From 063322ed0d7b20a8064c7dbe6604fee9b96a39f1 Mon Sep 17 00:00:00 2001
From: Jake Bailey <5341706+jakebailey@users.noreply.github.com>
Date: Fri, 8 May 2026 11:56:56 -0700
Subject: [PATCH] Ensure node_modules is excluded in createTgz

---
 .changeset/exclude-node-modules-from-tgz.md |  5 +++++
 packages/utils/src/io.ts                    | 15 +++++++++------
 2 files changed, 14 insertions(+), 6 deletions(-)
 create mode 100644 .changeset/exclude-node-modules-from-tgz.md

diff --git a/.changeset/exclude-node-modules-from-tgz.md b/.changeset/exclude-node-modules-from-tgz.md
new file mode 100644
index 0000000000..716e00a233
--- /dev/null
+++ b/.changeset/exclude-node-modules-from-tgz.md
@@ -0,0 +1,5 @@
+---
+"@definitelytyped/utils": patch
+---
+
+Exclude node_modules from tarballs created by createTgz.
diff --git a/packages/utils/src/io.ts b/packages/utils/src/io.ts
index 04c8af3d9b..0574ae5981 100644
--- a/packages/utils/src/io.ts
+++ b/packages/utils/src/io.ts
@@ -272,7 +272,7 @@ function createTar(dir: string, onError: (error: any) => void): NodeJS.ReadableS
   const dirSegments = resolve(dir).split(sep);
   const parentDir = dirSegments.slice(0, dirSegments.length - 1).join(sep);
   const entryToAdd = dirSegments[dirSegments.length - 1];
-  const packer = new Pack({ cwd: parentDir, filter: addDirectoryExecutablePermission });
+  const packer = new Pack({ cwd: parentDir, filter: tarFilter });
   packer.on("error", onError);
   const stream = packer.add(entryToAdd);
   packer.end();
@@ -280,14 +280,17 @@ function createTar(dir: string, onError: (error: any) => void): NodeJS.ReadableS
   return stream as unknown as NodeJS.ReadableStream;
 }
 
-/**
- * Work around a bug where directories bundled on Windows do not have executable permission when extracted on Linux.
- * https://github.com/npm/node-tar/issues/7#issuecomment-17572926
- */
-function addDirectoryExecutablePermission(_: string, stat: ReadEntry | fs.Stats): boolean {
+const nodeModulesPattern = /(?:^|[\\/])node_modules(?:[\\/]|$)/;
+
+function tarFilter(path: string, stat: ReadEntry | fs.Stats): boolean {
   if (stat instanceof ReadEntry) {
     return true; // never happens?
   }
+  if (nodeModulesPattern.test(path)) {
+    return false;
+  }
+  // Work around a bug where directories bundled on Windows do not have executable permission when extracted on Linux.
+  // https://github.com/npm/node-tar/issues/7#issuecomment-17572926
   if (stat.isDirectory()) {
     stat.mode = addExecutePermissionsFromReadPermissions(stat.mode);
   }