tar entry '{}' extends beyond archive (offset={}, size={}, a

Error message

tar entry '{}' extends beyond archive (offset={}, size={}, archive_len={})

What it means

The extractor slices the in-memory tarball buffer with tar_data.get(data_offset..end); when the entry's declared [offset, offset+size) range runs past the end of the buffer, get() returns None and this UnexpectedEof error is thrown with the entry path, offset, size and actual archive length. It means the tar headers describe more data than the archive actually contains — a truncated or corrupt tarball.

Source

Thrown at libs/npm_cache/tarball_extract.rs:420

      EntryType::Regular => {
        let open_options = OpenOptions::new_write();
        let mut f = sys.fs_open(&absolute_path, &open_options)?;
        let data_offset = entry.raw_file_position() as usize;
        let size = entry.header().size()? as usize;
        let end = data_offset.checked_add(size).ok_or_else(|| {
          std::io::Error::new(
            std::io::ErrorKind::InvalidData,
            format!(
              "tar entry '{}' has invalid offset/size (offset={}, size={})",
              absolute_path.display(),
              data_offset,
              size,
            ),
          )
        })?;
        let entry_data =
          tar_data.get(data_offset..end).ok_or_else(|| {
            std::io::Error::new(
              std::io::ErrorKind::UnexpectedEof,
              format!(
                "tar entry '{}' extends beyond archive (offset={}, size={}, archive_len={})",
                absolute_path.display(),
                data_offset,
                size,
                tar_data.len(),
              ),
            )
          })?;
        f.write_all(entry_data)?;
        if !sys_traits::impls::is_windows() {
          let mode = entry.header().mode()?;
          if mode != 0o644 {
            f.fs_file_set_permissions(mode)?;
          }
        }
      }

View on GitHub (pinned to 9ad36f7a2c)

Solutions

Remove the cached tarball for that package/version and retry so it is downloaded again.
Re-run the install with cache reload (e.g. deno install --reload) to bypass the truncated copy.
Check disk space and network stability; if a fresh download still truncates, capture the tarball and compare its shasum/size with the registry metadata, then report the mirror/CDN problem.

Example fix

# before
deno install   # error: tar entry 'package/lib/big.wasm' extends beyond archive (offset=1048576, size=5242880, archive_len=2097152)

# after
rm -rf ~/.cache/deno/npm/registry.npmjs.org/pkg
deno install --reload

Defensive patterns

Strategy: retry

Validate before calling

// guard: downloaded length must match the Content-Length / integrity size before caching
async fn download_full(client: &Client, url: &str, expected_len: u64) -> anyhow::Result<Vec<u8>> {
  let bytes = client.get(url).send().await?.error_for_status()?.bytes().await?;
  anyhow::ensure!(bytes.len() as u64 == expected_len, "truncated download: got {} of {}", bytes.len(), expected_len);
  Ok(bytes.to_vec())
}

Try / catch

match extract_tarball(&tar_data, &dest) {
  Ok(()) => {}
  Err(err) if err.kind() == std::io::ErrorKind::UnexpectedEof => {
    // truncated archive — drop the cached copy and re-download, then retry once
    fs::remove_file(&cached_tgz).ok();
    let tar_data = re_download(&pkg).await?;
    extract_tarball(&tar_data, &dest)?;
  }
  Err(err) => return Err(err),
}

Prevention

Check Content-Length/integrity after download and before writing to the npm cache.
Keep enough free disk space — disk-full during cache writes is a common source of truncated tarballs.
On CI, retry network-dependent installs once after clearing the cache instead of failing the pipeline on a truncation.

When it happens

Trigger: Extracting an npm tarball that was cut short: an interrupted download, a proxy that closed the response early, a partially-written cache file (disk full or process killed mid-write), or a registry CDN serving a bad artifact.

Common situations: Flaky CI networks that truncate large package downloads; disk-full during first install; cache written by an older killed process; npm mirrors lagging/corrupting artifacts; antivirus quarantine removing part of the file.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/5e04b71a3a366661. Report an issue: GitHub.