zip.js

zip.js reads and writes zip files in JavaScript, in the browser, in Node, in Deno, and in Bun. It is not a wrapper around a native binary. It does the compression itself, in web workers, in parallel, which is why it can zip a folder of files in a browser tab without freezing the page. BSD-3 licensed and free.

The feature list is why you would pick it over the smaller alternatives. Zip64 for archives past 4 GB, split archives, AES encryption, and streaming reads and writes so a 2 GB file never has to fit in memory at once. Recent releases added a filename validation option that rejects entries whose paths would escape the extraction directory, which is the zip-slip class of vulnerability you would otherwise have to defend against by hand.

Nothing to operate. It is an npm install and an import. Solo developers building anything that lets a user download a bundle of files or upload an archive: this is the sensible default. Teams: same answer, and the streaming API is what keeps it working at file sizes where naive implementations fall over.

The catch: this is essentially one maintainer's project, and releases ship every few days. That is a strength when your bug is fixed the same week you file it and a risk when you need to pin a version and trust it untouched for two years. The API surface is large and growing, so read the changelog before you upgrade rather than after.