Zero-dependency streaming tar parser and writer for JavaScript
2 days ago
- The NPM ecosystem suffers from legacy dependencies, which slow down applications, increase install times, and expand the attack surface for supply chain attacks.
- e18e.dev is a movement to modernize the ecosystem by promoting cleaner, more efficient libraries like modern-tar, a zero-dependency, standards-compliant TAR parser.
- The architecture of modern-tar decouples parsing logic from I/O, using a pure, synchronous state machine that works across runtimes, including browsers and Node.js.
- A zero-copy ring buffer minimizes memory allocations and garbage collector pressure by storing references to incoming data rather than copying it.
- To handle concurrency and security, modern-tar uses a path-caching mechanism with promise chains, enabling parallel processing while maintaining strict sequential order and preventing vulnerabilities like TOCTOU.
- Benchmarks show modern-tar is 1.4x faster than node-tar and 2.6x faster than tar-fs for archives with many small files, while being stable, actively maintained, and widely adopted in the industry.