Install-time vulnerability in chownr introduced through tar

[mceachen]

There's a TOCTOU vuln in chownr that snyk is just reporting now (even though disclosure happened 31 Jul, 2018).

Given that this is part of the installation step for sharp, I don't think this is terribly exploitable, it's more an FYI.

Thanks for sharp 🥇 !

[lovell]

Thanks for reporting this. As you say, chownr is an install-time (transient) dependency of sharp and an attacker would already need to have write access to the filesystem to be able to exploit this.

isaacs/chownr#14

The truly paranoid could run npm install && rm -rf node_modules/chownr.