Do not report security vulnerabilities through public GitHub issues.

Report them to the Microsoft Security Response Center (MSRC) at https://msrc.microsoft.com/create-report, or by email to secure@microsoft.com. More detail, including the PGP key for encrypted mail, is at https://www.microsoft.com/msrc.

Please include as much of the following as you can, so we can reproduce and triage quickly:

• The type of issue (for example: memory corruption in a decoder, path traversal on extraction, denial of service from a malformed file)
• The source file format and, if possible, a minimal sample asset that triggers it
• Whether it reproduces in Node, in the browser, or both
• Step-by-step instructions to reproduce
• The impact, and how an attacker might exploit it

This package parses untrusted 3D asset files and bundles third-party native and WebAssembly converters and compressors. Malformed or hostile input is an expected part of its threat model, so parser crashes, out-of-bounds reads, resource exhaustion, and anything that escapes the intended output directory are all in scope.

Vulnerabilities in an upstream dependency are best reported to that project directly, but tell us too so we can pick up the fix.