Arbitrary file write via symlink traversal

Path traversal in max-mapper extract-zip 2.0.1 and earlier allows remote attackers to write files outside the target directory via ZIP extraction. In index.js, the entry handler resolves and bounds-checks only path.dirname(path.join(opts.dir, entry.fileName)); extractEntry then opens the final dest path and writes or symlinks it without revalidating that last component. Exploitation requires a consuming application or user to extract an attacker-supplied archive; the result is arbitrary file write outside the destination, with no direct read primitive described in the source record.