fix(npm): skip extracting pax_global_header from tarballs (#15677)

cli/npm/tarball.rs

@@ -123,6 +123,13 @@ fn extract_tarball(data: &[u8], output_folder: &Path) -> Result<(), AnyError> {
     let mut entry = entry?;
     let path = entry.path()?;
     let entry_type = entry.header().entry_type();
+
+    // Some package tarballs contain "pax_global_header", these entries
+    // should be skipped.
+    if entry_type == EntryType::XGlobalHeader {
+      continue;
+    }
+
     // skip the first component which will be either "package" or the name of the package
     let relative_path = path.components().skip(1).collect::<PathBuf>();
     let absolute_path = output_folder.join(relative_path);

cli/tests/integration/npm_tests.rs

@@ -110,6 +110,13 @@ itest!(sub_paths {
   http_server: true,
 });
 
+itest!(tarball_with_global_header {
+  args: "run --unstable -A --quiet npm/tarball_with_global_header/main.js",
+  output: "npm/tarball_with_global_header/main.out",
+  envs: env_vars(),
+  http_server: true,
+});
+
 #[test]
 fn parallel_downloading() {
   let (out, _err) = util::run_and_collect_output_with_args(

cli/tests/testdata/npm/tarball_with_global_header/main.js

@@ -0,0 +1,3 @@
+import { Client } from "npm:ssh2";
+
+console.log(Client);

cli/tests/testdata/npm/tarball_with_global_header/main.out

@@ -0,0 +1 @@
+[Function: bound Client]