npm stage download names the output file from the name and version in the staged tarball's own package.json, replacing only the first / in the name and not sanitizing the version at all. A staged manifest with a name like @a/b/../../../../x (or a version containing slashes) keeps its ../ segments, so path.resolve(process.cwd(), filename) escapes the working directory and writeFile drops the attacker-controlled tarball bytes at any writable path. Whoever staged the package controls that manifest, and inspecting an unreviewed stage is the point of this command, so the name and version are now validated right after they are read from the tarball; legitimate stages always pass because the registry enforces the same rules at publish time.

The added tests fail on the previous code: the download succeeded and the tarball landed four directories above the test cwd.

This fix was found and prepared with AI assistance and reviewed by me before submitting.