modern-tar

Zero dependency streaming tar parser and writer for JavaScript.

Latest 0.8.5

NPM

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The linked repository is owned by a user rather than an organization, so no organizational maintenance handoff or backing should be assumed.

Repo bus factor

One contributor produced 100% of the 53 commits during the last three months, creating a genuine single-maintainer continuity risk; the repository is user-owned rather than organization-owned, so there is no project-backing compensation shown.

Repo tooling

The repository uses TypeScript and Vitest build tooling, but no security-scanning tools were detected; this is a security-hygiene gap rather than evidence of abandonment.

Security policy

No security policy was found in the repository, leaving vulnerability-reporting and response expectations undocumented.

Version stability

The release is not a prerelease, but version 0.8.5 remains before a stable 1.0 major, so API and compatibility maturity are somewhat less established.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-386051 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. modern-tar is vulnerable to Path Traversal in versions 0.0.0 - 0.7.6.	0.0.0 - 0.7.6	High
AIKIDO-2026-10422 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. modern-tar is vulnerable to Integer Overflow in versions 0.7.0 - 0.7.5.	0.7.0 - 0.7.5	Medium
AIKIDO-2026-10275 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. modern-tar is vulnerable to Prototype Pollution in versions 0.4.0 - 0.7.3.	0.4.0 - 0.7.3	Low