Remove . and / from pkg name to avoid directory traversal