CVE-2026-31802 — npm tar Path Traversal Scanner

Detects npm packages vulnerable to CVE-2026-31802, a path traversal vulnerability in the tar npm package that allows arbitrary file writes during archive extraction.

Features

Scans package-lock.json for vulnerable tar versions
Checks node_modules for installed vulnerable packages
Tests extraction behavior with crafted tar archives
Identifies dependency chains leading to vulnerable tar
Supports bulk scanning of multiple projects
JSON/CSV report generation
Remediation recommendations

Installation

git clone https://github.com/ridhinva/npm-tar-traversal-scanner.git
cd npm-tar-traversal-scanner
pip3 install -r requirements.txt

Usage

Scan Current Directory

python3 npm_tar_scanner.py

Scan Specific Project

python3 npm_tar_scanner.py /path/to/project

Scan package-lock.json Directly

python3 npm_tar_scanner.py --lock-file /path/to/package-lock.json

Bulk Scan Multiple Projects

python3 npm_tar_scanner.py --bulk /path/to/projects/

Generate Report

python3 npm_tar_scanner.py --report json --output report.json
python3 npm_tar_scanner.py --report csv --output report.csv

Check with Exploit Test

python3 npm_tar_scanner.py --test-exploit /path/to/project

Vulnerable Versions

Package	Vulnerable Range	Fixed In
`tar`	< 6.2.1	6.2.1
`tar`	7.0.0-alpha.0 - 7.0.0-alpha.5	7.0.0-alpha.6

How It Works

Parses package-lock.json to extract dependency tree
Checks tar package version against known vulnerable ranges
Identifies if tar is a direct or transitive dependency
Optionally tests extraction with a crafted tar containing ../ path entries
Reports vulnerable projects with dependency chain and remediation steps

Example Output

[!] CVE-2026-31802 - npm tar Path Traversal Scanner
[+] Scanning: /home/user/my-project
[!] VULNERABLE: [email protected] (locked in package-lock.json)
    Path: node_modules/tar
    Dependency chain: my-project -> node-gyp -> tar
    Severity: HIGH - Arbitrary file write during extraction
    Fix: Update to [email protected] or later

References

CVE-2026-31802
npm tar package: https://www.npmjs.com/package/tar
CISA KEV: 2026-05-22

Author

@c_y_p_h3r

Legal Disclaimer

For authorized security testing and educational purposes only.

npm-tar-path-traversal-scanner

Most Popular