tar
Healthy and suitable to depend on. It has a long release history, frequent recent releases, current repository activity, strong documentation, tests in the repository, and a security policy. Maintenance is concentrated in one contributor, and the release lacks build provenance and automated security scanning.
82%
Total Score
63
100
94
80
50
Health Score Breakdown
No build attestation or trusted-publisher provenance is present, leaving the link between the published artifact and its source less independently verifiable.
A prepare script runs during installation or package preparation, adding some supply-chain exposure, although the provided signals do not show dangerous workflow behavior.
The repository is owned by the named user account isaacs rather than an organization, so the one-person maintenance concentration is not offset by visible organizational backing.
All 12 recent commits came from one contributor, so maintenance depends heavily on a single person and has a meaningful bus-factor risk.
There were 12 commits from one active maintainer in the last three months, demonstrating recent work but limited maintenance breadth.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-48452 tar is vulnerable to Uncontrolled Recursion in versions 3.0.0 - 7.5.20. | 3.0.0 - 7.5.20 | Medium |
AIKIDO-2026-401672 tar is vulnerable to Denial of Service (DoS) in versions 0.0.0 - 7.5.17. | 0.0.0 - 7.5.17 | Medium |
CVE-2026-59873 tar is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.0.0 - 7.5.18. | 0.0.0 - 7.5.18 | High |
AIKIDO-2026-732519 tar is vulnerable to Denial of Service in versions 0.0.0 - 7.5.17. | 0.0.0 - 7.5.17 | High |
AIKIDO-2026-568044 tar is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 7.5.16. | 0.0.1 - 7.5.16 | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 chownr Version ^3.0.0 | — | — |
yallist Version ^5.0.0 | — | — |
minipass Version ^7.1.2 | — | — |
minizlib Version ^3.1.0 | — | — |
@isaacs/fs-minipass Version ^4.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 14 years ago
- Unpacked Size
- 2.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.