modern-tar

Zero dependency streaming tar parser and writer for JavaScript.

Latest 0.8.6

82%

Total Score

healthy

Active releases, recent commits, tests, provenance, and clean packaging outweigh concentrated ownership and publishing-workflow concerns.

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the highly concentrated commit activity has no visible organizational handoff support.

Repo bus factor

One contributor made 42 of 43 recent commits, so maintenance is highly concentrated despite a second active contributor.

Repo tooling

The repository uses TypeScript, Vitest, and npm scripts, but no security-scanning tools were detected. The missing scanner is a modest transparency gap rather than evidence of abandonment.

Security policy

No repository security policy was detected, leaving the process for reporting vulnerabilities unspecified.

Workflow audit

All three workflows were analyzed, use read-only permissions, and have all 15 action references pinned. The audit reports high-confidence trusted-publishing usage, which warrants caution; the cache-poisoning findings are low-confidence hygiene observations.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-386051 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. modern-tar is vulnerable to Path Traversal in versions 0.0.0 - 0.7.6.	0.0.0 - 0.7.6	High
AIKIDO-2026-10422 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. modern-tar is vulnerable to Integer Overflow in versions 0.7.0 - 0.7.5.	0.7.0 - 0.7.5	Medium
AIKIDO-2026-10275 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. modern-tar is vulnerable to Prototype Pollution in versions 0.4.0 - 0.7.3.	0.4.0 - 0.7.3	Low