fix: do not follow absolute paths outside job base

src/analyze.ts

@@ -1169,9 +1169,33 @@ export default async function analyze(
       return;
     }
     if (wildcardIndex !== -1 && stats.isFile()) return;
+    // do not emit assets outside the package boundary if inside node_modules
+    if (pkgBase) {
+      const nodeModulesBase =
+        id.substring(0, id.indexOf(path.sep + 'node_modules')) +
+        path.sep +
+        'node_modules' +
+        path.sep;
+      if (!assetPath.startsWith(nodeModulesBase)) {
+        if (job.log)
+          console.log(
+            'Skipping asset emission of ' +
+              assetPath +
+              ' for ' +
+              id +
+              ' as it is outside the package base ' +
+              pkgBase,
+          );
+        return;
+      }
+    }
     if (stats.isFile()) {
+      // do not emit file assets outside job.base
+      if (job.ignoreFn(path.relative(job.base, assetPath))) return;
       assets.add(assetPath);
     } else if (stats.isDirectory()) {
+      // do not emit directory assets outside job.base
+      if (job.ignoreFn(path.relative(job.base, assetPath))) return;
       if (validWildcard(assetPath)) emitAssetDirectory(assetPath);
     }
   }

src/utils/ast-helpers.ts

@@ -22,7 +22,7 @@ export function isIdentifierRead(node: Node, parent: Node) {
       return parent.id !== node;
     // disregard the `bar` in `export { foo as bar }`
     case 'ExportSpecifier':
-      return false;
+      return node.name === parent.exported.name;
     // disregard the `bar` in `function (bar) {}`
     case 'FunctionExpression':
     case 'FunctionDeclaration':

test/unit/pkg-dir-outside-base/.gitignore

@@ -0,0 +1 @@
+!node_modules 

test/unit/pkg-dir-outside-base/input.js

@@ -0,0 +1 @@
+require('some-pkg');

test/unit/pkg-dir-outside-base/output.js

@@ -0,0 +1,6 @@
+[
+  "package.json",
+  "test/unit/pkg-dir-outside-base/input.js",
+  "test/unit/pkg-dir-outside-base/node_modules/some-pkg/index.js",
+  "test/unit/pkg-dir-outside-base/node_modules/some-pkg/package.json"
+]

test/unit/pkg-dir-outside-base/secret-dir/secret.txt

@@ -0,0 +1 @@
+secret

test/unit/pkg-file-outside-base/.gitignore

@@ -0,0 +1 @@
+!node_modules 

test/unit/pkg-file-outside-base/input.js

@@ -0,0 +1 @@
+require('some-pkg');

test/unit/pkg-file-outside-base/output.js

@@ -0,0 +1,6 @@
+[
+  "package.json",
+  "test/unit/pkg-file-outside-base/input.js",
+  "test/unit/pkg-file-outside-base/node_modules/some-pkg/index.js",
+  "test/unit/pkg-file-outside-base/node_modules/some-pkg/package.json"
+]

test/unit/pkg-file-outside-base/secret.txt

@@ -0,0 +1 @@
+secret content