title: npm audit Arbitrary File Overwrite
body: <p>I recently updated my version of angular using <code>ng update</code> 
  and when running <code>npm audit</code> it found 1 high severity vulnerability but offered no suggestions on how to resolve it. It usually suggests to upgrade a package from package.json like: "angular-devkit/build-angular" but I am already using their latest version.</p>
  
  <pre><code>                   === npm audit security report ===                        
  
  
                               Manual Review                                  
           Some vulnerabilities require your attention to resolve             
  
        Visit https://go.npm.me/audit-guide for additional guidance           
  
  
  High            Arbitrary File Overwrite                                      
  
  Package         tar                                                           
  
  Patched in      &gt;=4.4.2                                                       
  
  Dependency of   @angular-devkit/build-angular [dev]                           
  
  Path            @angular-devkit/build-angular &gt; node-sass &gt; node-gyp &gt; tar    
  
  More info       https://npmjs.com/advisories/803                              
  
  found 1 high severity vulnerability in 29707 scanned packages
  1 vulnerability requires manual review. See the full report for details.
  </code></pre>
  
  <p>I thought of installing <code>npm i tar</code> but I am not sure.</p>