n8n-io/n8n · error · Error

tar extraction failed: ${tarResult.stderr?.toString()}

Error message

tar extraction failed: ${tarResult.stderr?.toString()}

What it means

Thrown by downloadAndExtractPackage when the system `tar` binary exits non-zero while extracting a freshly downloaded npm tarball into the per-package directory. Distinct from error 926 (which extracts the source tarball) - this one unpacks the published package itself. The error embeds tar's stderr.

Source

Thrown at packages/@n8n/scan-community-package/scanner/scanner.mjs:109

		const tarballName = fs.readdirSync(TEMP_DIR).find((file) => file.endsWith('.tgz'));
		if (!tarballName) {
			throw new Error('Tarball not found');
		}

		// Unpack the tarball
		const packageDir = safeJoinPath(TEMP_DIR, `${packageName}-${version}`);
		fs.mkdirSync(packageDir, { recursive: true });
		const tarResult = spawnSync(
			'tar',
			['-xzf', tarballName, '-C', packageDir, '--strip-components=1'],
			{
				cwd: TEMP_DIR,
				stdio: 'pipe',
				shell: process.platform === 'win32',
			},
		);
		if (tarResult.status !== 0) {
			throw new Error(`tar extraction failed: ${tarResult.stderr?.toString()}`);
		}
		fs.unlinkSync(safeJoinPath(TEMP_DIR, tarballName));

		return packageDir;
	} catch (error) {
		console.error(`\nFailed to download package: ${error.message}`);
		throw error;
	}
};

/**
 * Extracts the source repository and commit a package was built from, out of
 * its npm provenance attestation. Provenance is already mandatory for the
 * scan to proceed, so any package that reaches this point attests exactly
 * which source produced the published artifact.
 *
 * Returns `{ owner, repo, gitCommit }`, or `null` when the attestation is
 * missing, malformed, or points at an unsupported host.

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Read the embedded tar stderr - 'No such file or directory' means tar is missing; 'Unexpected EOF' means the tarball is truncated.
2. Install or expose a `tar` binary (bsdtar on Windows via git-for-windows, or tar on Linux/macOS).
3. Re-run the scan after clearing TEMP_DIR so a stale/truncated .tgz is re-downloaded.
4. If the registry serves zstd tarballs, use a tar build with zstd support or fall back to Node's tar library.

Example fix

// before
const tarResult = spawnSync('tar', ['-xzf', tarballName, '-C', packageDir, '--strip-components=1'], { cwd: TEMP_DIR });

// after - prefer Node tar, fall back to system tar
import { extract } from 'tar';
try {
  await extract({ file: safeJoinPath(TEMP_DIR, tarballName), cwd: packageDir, strip: 1 });
} catch {
  const tarResult = spawnSync('tar', ['-xzf', tarballName, '-C', packageDir, '--strip-components=1'], { cwd: TEMP_DIR });
  if (tarResult.status !== 0) throw new Error(`tar extraction failed: ${tarResult.stderr?.toString()}`);
}

import { execFileSync } from 'node:child_process';

function tarAvailable(): boolean {
  try { execFileSync('tar', ['--version'], { stdio: 'pipe' }); return true; }
  catch { return false; }
}

if (!tarAvailable()) {
  throw new Error('tar binary not found; install bsdtar/gnu tar before scanning');
}

try {
  // extraction
} catch (e) {
  const stderr = (e as Error).message;
  if (stderr.includes('Unexpected EOF')) {
    // truncated download - clear TEMP_DIR and retry once
    fs.rmSync(TEMP_DIR, { recursive: true, force: true });
    throw new Error('Tarball truncated; cleared TEMP_DIR for retry');
  }
  if (stderr.includes('No such file')) throw new Error('tar binary missing on PATH');
  throw e;
}

When it happens

Trigger: spawnSync('tar', ['-xzf', tarballName, '-C', packageDir, '--strip-components=1']) returns status !== 0 because the tarball is corrupt/truncated, the `tar` binary is missing (common on minimal Windows images), packageDir could not be created, or the tarball uses a format the system tar rejects (e.g. zstd-compressed).

Common situations: Running the scanner on a Windows host without `tar` on PATH; CI runner killed mid-download leaving a truncated .tgz; npm registry serving a tarball compressed with an unsupported algorithm; packageDir creation failed silently (read-only TEMP_DIR).

Related errors

• Path traversal detected, refusing to join paths: ${parentPat
• Tarball not found
• Duplicate skill source directory "${normalizedSkill.sourceDi
• Invalid skill at ${sourceDirectory}: ${errors.join('; ')}
• Filesystem "${this.id}" is not ready (status: ${this.status}

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/49960827b11eaf0a. Report an issue: GitHub.