diff --git a/app/common/PackageUtil.ts b/app/common/PackageUtil.ts
index 1fc36f7c..ae38a538 100644
--- a/app/common/PackageUtil.ts
+++ b/app/common/PackageUtil.ts
@@ -2,7 +2,7 @@ import { createReadStream } from 'node:fs';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import * as ssri from 'ssri';
-import tar from 'tar';
+import tar from '@fengmk2/tar';
 import { AuthorType, PackageJSONType } from '../repository/PackageRepository';
 
 
diff --git a/app/core/service/PackageVersionFileService.ts b/app/core/service/PackageVersionFileService.ts
index edd1be43..5c47fbe5 100644
--- a/app/core/service/PackageVersionFileService.ts
+++ b/app/core/service/PackageVersionFileService.ts
@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import { join, dirname, basename } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import tar from 'tar';
+import tar from '@fengmk2/tar';
 import {
   AccessLevel,
   SingletonProto,
diff --git a/package.json b/package.json
index 170bb153..2e265589 100644
--- a/package.json
+++ b/package.json
@@ -78,6 +78,7 @@
     "@eggjs/tegg-schedule-plugin": "^3.12.0",
     "@eggjs/tsconfig": "^1.0.0",
     "@elastic/elasticsearch": "^8.8.1",
+    "@fengmk2/tar": "^6.2.0",
     "@node-rs/crc32": "^1.2.2",
     "@simplewebauthn/server": "^7.0.1",
     "@sinclair/typebox": "^0.23.0",
@@ -108,7 +109,6 @@
     "s3-cnpmcore": "^1.1.2",
     "semver": "^7.3.5",
     "ssri": "^8.0.1",
-    "tar": "^6.1.13",
     "type-fest": "^2.5.3",
     "ua-parser-js": "^1.0.34",
     "validate-npm-package-name": "^3.0.0"