Fix 23 Dependabot alerts (#562)

scripts/vendor-node.cjs

@@ -1,8 +1,8 @@
 const path = require("node:path");
 const crypto = require("node:crypto");
 const fs = require("node:fs");
-const decompress = require("decompress");
 const Downloader = require("nodejs-file-downloader");
+const { extractArchive } = require("./extract-archive.cjs");
 const { rmSync, cpSync, mkdirSync, existsSync } = require("node:fs");
 const { execSync } = require("node:child_process");
 
@@ -92,7 +92,7 @@ rmSync(tmpDir, { recursive: true, force: true });
   console.log("SHA256 verified:", actualHash);
 
   // Decompress to the same directory
-  await decompress(filePath, tmpDir, {});
+  await extractArchive(filePath, tmpDir);
 
   // Copy binary
   const binSrc = path.join(tmpDir, SRC_BIN_MAP[key]);