`tar-fs`

Ecosystem:
npm

Package URL:
pkg:npm/tar-fs

Total PRs:
24,107 Dependabot PRs

Latest PR:
2 days ago

Unique Repositories:
14,028 repositories

Unique Repos (30 days):
55 repositories

Security Advisories

tar-fs can extract outside the specified dir with a specific tarball

GHSA-8cj5-5rvv-wf4v CVE-2025-48387 HIGH published 12 months ago • updated 23 days ago

### Impact v3.0.8, v2.1.2, v1.16.4 and below ### Patches Has been patched in 3.0.9, 2.1.3, and 1.16.5 ### Workarounds You can use the ignore opt...

tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

GHSA-pq67-2wwv-3xjx CVE-2024-12905 HIGH published about 1 year ago • updated about 1 hour ago

An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"...

Improper Input Validation in tar-fs

GHSA-x2mc-8fgj-3wmr CVE-2018-20835 HIGH published about 7 years ago • updated 1 day ago

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a fi...

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

GHSA-vj76-c3g6-qr5v CVE-2025-59343 HIGH published 8 months ago • updated about 1 hour ago

### Impact v3.1.0, v2.1.3, v1.16.5 and below ### Patches Has been patched in 3.1.1, 2.1.4, and 1.16.6 ### Workarounds You can use the ignore opt...

Recent PRs

RSS Feed

Bump tar-fs from 3.1.0 to 3.1.2 in /js

rmcode-benchmark/clean20260529-2327__keycloak-greptile__rmcode-dev__PR1__20260530 #30

3.1.0 → 3.1.2 Patch PR

Open 2 days ago 1 comment

Bump tar-fs from 3.1.0 to 3.1.2 in /js

rmcode-benchmark/clean20260529-1728__keycloak__rmcode-dev__PR40940__20260529 #19

3.1.0 → 3.1.2 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 19 updates

NYPL/nypl-library-card-app #745

2.1.3 → 2.1.4 Patch PR

Open 2 days ago 1 comment

Bump tar-fs from 3.0.8 to 3.1.2 in /js

rmcode-benchmark/keycloak__keycloak__rmcode-dev__PR37634__20260529 #33

3.0.8 → 3.1.2 Minor PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 16 updates

ali963git/keycloak-nodejs-connect #11

3.0.8 → 3.1.1 Minor PR

Open 4 days ago 3 comments

Bump tar-fs from 2.1.3 to 2.1.4

stephendmann/LeadershipIntel #8

2.1.3 → 2.1.4 Patch PR

Open 5 days ago 1 comment

Bump tar-fs from 3.0.8 to 3.1.2 in /js

pr-review-agent-bench/keycloak__keycloak__diffjudge__PR37634__20260527 #65

3.0.8 → 3.1.2 Minor PR

Open 5 days ago 1 comment

Bump the npm_and_yarn group across 16 directories with 19 updates

Future-whitehat7/react #10

1.16.0 → 1.16.6 Patch PR

Closed 7 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 8 updates

FortiShield/code-editor #11

2.1.1 → 2.1.4 Patch PR

Open 9 days ago 1 comment

Bump the npm_and_yarn group across 9 directories with 19 updates

Surfndez/next.js #15

2.0.0 → 2.1.4 Minor PR

Closed 10 days ago 1 comment

Bump tar-fs from 3.0.8 to 3.1.2 in /js

CloudSmith-Agent-Benchmark/keycloak__PR37429 #53

3.0.8 → 3.1.2 Minor PR

Open 10 days ago 1 comment

Bump the npm-dependencies group across 1 directory with 33 updates

Win1817/keycloak #22

3.1.1 → 3.1.2 Patch PR

Closed 11 days ago 2 comments

Bump the npm_and_yarn group across 4 directories with 12 updates

gionabbe/react #6

1.16.0 → 1.16.6 Patch PR

Closed 12 days ago 1 comment

chore(deps): bump tar-fs from 2.1.3 to 2.1.4

txpipe-shop/cardano-graphical-tx #273

2.1.3 → 2.1.4 Patch PR

Closed 13 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 3 directories with 7 updates

asleekgeek/docusaurus #234

2.1.1 → 3.1.2 Major PR

Open 13 days ago 3 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates

Dargon789/coinbase-wallet-sdk #199

3.0.5 → 3.1.2 Minor PR

Open 13 days ago 3 comments

Bump the npm_and_yarn group across 1 directory with 29 updates

ivanm696/chatbot-ui #1

2.1.1 → 2.1.4 Patch PR

Open 13 days ago 2 comments

Bump tar-fs from 3.0.8 to 3.1.2 in /js

imantubex-create/keycloak__keycloak__prixai__PR37634__20260516 #14

3.0.8 → 3.1.2 Minor PR

Open 16 days ago 2 comments

Bump tar-fs from 3.0.6 to 3.1.2

imantubex-create/keycloak__keycloak__prixai__PR32918__20260516 #29

3.0.6 → 3.1.2 Minor PR

Open 16 days ago 2 comments

Bump tar-fs from 3.0.6 to 3.1.2

imantubex-create/keycloak__prixai__PR32918__20260516 #10

3.0.6 → 3.1.2 Minor PR

Open 16 days ago 2 comments

Bump the npm_and_yarn group across 1 directory with 26 updates

FacePrintPay/bolt.new #1

2.1.1 → 2.1.4 Patch PR

Open 17 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 25 updates

ZoneCog/zone.bolt #32

2.1.1 → 2.1.4 Patch PR

Closed 17 days ago 3 comments

Bump the npm_and_yarn group across 1 directory with 26 updates

GrantBirki/bean-quest #12

2.1.1 → 2.1.4 Patch PR

Open 17 days ago 1 comment

Bump the npm_and_yarn group across 7 directories with 20 updates

Surfndez/next.js #12

2.0.0 → 2.1.4 Minor PR

Closed 18 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 15 updates

drzo/bolt.ceo #28

2.1.2 → 2.1.4 Patch PR

Closed 20 days ago 2 comments

chore(deps): bump the npm_and_yarn group across 11 directories with 14 updates

GlacierEQ/openai-node #39

3.0.6 → 3.1.2 Minor PR

Open 20 days ago 6 comments

chore(deps): bump the npm_and_yarn group across 2 directories with 22 updates

bobdavis84/gemini-cli #22

2.1.3 → 2.1.4 Patch PR

Closed 21 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 11 directories with 13 updates

GlacierEQ/openai-node #38

3.0.6 → 3.1.2 Minor PR

Open 23 days ago 4 comments

Bump the npm_and_yarn group across 5 directories with 17 updates

blck-snwmn/playground-ts #144

2.1.3 → 2.1.4 Patch PR

Closed 23 days ago 1 comment

build(deps): bump the npm_and_yarn group across 3 directories with 20 updates

Asper-Beauty-Shop/supabase-js #27

3.1.0 → 3.1.2 Patch PR

Closed 24 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 7 updates

RetireJS/retire-site-scanner #7

3.0.6 → 3.1.2 Minor PR

Closed 25 days ago 1 comment

Bump the npm-dependencies group across 1 directory with 30 updates

Win1817/keycloak #21

3.1.1 → 3.1.2 Patch PR

Closed 25 days ago 2 comments

Bump the npm-dependencies group across 1 directory with 29 updates

sg-evals/keycloak--6fd372cb #20

3.1.1 → 3.1.2 Patch PR

Closed 25 days ago 2 comments

Bump the npm-dependencies group across 1 directory with 28 updates

Code-Review-Assessment-2026/test_subset_6__keycloak__claude__PR37634__20260407 #14

3.1.1 → 3.1.2 Patch PR

Open 25 days ago 1 comment

Bump the npm-dependencies group across 1 directory with 27 updates

86dh/keycloak #940

3.1.1 → 3.1.2 Patch PR

Open 25 days ago 1 comment

Bump the npm-dependencies group across 1 directory with 27 updates

thomasdarimont/keycloak #1232

3.1.1 → 3.1.2 Patch PR

Closed 25 days ago 2 comments

Bump the npm_and_yarn group across 1 directory with 10 updates

ZhongRuoyu/shorten.js #2

2.1.1 → 2.1.4 Patch PR

Closed 25 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 20 updates

bobdavis84/gemini-cli #20

2.1.3 → 2.1.4 Patch PR

Closed 26 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 4 directories with 27 updates

RyzinRiley/Yarnpkg #12

1.16.3 → 1.16.6 Patch PR

Closed 26 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 4 directories with 27 updates

RyzinRiley/Yarnpkg #10

1.16.3 → 1.16.6 Patch PR

Closed 26 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 7 updates

Dargon789/app-monorepo #86

2.1.3 → 2.1.4 Patch PR

Open 26 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 23 updates

FacePrintPay/npm-documentation #1

2.1.1 → 2.1.4 Patch PR

Closed 27 days ago 2 comments

chore(deps): Bump the npm_and_yarn group across 6 directories with 14 updates

jadenblack/puppeteer #10

3.0.4 → 3.1.2 Minor PR

Open 27 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 10 updates

Jamq513/react-router #3

2.1.3 → 2.1.4 Patch PR

Closed 27 days ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 20 updates

chriscarlton5/wordpuzzles #7

2.1.2 → 2.1.4 Patch PR

Closed 28 days ago 2 comments

Bump the npm_and_yarn group across 5 directories with 26 updates

getflip/swirl #1637

1.16.3 → 1.16.6 Patch PR

Open 28 days ago 1 comment

Bump tar-fs from 3.0.6 to 3.1.2

sc-vikvorona-test/keycloak__keycloak__sonar-review__PR32918__20260504 #18

3.0.6 → 3.1.2 Minor PR

Open 28 days ago 2 comments

build(deps): bump the npm_and_yarn group across 3 directories with 20 updates

MetaMask/snap-bitcoin-wallet #603

2.1.3 → 2.1.4 Patch PR

Open 28 days ago 2 comments

chore(deps): Bump the npm_and_yarn group across 1 directory with 2 updates

SantiagoXOR/pintureria-digital #26

2.1.1 → 3.1.1 Major PR

Open 28 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 25 updates

UNLP-Accesible/unlp-accesible #15

2.1.1 → 2.1.4 Patch PR

Open 28 days ago 2 comments

Package Details

Name:	`tar-fs`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/tar-fs`
JSON API:	View JSON

Security Advisories

4

Active advisories

HIGH 4

View All npm Advisories

Package Information

Description:

filesystem bindings for tar-stream

Repository:	https://github.com/mafintosh/tar-fs
Homepage:	https://github.com/mafintosh/tar-fs
Latest Release:	`3.0.9` about 1 year ago
Dependent Repos:	404,503
Dependent Packages:	1,213
Downloads:	98,992,404
Ranking:	Top 0.0565% by dependent repos Top 0.0247% by downloads Top 0.0588% by dependent pkgs

PR Status

Open 11,837 (49.1%)

Merged 3,445 (14.3%)

Closed 6,363 (26.4%)

PR Types

Major 1,177 (4.9%)

Minor 3,122 (13.0%)

Patch 17,309 (71.8%)

Removal 9 (0.0%)