[APS-22106] replace decompress@4.2.1 with adm-zip@0.6.1

decompress@4.2.1 has an unpatched CVSS-9.1 Zip Slip vulnerability
(GHSA-mp2f-45pm-3cg9 + two related advisories). The package is
unmaintained (last release Feb 2020); no upstream fix is coming.

Replacement: adm-zip@0.6.1.

Why adm-zip@0.6.1:
  - Zero known CVEs (verified via `npm audit` — see below).
  - CJS package; direct `require()` works, no ESM incompat.
  - Node engine >= 14.0 — safe for the CLI's practical Node 14+ floor.
    (The @xhmikosr/decompress fork was rejected because it is ESM-only
    from 5.0.0 and requires Node 20+ at 11.x — either blocker breaks
    existing customers.)
  - No transitive dependencies (self-contained; supply-chain surface
    limited to adm-zip itself).
  - 19M+ weekly downloads.
  - Actively maintained: 0.6.1 was published 2026-09-11 specifically to
    close two prior advisories (GHSA-xcpc-8h2w-3j85 memory exhaustion
    and GHSA-vwc7-r8mq-g2x9 symlink Zip Slip). The fix commits are real
    code work — `eaa35fa7` ("Blocked extraction from writing through
    symlinks inside the target"), plus stripped setuid/setgid/sticky
    bits, rejected duplicate entry names, enforced decompression size
    caps.

Also considered and rejected:
  - `extract-zip@2.0.1`: two unpatched HIGH symlink Zip Slip advisories
    (GHSA-jmr9-qjv8-65gv, GHSA-7pqw-9j4j-h8q3), last publish June 2020,
    fixAvailable:false. Same class of unmaintained-with-open-CVEs
    problem as decompress.
  - `@xhmikosr/decompress@11.1.3`: ESM-only across all versions
    (`type: module`) and requires Node >= 20; either breaks CJS require
    or breaks existing customers on Node 14/16/18.

Flow preserved: both call sites keep the existing
"primary + unzipper.Extract fallback" pattern. Only the primary
lib changes.

API swap:
  - `decompress(zipPath, targetDir)` -> Promise<Files[]>
  + `new AdmZip(zipPath).extractAllToAsync(targetDir, /*overwrite*/ true)`
    -> Promise<void>
  Both call sites already discarded the `Files[]` return value, so the
  shape difference is a no-op.

Local verification:
  - `node --check` on both changed source files: OK
  - `npm ls adm-zip`: adm-zip@0.6.1 present
  - `npm ls decompress`: empty (vulnerable pkg gone; the remaining
    `decompress-response` is an unrelated HTTP-body decompressor).
  - `grep decompress` in source (excl. lockfile/node_modules): 0 hits
  - `npm audit` — adm-zip subtree: 0 vulnerabilities.
    Other pre-existing tree vulns unchanged: 10 (identical to master).
  - `npm test`: 723 passing / 2 pending / 16 failing — byte-identical
    to master baseline (the 16 failures are pre-existing flakes,
    unrelated to this PR).

Author: Raghav11-11

bin/helpers/buildArtifacts.js

@@ -11,7 +11,7 @@ const logger = require('./logger').winstonLogger,
 const { default: axios } = require('axios');
 const { HttpsProxyAgent = require('https-proxy-agent') } = require('https-proxy-agent');
 const FormData = require('form-data');
-const decompress = require('decompress');
+const AdmZip = require('adm-zip');
 const unzipper = require("unzipper");
 const { setAxiosProxy } = require('./helper');
 
@@ -154,10 +154,11 @@ const downloadAndUnzip = async (filePath, fileName, url) => {
 const unzipFile = async (filePath, fileName) => {
   return new Promise( async (resolve, reject) => {
     try {
-      await decompress(path.join(filePath, fileName), filePath);
+      const zip = new AdmZip(path.join(filePath, fileName));
+      await zip.extractAllToAsync(filePath, /* overwrite */ true);
       resolve();
     } catch (error) {
-      logger.debug(`Error unzipping with decompress, trying with unzipper. Stacktrace: ${error}.`);
+      logger.debug(`Error unzipping with adm-zip, trying with unzipper. Stacktrace: ${error}.`);
       try {
         fs.createReadStream(path.join(filePath, fileName))
           .pipe(unzipper.Extract({ path: filePath }))

bin/helpers/reporterHTML.js

@@ -6,7 +6,7 @@ const fs = require('fs'),
       utils = require("./utils"),
       Constants = require('./constants'),
       config = require("./config"),
-      decompress = require('decompress');
+      AdmZip = require('adm-zip');
 const { isTurboScaleSession } = require('../helpers/atsHelper');
 
 const { setAxiosProxy } = require('./helper');
@@ -171,15 +171,14 @@ function getReportResponse(filePath, fileName, reportJsonUrl) {
 
 const unzipFile = async (filePath, fileName) => {
   return new Promise( async (resolve, reject) => {
-    await decompress(path.join(filePath, fileName), filePath)
-    .then((files) => {
-      let message = "Unzipped the json and html successfully."
-      resolve(message);
-    })
-    .catch((error) => {
+    try {
+      const zip = new AdmZip(path.join(filePath, fileName));
+      await zip.extractAllToAsync(filePath, /* overwrite */ true);
+      resolve("Unzipped the json and html successfully.");
+    } catch (error) {
       reject(error);
       process.exitCode = Constants.ERROR_EXIT_CODE;
-    });
+    }
   });
 }