See the full list of npm packages compromised in the "Keyv / Cacheable Supply Chain Compromise - Aug 2026" [View compromised packages].
tar-stream
tar-stream is a streaming tar parser and generator and nothing else. It operates purely using streams which means you can easily extract/parse tarballs without ever hitting the file system.