node-tar is a robust and fast full-featured library for creating and extracting tar archives in Node.js, designed to mimic the `tar(1)` utility on Unix systems. The current stable version is 7.5.13, requiring Node.js >=18. It prioritizes security, implementing extensive hardening measures against various filesystem-based attacks, such as path traversal, symbolic link manipulation, and malicious file types, especially critical for use cases like the npm registry. Unlike many ad-hoc tar implementations, node-tar has undergone years of scrutiny and intensive use, making it one of the most secure JavaScript tar extractors available. While it doesn't have a fixed release cadence, updates are issued as needed for bug fixes, security patches, or feature enhancements.
npm install tarVerified import paths — ran on the pinned version, not inferred.
Demonstrates how to create a non-gzipped tar archive from a directory and then extract its contents into a new location using `node-tar`.
Ensure the extraction target directory and its parent directories are owned and controlled only by trusted processes. Always extract into a newly created, isolated directory.
Update to the latest `node-tar` (v7.x or higher) to ensure compatibility with modern `minipass` versions and leverage the latest security patches and features.
Implement a `filter` option during extraction, e.g., `tar.extract({ ..., filter: (path, stat) => !stat.isSymbolicLink() && !stat.isFile() /* for hardlinks */ }, ...)`.Use the `filter` option during extraction to check `stat.size` against a reasonable maximum, e.g., `tar.extract({ ..., filter: (path, stat) => stat.size < MAX_FILE_SIZE_BYTES }, ...)`.Always stay up to date with the latest major version of `node-tar`. Upgrade to v7.x or later to benefit from ongoing maintenance, security hardening, and bug fixes.
Use named imports: `import { create } from 'tar';` or `import * as tar from 'tar';` then `tar.create(...)`.Ensure the Node.js process has appropriate file system permissions. If extracting, consider changing the `cwd` option or running with elevated privileges (with caution, especially for untrusted archives).
Verify the `file` path and the `cwd` option are correct and point to an existing tarball. Use `path.resolve()` for absolute paths if necessary.
This is generally a security feature working as intended. If you *intended* to allow such links, set `preservePaths: true` (with extreme caution, as it disables many security protections) or implement a custom `filter` function to allow specific links after careful validation.