Filesystem Writes via `yarn install` via symlinks and tar transforms inside a crafted malicious package

I would like to report an arbitrary filesystem write vulnerability in Yarn when installing a malicious package from the default repositories. This vulnerability has the potential for RCE -- even if `--ignore-scripts` is disabled.

{
  "name": "my-malicious-package",
  "version": "1.0.38",
  "description": "",
  "main": "index.js",
  "scripts": {
    "postinstall": "echo ‘foo’ > /tmp/file"
  },
  "author": "",
  "license": "ISC"
}