Gathering detailed insights and metrics for @electron/asar
Gathering detailed insights and metrics for @electron/asar
Gathering detailed insights and metrics for @electron/asar
Gathering detailed insights and metrics for @electron/asar
Simple extensive tar-like archive format with indexing
npm install @electron/asar
Typescript
Module System
Min. Node Version
Node Version
NPM Version
96.1
Supply Chain
99.5
Quality
84.9
Maintenance
100
Vulnerability
100
License
TypeScript (54.06%)
JavaScript (45.94%)
Total Downloads
55,015,125
Last Day
44,635
Last Week
837,569
Last Month
3,756,008
Last Year
32,915,993
MIT License
2,701 Stars
384 Commits
255 Forks
70 Watchers
3 Branches
49 Contributors
Updated on Jul 01, 2025
Latest Version
4.0.0
Package Id
@electron/asar@4.0.0
Unpacked Size
88.62 kB
Size
21.90 kB
File Count
25
NPM Version
10.9.0
Node Version
22.12.0
Published on
May 14, 2025
Cumulative downloads
Total Downloads
Last Day
12.8%
44,635
Compared to previous day
Last Week
-10.8%
837,569
Compared to previous week
Last Month
1.6%
3,756,008
Compared to previous month
Last Year
71.1%
32,915,993
Compared to previous year
Asar is a simple extensive archive format, it works like tar
that concatenates
all files together without compression, while having random access support.
This module requires Node 22.12.0 or later.
1$ npm install --engine-strict @electron/asar
1$ asar --help 2 3 Usage: asar [options] [command] 4 5 Commands: 6 7 pack|p <dir> <output> 8 create asar archive 9 10 list|l <archive> 11 list files of asar archive 12 13 extract-file|ef <archive> <filename> 14 extract one file from archive 15 16 extract|e <archive> <dest> 17 extract archive 18 19 20 Options: 21 22 -h, --help output usage information 23 -V, --version output the version number 24
Given:
app
(a) ├── x1
(b) ├── x2
(c) ├── y3
(d) │ ├── x1
(e) │ └── z1
(f) │ └── x2
(g) └── z4
(h) └── w1
Exclude: a, b
1$ asar pack app app.asar --unpack-dir "{x1,x2}"
Exclude: a, b, d, f
1$ asar pack app app.asar --unpack-dir "**/{x1,x2}"
Exclude: a, b, d, f, h
1$ asar pack app app.asar --unpack-dir "{**/x1,**/x2,z4/w1}"
1import { createPackage } from '@electron/asar'; 2 3const src = 'some/path/'; 4const dest = 'name.asar'; 5 6await createPackage(src, dest); 7console.log('done.');
Please note that there is currently no error handling provided!
You can pass in a transform
option, that is a function, which either returns
nothing, or a stream.Transform
. The latter will be used on files that will be
in the .asar
file to transform them (e.g. compress).
1import { createPackageWithOptions } from '@electron/asar'; 2 3const src = 'some/path/'; 4const dest = 'name.asar'; 5 6function transform (filename) { 7 return new CustomTransformStream() 8} 9 10await createPackageWithOptions(src, dest, { transform: transform }); 11console.log('done.');
Asar uses Pickle to safely serialize binary value to file.
The format of asar is very flat:
| UInt32: header_size | String: header | Bytes: file1 | ... | Bytes: file42 |
The header_size
and header
are serialized with Pickle class, and
header_size
's Pickle object is 8 bytes.
The header
is a JSON string, and the header_size
is the size of header
's
Pickle
object.
Structure of header
is something like this:
1{ 2 "files": { 3 "tmp": { 4 "files": {} 5 }, 6 "usr" : { 7 "files": { 8 "bin": { 9 "files": { 10 "ls": { 11 "offset": "0", 12 "size": 100, 13 "executable": true, 14 "integrity": { 15 "algorithm": "SHA256", 16 "hash": "...", 17 "blockSize": 1024, 18 "blocks": ["...", "..."] 19 } 20 }, 21 "cd": { 22 "offset": "100", 23 "size": 100, 24 "executable": true, 25 "integrity": { 26 "algorithm": "SHA256", 27 "hash": "...", 28 "blockSize": 1024, 29 "blocks": ["...", "..."] 30 } 31 } 32 } 33 } 34 } 35 }, 36 "etc": { 37 "files": { 38 "hosts": { 39 "offset": "200", 40 "size": 32, 41 "integrity": { 42 "algorithm": "SHA256", 43 "hash": "...", 44 "blockSize": 1024, 45 "blocks": ["...", "..."] 46 } 47 } 48 } 49 } 50 } 51}
offset
and size
records the information to read the file from archive, the
offset
starts from 0 so you have to manually add the size of header_size
and
header
to the offset
to get the real offset of the file.
offset
is a UINT64 number represented in string, because there is no way to
precisely represent UINT64 in JavaScript Number
. size
is a JavaScript
Number
that is no larger than Number.MAX_SAFE_INTEGER
, which has a value of
9007199254740991
and is about 8PB in size. We didn't store size
in UINT64
because file size in Node.js is represented as Number
and it is not safe to
convert Number
to UINT64.
integrity
is an object consisting of a few keys:
algorithm
, currently only SHA256
is supported.hash
value representing the hash of the entire file.blocks
of the file. i.e. for a blockSize of 4KB this array contains the hash of every block if you split the file into N 4KB blocks.blockSize
representing the size in bytes of each block in the blocks
hashes aboveNo vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
all changesets reviewed
Reason
all dependencies are pinned
Details
Reason
no binaries found in the repo
Reason
license file detected
Details
Reason
2 existing vulnerabilities detected
Details
Reason
branch protection is not maximal on development and all release branches
Details
Reason
6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
Reason
security policy file not detected
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Score
Last Scanned on 2025-06-30
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More