Arbitrary file write via unchecked archive path

Path traversal in Peerigon unzip-crx and unzip-crx-3 0.2.0 and earlier allows local users to write outside the extraction directory. dist/index.js joins an archive-controlled backslash entry name to destination and calls mkdir and writeFile without checking that the resolved path remains inside it. Exploitation requires a Windows consumer to extract an attacker-influenced CRX or ZIP; it creates or overwrites files with attacker-controlled content but does not directly disclose data or execute code.