If you discover a security vulnerability, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

PackSmoke is a development tool that:

• Runs npm pack and npm install locally
• Does not send data to external services
• Does not execute installed binaries
• Does not run lifecycle scripts by default

PackSmoke requires:

• Read access to the target package directory
• Write access to OS temp directories
• Network access for npm install (only if the target package has registry dependencies)

PackSmoke creates temporary directories for tarballs and consumer installations. These are cleaned up in finally blocks. If cleanup fails, a warning is surfaced but no files outside PackSmoke-owned temp directories are deleted.