@npmcli/arborist npm package: is it safe?

When options.saveHidden is true, the code sets tree.meta.filename to a path constructed from options.path + '/node_modules/.package-lock.json' and writes to it via tree.meta.save(). This writes to node_modules/.package-lock.json which is outside the typical package scope, though it is within the hybrid tree structure. This could be used to persist configuration or metadata outside expected boundaries.

The file executes top-level code immediately when run, including reading the directory, requiring all command files, and dispatching a command. This is expected for a CLI entry point but means any import of this file triggers filesystem reads and module loading.

fs.readdirSync(__dirname) reads the bin directory to discover command files. This is scoped to the package's own bin directory, not outside package scope, so it is low risk.

The code writes log output to a user-specified logfile via options.logfile. It creates directories recursively with fs.mkdirSync and opens the file in append mode with fs.openSync. This behavior is expected for a logging utility and is controlled by user configuration, but it does write outside the package directory.

The module registers event listeners on import, which executes code at load time. However, this is benign and part of the module's intended functionality.

The code listens for a non-standard 'time' event on the process object, which is unusual but not inherently malicious; it appears to be an internal API for performance timing.

Uses nameFromFolder() to sanitize package names before joining into filesystem paths (e.g., ${safeName}@${node.version} under node_modules/.store). Comments explicitly note stripping path traversal from package.json name fields. This appears to be a defensive measure rather than a vulnerability.

Calls pacote.extract(node.resolved, dir, ...) to download and extract tarballs from registry/resolved URLs into node_modules/.store. This is normal npm Arborist functionality for installing dependencies, not exfiltration, but does write files and make network requests to resolved package URLs.

On shrinkwrap nodes, creates a new Arborist instance with { ...this.options, path: dir } and recursively calls buildIdealTree/makeIdealGraph. Options are inherited from the parent npm invocation. No suspicious option injection beyond what npm normally supports.

No use of eval, new Function, vm, child_process, shell commands, or dynamic requires with computed paths. crypto is used only for hashing (shake256), not for any key/credential material.

No reads of ~/.npmrc, ~/.ssh, ~/.aws, environment variables, or browser data. No outbound requests beyond expected pacote.extract calls to resolved package tarball URLs.

The code uses existsSync to check whether binary paths exist as part of diffing node trees. This is a legitimate local file existence check and does not read or exfiltrate file contents.

The diff logic mutates the input trees by reassigning node.parent for bundled dependencies. This is documented as a deliberate performance optimization, not a security issue, though it could have unintended side effects in consumers.

The code handles process signals to perform cleanup and re-raises the caught signal; this is benign and common in CLI tools.

If resolving with the passed-in name and version fails, the fallback at the end attempts npa.resolve(name, lock.version, where) again, without changing parameters, then returns {}. This is benign but could produce misleading results for a lockfile handling utility. No actual malicious behavior detected.