plugin-qrscanner": "^2.6.0",
      "cordova-plugin-splashscreen": "^5.0.2",
      "cordova-plugin-whitelist": "^1.3.3",
      "cordova-sqlite-storage": "^2.4.0",
      "node-pre-gyp": "0.14.0",
      "picomatch": "2.2.1",
      "rxjs": "^6.5.3",
      "tslib": "1.10.0",
      "zone.js": "0.10.3"
    },
    "devDependencies": {
      "@ionic/cli": "6.3.0",
      "@truffle/contract": "^4.1.13",
      "@types/node": "^10.11.5",
      "cordova": "^9.0.0",
      "cross-env": "7.0.2",
      "decompress": "^4.2.0",
      "ganache-cli": "6.9.1",
      "http-server": "0.12.1",
      "minimist": "^1.2.5",
      "superagent": "5.2.2",
      "truffle": "5.1.17",
      "truffle-wallet-provider": "^0.0.5",
      "typescript": "3.7.3"
    },
    "optionalDependencies": {
      "fsevents": "*"
    },
  </code></pre>
  
  <p>Can somebody help me with this error. </p>
  
  <p><strong>Elias</strong></p>