Gathering detailed insights and metrics for tar-fs
Gathering detailed insights and metrics for tar-fs
Gathering detailed insights and metrics for tar-fs
Gathering detailed insights and metrics for tar-fs
npm install tar-fs
Typescript
Module System
Node Version
NPM Version
88.8
Supply Chain
100
Quality
92.6
Maintenance
100
Vulnerability
100
License
JavaScript (100%)
Total Downloads
2,839,910,288
Last Day
1,270,413
Last Week
21,888,365
Last Month
93,520,922
Last Year
978,697,299
MIT License
364 Stars
189 Commits
89 Forks
6 Watchers
3 Branches
26 Contributors
Updated on Jun 30, 2025
Minified
Minified + Gzipped
Latest Version
3.1.0
Package Id
tar-fs@3.1.0
Unpacked Size
17.10 kB
Size
5.52 kB
File Count
4
NPM Version
10.9.2
Node Version
22.16.0
Published on
Jun 30, 2025
Cumulative downloads
Total Downloads
Last Day
-0.7%
1,270,413
Compared to previous day
Last Week
-5.7%
21,888,365
Compared to previous week
Last Month
2.7%
93,520,922
Compared to previous month
Last Year
29.1%
978,697,299
Compared to previous year
Filesystem bindings for tar-stream.
npm install tar-fs
tar-fs allows you to pack directories into tarballs and extract tarballs into directories.
It doesn't gunzip for you, so if you want to extract a .tar.gz
with this you'll need to use something like gunzip-maybe in addition to this.
1const tar = require('tar-fs') 2const fs = require('fs') 3 4// packing a directory 5tar.pack('./my-directory').pipe(fs.createWriteStream('my-tarball.tar')) 6 7// extracting a directory 8fs.createReadStream('my-other-tarball.tar').pipe(tar.extract('./my-other-directory'))
To ignore various files when packing or extracting add a ignore function to the options. ignore
is also an alias for filter
. Additionally you get header
if you use ignore while extracting.
That way you could also filter by metadata.
1const pack = tar.pack('./my-directory', { 2 ignore (name) { 3 return path.extname(name) === '.bin' // ignore .bin files when packing 4 } 5}) 6 7const extract = tar.extract('./my-other-directory', { 8 ignore (name) { 9 return path.extname(name) === '.bin' // ignore .bin files inside the tarball when extracing 10 } 11}) 12 13const extractFilesDirs = tar.extract('./my-other-other-directory', { 14 ignore (_, header) { 15 // pass files & directories, ignore e.g. symlinks 16 return header.type !== 'file' && header.type !== 'directory' 17 } 18})
You can also specify which entries to pack using the entries
option
1const pack = tar.pack('./my-directory', { 2 entries: ['file1', 'subdir/file2'] // only the specific entries will be packed 3})
If you want to modify the headers when packing/extracting add a map function to the options
1const pack = tar.pack('./my-directory', { 2 map (header) { 3 header.name = 'prefixed/'+header.name 4 return header 5 } 6}) 7 8const extract = tar.extract('./my-directory', { 9 map (header) { 10 header.name = 'another-prefix/'+header.name 11 return header 12 } 13})
Similarly you can use mapStream
incase you wanna modify the input/output file streams
1const pack = tar.pack('./my-directory', { 2 mapStream (fileStream, header) { 3 // NOTE: the returned stream HAS to have the same length as the input stream. 4 // If not make sure to update the size in the header passed in here. 5 if (path.extname(header.name) === '.js') { 6 return fileStream.pipe(someTransform) 7 } 8 return fileStream 9 } 10}) 11 12const extract = tar.extract('./my-directory', { 13 mapStream (fileStream, header) { 14 if (path.extname(header.name) === '.js') { 15 return fileStream.pipe(someTransform) 16 } 17 return fileStream 18 } 19})
Set options.fmode
and options.dmode
to ensure that files/directories extracted have the corresponding modes
1const extract = tar.extract('./my-directory', { 2 dmode: parseInt(555, 8), // all dirs should be readable 3 fmode: parseInt(444, 8) // all files should be readable 4})
It can be useful to use dmode
and fmode
if you are packing/unpacking tarballs between *nix/windows to ensure that all files/directories unpacked are readable.
Alternatively you can set options.readable
and/or options.writable
to set the dmode and fmode to readable/writable.
1var extract = tar.extract('./my-directory', { 2 readable: true, // all dirs and files should be readable 3 writable: true, // all dirs and files should be writable 4})
Set options.strict
to false
if you want to ignore errors due to unsupported entry types (like device files)
To dereference symlinks (pack the contents of the symlink instead of the link itself) set options.dereference
to true
.
Copying a directory with permissions and mtime intact is as simple as
1tar.pack('source-directory').pipe(tar.extract('dest-directory'))
tar-stream
Use finalize: false
and the finish
hook to
leave the pack stream open for further entries (see
tar-stream#pack
),
and use pack
to pass an existing pack stream.
1const mypack = tar.pack('./my-directory', { 2 finalize: false, 3 finish (sameAsMypack) { 4 mypack.entry({name: 'generated-file.txt'}, "hello") 5 tar.pack('./other-directory', { 6 pack: sameAsMypack 7 }) 8 } 9})
MIT
0/10
Summary
tar-fs can extract outside the specified dir with a specific tarball
Affected Versions
>= 3.0.0, < 3.0.9
Patched Versions
3.0.9
0/10
Summary
tar-fs can extract outside the specified dir with a specific tarball
Affected Versions
>= 2.0.0, < 2.1.3
Patched Versions
2.1.3
0/10
Summary
tar-fs can extract outside the specified dir with a specific tarball
Affected Versions
< 1.16.5
Patched Versions
1.16.5
7.5/10
Summary
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Affected Versions
>= 3.0.0, < 3.0.7
Patched Versions
3.0.7
7.5/10
Summary
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Affected Versions
>= 2.0.0, < 2.1.2
Patched Versions
2.1.2
7.5/10
Summary
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Affected Versions
< 1.16.4
Patched Versions
1.16.4
7.5/10
Summary
Improper Input Validation in tar-fs
Affected Versions
< 1.16.2
Patched Versions
1.16.2
Reason
security policy file detected
Details
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
Reason
4 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 6
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
Found 2/30 approved changesets -- score normalized to 0
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
Reason
branch protection not enabled on development/release branches
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Score
Last Scanned on 2025-06-23
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More