sls package --package flag with aws wipes directory

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest version?

• Yes, I'm using the latest version

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

While trying to test my serverless.yml file, I ran the package command and provided the --package flag because I didn't want to pollute my code directory so I just gave it ../ in a hurry. After running the command, it had wiped my whole content of the directory I gave in, including my whole code repo.

I was definitely not expecting this and there's no warning in the CLI help about this behavior.

Note that I was trying to package a AWS lambda.

The command failed and returned my the following stack trace : Error --------------------------------------------------- Error: EINVAL: invalid argument, rmdir ‘../’ at Object.rmdirSync (fs.js:850:3) at rmkidsSync (/Users/myuser/Code/redacted/node_modules/fs-extra/lib/remove/rimraf.js:296:25) at rmdirSync (/Users/myuser/Code/redacted/node_modules/fs-extra/lib/remove/rimraf.js:269:7) at Object.rimrafSync [as removeSync] (/Users/myuser/Code/redacted/node_modules/fs-extra/lib/remove/rimraf.js:243:7) at AwsCommon.moveArtifactsToPackage (/Users/myuser/Code/redacted/node_modules/serverless/lib/plugins/aws/common/lib/artifacts.js:19:15) at Object.aws:common:moveArtifactsToPackage:move [as hook] (/Users/myuser/Code/redacted/node_modules/serverless/lib/plugins/aws/common/index.js:52:60) at PluginManager.invoke (/Users/myuser/Code/redacted/node_modules/serverless/lib/classes/PluginManager.js:579:20) at PluginManager.spawn (/Users/myuser/Code/redacted/node_modules/serverless/lib/classes/PluginManager.js:601:16) at Object.aws:package:finalize:saveServiceState [as hook] (/Users/myuser/Code/redacted/node_modules/serverless/lib/plugins/aws/package/index.js:109:46) at async PluginManager.invoke (/Users/myuser/Code/redacted/node_modules/serverless/lib/classes/PluginManager.js:579:9) at async PluginManager.spawn (/Users/myuser/Code/redacted/node_modules/serverless/lib/classes/PluginManager.js:601:5)

I took a look at it and it seems like some code in the serverless/lib/plugins/aws/common/lib/artifacts.js file deleted the whole content of the folder passed in with the --package flag.

I don't know if this is a bug or if it's working as intended, but documenting the behavior in the CLI help would probably avoid other people running into the issue.

Service configuration (serverless.yml) content

service: my_lambda
frameworkVersion: '2'

provider:
  name: aws
  runtime: nodejs14.x
  lambdaHashingVersion: 20201221

functions:
  my_lambda:
    handler: dist/src/index.handler

Command name and used flags

npx sls package -p ./test_serverless/ --stage dev --region us-east-1

Command output

N/A

Environment information

Framework Core: 2.53.1 (local)
Plugin: 5.4.3
SDK: 4.2.6
Components: 3.14.2