exarch

Memory-safe archive extraction and creation library with Python and Node.js bindings.

[!IMPORTANT] exarch is designed as a secure replacement for vulnerable archive libraries like Python’s tarfile and Node.js’s tar-fs, which have known CVEs with CVSS scores up to 9.4.

Features

• Extract, create, list, and verify archives — Full support for TAR and ZIP (all operations), plus 7z extraction, listing, and verification
• Format auto-detection — Falls back to magic-byte inspection when the file extension is absent, unrecognised, or contradicts the file content
• Security-first design — Default-deny security model with protection against path traversal, symlink attacks, zip bombs, and more
• Type-driven safety — Rust’s type system ensures validated paths can only be constructed through security checks
• Extension allowlists — Optional allowed_extensions filter restricts extraction to a specific set of file extensions across TAR, ZIP, and 7z handlers
• Fluent configuration — 15 with_* builder methods on SecurityConfig and 3 on ExtractionOptions for ergonomic setup
• In-memory processing — ArchiveReader, extract_to_sink…