Please report security issues privately through the repository security advisory feature when available. If that is not available, open a minimal issue asking for a private contact channel without publishing exploit details.
The package reads user-provided file trees, archives, and text formats. Treat untrusted input carefully and avoid executing user-provided content.