3 ms·Enjoy zipbomb.jsby cozzyd 2y agoEnjoy zipbomb.jsbhouston 2y agoBut npm already decompresses every package because it shows the contents on its website. So yeah it can be malicious but it already has dealt with that risk.