tarballs_v1.openStreamImpl reads the entire stream into data and, when tarballFormat == tfDetect, immediately inspects:
There is no prior length check. Empty input, and also one-byte input, therefore causes direct indexing into an undersized string.
import std/streams
import zippy/tarballs_v1
Tarball().open(newStringStream(""))
Found by GPT 5.4.