tar-fs

filesystem bindings for tar-stream

Latest 3.1.3

NPM

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

All three recent commits came from one contributor, so maintenance continuity depends heavily on a single person.

Repo tooling

No build tools or security scanning tools were detected; this is a modest transparency and maintenance gap, although the repository is small and has a straightforward test workflow.

Token permissions

The only workflow has no top-level token permissions declaration, leaving its default GitHub Actions token scope less explicit than recommended.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-414442 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. tar-fs is vulnerable to Path Traversal in versions 3.0.0 - 3.1.2 and 0.5.1 - 2.1.4.	0.5.1 - 2.1.43.0.0 - 3.1.2	Medium
CVE-2025-59343 tar-fs is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 3.0.0 - 3.1.1, 2.0.0 - 2.1.4 and 0.0.0 - 1.16.6.	0.0.0 - 1.16.62.0.0 - 2.1.43.0.0 - 3.1.1	High
CVE-2025-48387 tar-fs is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 1.16.5, 2.0.0 - 2.1.3 and 3.0.0 - 3.0.9.	0.0.0 - 1.16.52.0.0 - 2.1.33.0.0 - 3.0.9	High
CVE-2024-12905 tar-fs is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 1.16.4, 2.0.0 - 2.1.2 and 3.0.0 - 3.0.7.	0.0.0 - 1.16.42.0.0 - 2.1.23.0.0 - 3.0.7	High
CVE-2018-20835 tar-fs is vulnerable to Improper Input Validation in versions 0.0.0 - 1.16.2.	0.0.0 - 1.16.2	High