yauzl

yauzl reads ZIP files in Node.js with an emphasis on correctness and low memory use: it parses the central directory rather than scanning entries sequentially, exposes each entry as a Node stream so large files never need to be buffered fully in memory, and refuses to auto-decompress paths that look unsafe (like entries escaping their target directory) unless you explicitly opt in.

It supports ZIP64 for archives and entries beyond the standard 4GB/65535-entry limits, works with password-free ZIPs (both stored and deflated entries), and offers both a callback-based and a promise/async-iterator-friendly API, making it a common low-level dependency underneath higher-level extraction tools and Electron’s asar/archive handling code.

What You Get

• Central-directory-based parsing instead of naive sequential local-file-header scanning
• Per-entry readable streams so large files can be extracted without full in-memory buffering
• Opt-in protection against unsafe entry paths (zip-slip / directory traversal) via a validateEntrySizes-style option
• ZIP64 support for archives and entries exceeding the classic 4GB/65535-entry limits
• Both callback-based and for-await/async-iterator entry iteration APIs
• Support for both stored (uncompressed) and deflated entries

Common Use Cases

• Extracting user-uploaded ZIP archives on a server without loading the whole file into memory
• Building CLI or GUI unzip tools that need entry-by-entry streaming control
• Reading archive formats built on ZIP (like .xpi, .vsix, or Electron .asar-adjacent tooling) programmatically
• Safely unpacking untrusted ZIP files where path-traversal protection matters

Under The Hood

Architecture - index.js locates and parses the End Of Central Directory record (with ZIP64 EOCD locator support) to build an authoritative list of entries, then lazily seeks to each entry’s local header on demand via fd-slicer.js (a companion module for safe, ref-counted file-descriptor slicing) to produce a readable decompression stream per entry, rather than reading the whole archive sequentially. Tech Stack - Pure Node.js (>=12) with a minimal dependency footprint (only pend for pending-callback coordination), relying on Node’s built-in zlib for DEFLATE decompression; no build step, plain CommonJS. Code Quality - The test/ directory includes dedicated fixtures for error conditions, ZIP64 archives, malformed/wrong-entry-sizes inputs, and success/failure archive pairs, reflecting a strong focus on spec-edge-case correctness over feature breadth. API Design - yauzl.open(path, options, callback) returns a ZipFile object whose readEntry()/entry event pair drives sequential streaming reads; this event-driven model requires slightly more boilerplate than a single extractAll() call, but gives callers precise control over memory use and which entries get decompressed.