Affected: npm: basic-ftp

### Summary `basic-ftp@5.2.2` is vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes.

### Details The issue is in the package's default directory listing flow.

`Client.list()` reaches `dist/Client.js`, where the full listing response is downloaded into a `StringWriter` before parsing:

File: `dist/Client.js:516-527`

```js async _requestListWithCommand(command) { const buffer = new StringWriter_1.StringWriter(); await (0, transfer_1.downloadTo)(buffer, { ftp: this.ftp, tracker: this._progressTracker, command, remotePath: "", type: "list" }); const text = buffer.getText(this.ftp.encoding); this.ftp.log(text); return this.parseList(text); } ```

The vulnerable sink is `StringWriter`, which grows an in-memory `Buffer` with no limit:

File: `dist/StringWriter.js:5-20`

```js class StringWriter extends stream_1.Writable { constructor() { super(...arguments); this.buf = Buffer.alloc(0); } _write(chunk, _, callback) { if (chunk instanceof Buffer) { this.buf = Buffer.concat([this.buf, chunk]); callback(null); } else { callback(new Error("StringWriter expects chunks…