A path traversal issue exists where a malicious package publisher can cause the deletion of directories outside the project build directory. This occurs because Gleam reads the `app` field from the hex.pm release API and uses it as the package build directory name without proper validation. If a dependency fails to compile, Gleam uses the `remove dir all` function to delete the directory associated with that name. A publisher could set the `app` field to an absolute path or a relative path containing `..` components to target arbitrary directories. This can be triggered by commands such as `gleam build`, `gleam check`, `gleam run`, `gleam test`, or `gleam export` when a project depends on a malicious release. The issue is specifically linked to the `hex manifest package` function in `compiler-cli/src/dependencies.rs` and the `ProjectPaths::build directory for package` function.