diff --git a/scripts/e2e/parallels/package-artifact.ts b/scripts/e2e/parallels/package-artifact.ts
index cfb75c27f3b4..cef9c7d41251 100644
--- a/scripts/e2e/parallels/package-artifact.ts
+++ b/scripts/e2e/parallels/package-artifact.ts
@@ -26,6 +26,19 @@ export async function packageBuildCommitFromTgz(tgzPath: string): Promise<string
   return info.commit ?? "";
 }
 
+function resolveNpmPackTarballFilename(value: unknown): string {
+  const filename = typeof value === "string" ? value.trim() : "";
+  if (
+    !filename.endsWith(".tgz") ||
+    filename.includes("\0") ||
+    filename !== path.basename(filename) ||
+    filename !== path.win32.basename(filename)
+  ) {
+    die("npm pack did not report a safe tarball filename");
+  }
+  return filename;
+}
+
 export function resolveOpenClawRegistryVersion(specOrAlias: string): string {
   const rawValue = specOrAlias.trim();
   const value = rawValue.startsWith("openclaw@") ? rawValue.slice("openclaw@".length) : rawValue;
@@ -139,11 +152,8 @@ export async function packOpenClaw(input: {
       ],
       { quiet: true },
     ).stdout;
-    const packed = JSON.parse(output).at(-1)?.filename as string | undefined;
-    if (!packed) {
-      die("npm pack did not report a filename");
-    }
-    const tgzPath = path.join(input.destination, path.basename(packed));
+    const packed = resolveNpmPackTarballFilename(JSON.parse(output).at(-1)?.filename);
+    const tgzPath = path.join(input.destination, packed);
     const version = await packageVersionFromTgz(tgzPath);
     say(`Packed ${tgzPath}`);
     say(`Target package version: ${version}`);
@@ -170,10 +180,7 @@ export async function packOpenClaw(input: {
         quiet: true,
       },
     ).stdout;
-    const packed = JSON.parse(output).at(-1)?.filename as string | undefined;
-    if (!packed) {
-      die("npm pack did not report a filename");
-    }
+    const packed = resolveNpmPackTarballFilename(JSON.parse(output).at(-1)?.filename);
     const tgzPath = path.join(input.destination, `openclaw-main-${shortHead}.tgz`);
     await copyFile(path.join(input.destination, packed), tgzPath);
     const buildCommit = await packageBuildCommitFromTgz(tgzPath);
diff --git a/test/scripts/parallels-smoke-model.test.ts b/test/scripts/parallels-smoke-model.test.ts
index 3c6582f30919..5ca34c3ac3f9 100644
--- a/test/scripts/parallels-smoke-model.test.ts
+++ b/test/scripts/parallels-smoke-model.test.ts
@@ -334,6 +334,11 @@ describe("Parallels smoke model selection", () => {
     expect(packageArtifact).toContain("Wait for Parallels package lock");
     expect(packageArtifact).toContain("export async function packageVersionFromTgz");
     expect(packageArtifact).toContain("export async function packOpenClaw");
+    expect(packageArtifact).toContain("function resolveNpmPackTarballFilename");
+    expect(packageArtifact).toContain("filename !== path.basename(filename)");
+    expect(packageArtifact).toContain("filename !== path.win32.basename(filename)");
+    expect(packageArtifact).toContain("npm pack did not report a safe tarball filename");
+    expect(packageArtifact).not.toContain("path.basename(packed)");
     expect(parallelsVm).toContain("export function resolveUbuntuVmName");
     expect(parallelsVm).toContain("export function resolveMacosVmName");
     expect(parallelsVm).toContain("export function waitForVmStatus");