fix(npm): validate tar paths before extraction (#36468)