package-managers

Same digest, different files: ZIP parser differentials in uv and pip

A ZIP with one digest that expands into two different packages depending on which installer opens it.

found by Caleb Brown (Google) and Tim Hatch (Netflix)

Pointing Cargo's .cargo-ok write at a file outside the crate directory

Cargo wrote "ok" into a marker file after unpacking a crate, and the crate got to decide what that marker was.

found by Ori Hollander, JFrog Security Research

Arbitrary file write in node-tar through a stale directory cache

node-tar skipped a symlink check whenever its directory cache said the path was fine, and two ways of spelling a path could make the cache lie.

found by chen-robert, ginkoid and levpachmanov