Steps to download and install node in ubuntu

Step 1: Download latest or recommended node .tar.xz file from https://nodejs.org/en/

or you can download node version 14.15.5 (.tar.xz file) directly from here ->

https://nodejs.org/dist/v14.15.5/node-v14.15.5-linux-x64.tar.xz

Step 2: Go to the directory in which (.tar.xz file) is downloaded.

In my case --> /Download directory

Step 3: Update System Repositories

sudo apt update

Step 4: Install the package xz-utils

sudo apt install xz-utils

Step 5: To Extract the .tar.xz file

sudo tar -xvf name_of_file

In my case --> sudo tar -xvf node-v14.15.5-linux-x64.tar.xz

Step 6: sudo cp -r directory_name/{bin,include,lib,share} /usr/

In my case --> sudo cp -r node-v14.15.5-linux-x64/{bin,include,lib,share} /usr/

Step 7: Check the node version

node --version

Result In my case -> v14.15.5

Answer from Azam Baig on Stack Overflow
🌐
npm
npmjs.com › package › tar
tar - npm
March 23, 2026 - tar for node. Latest version: 7.5.13, last published: a month ago. Start using tar in your project by running `npm i tar`. There are 6428 other projects in the npm registry using tar.
      » npm install tar
    
Published   Mar 23, 2026
Version   7.5.13
🌐
GitHub
github.com › isaacs › node-tar › blob › main › CHANGELOG.md
node-tar/CHANGELOG.md at main · isaacs/node-tar
Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node. ... Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
Author   isaacs
Discussions

node.js - How to install node.tar.xz file in linux - Stack Overflow
I recently downloaded the Nodejs file from the official site and I don't know how to install the Nodejs from a archived file. Please help me how can I install this file so that I can run the "... More on stackoverflow.com
🌐 stackoverflow.com
tar - How to untar file in node.js - Stack Overflow
Performing a CPU intensive task in the event loop is not what node was designed for, it is what tar was designed for. More on stackoverflow.com
🌐 stackoverflow.com
How to extract tar file to memory and fire event upon extraction of all files?
https.get(url, res => { How does one https.get call fetch multiple files? More on reddit.com
🌐 r/node
6
4
August 31, 2022
How to exclude directories from tar - it keeps ignoring the ones I tell it to exclude
The --exclude patterns must be defined before the target path. Simple TAR Backup example, With zstd compression More on reddit.com
🌐 r/linuxquestions
5
2
December 31, 2021
🌐
Tenable
tenable.com › plugins › nessus › 192685
Node.js Module node-tar < 6.2.1 DoS<!-- --> | Tenable®
March 29, 2024 - A module in the Node.js JavaScript run-time environment is affected by a denial of service vulnerability. (Nessus Plugin ID 192685)
🌐
Node.js
nodejs.org › dist › latest
Index of /dist/latest/
../ docs/ - - win-arm64/ - - win-x64/ - - SHASUMS256.txt.asc 01-Apr-2026 14:45 3.2 KB SHASUMS256.txt.sig 01-Apr-2026 14:45 119 B SHASUMS256.txt 01-Apr-2026 14:44 2.9 KB node-v25.9.0-aix-ppc64.tar.gz 01-Apr-2026 14:44 77 MB node-v25.9.0-arm64.msi 01-Apr-2026 14:44 30 MB node-v25.9.0-darwin-arm64.tar.gz 01-Apr-2026 14:44 54 MB node-v25.9.0-darwin-arm64.tar.xz 01-Apr-2026 14:44 28 MB node-v25.9.0-darwin-x64.tar.gz 01-Apr-2026 14:44 55 MB node-v25.9.0-darwin-x64.tar.xz 01-Apr-2026 14:44 30 MB node-v25.9.0-headers.tar.gz 01-Apr-2026 14:44 10.0 MB node-v25.9.0-headers.tar.xz 01-Apr-2026 14:44 580 KB
Find elsewhere
🌐
Reddit
reddit.com › r/cybersecurity › vulnerability | node.js module node-tar
r/cybersecurity on Reddit: Vulnerability | Node.js Module node-tar < 6.2.1 DoS
September 3, 2024 - I came across this vulnerability Node.js Module node-tar < 6.2.1 DoS. I have updated the Node JS to the latest version.
🌐
Foresiet
foresiet.com › home › cve-2026-23745: a deep dive into the node-tar arbitrary file overwrite vulnerability
CVE-2026-23745: Fix node-tar Arbitrary File Overwrite Vulnerability
January 19, 2026 - CVE-2026-23745 is a high-severity path traversal flaw in node-tar (the tar library for Node.js). Versions ≤7.5.2 fail to sanitize linkpath in hardlink and symlink entries when preservePaths is false (default secure mode). Malicious tar archives bypass extraction root restrictions, enabling arbitrary file overwrite via hardlinks and symlink poisoning via absolute targets.
Top answer
1 of 2
24

The tarball directory structure is like this:

$ tar tf node-v6.10.1-linux-x64.tar.xz | head
node-v6.10.1-linux-x64/
node-v6.10.1-linux-x64/bin/
node-v6.10.1-linux-x64/bin/npm
node-v6.10.1-linux-x64/bin/node
node-v6.10.1-linux-x64/share/
node-v6.10.1-linux-x64/share/man/
node-v6.10.1-linux-x64/share/man/man1/
node-v6.10.1-linux-x64/share/man/man1/node.1
node-v6.10.1-linux-x64/share/systemtap/
node-v6.10.1-linux-x64/share/systemtap/tapset/

When you extract this archive without any other options in /usr/local, you get this:

/usr/local/node-v6.10.1-linux-x64/
/usr/local/node-v6.10.1-linux-x64/bin/
/usr/local/node-v6.10.1-linux-x64/bin/npm
/usr/local/node-v6.10.1-linux-x64/bin/node
/usr/local/node-v6.10.1-linux-x64/share/
/usr/local/node-v6.10.1-linux-x64/share/man/
/usr/local/node-v6.10.1-linux-x64/share/man/man1/
/usr/local/node-v6.10.1-linux-x64/share/man/man1/node.1
/usr/local/node-v6.10.1-linux-x64/share/systemtap/
/usr/local/node-v6.10.1-linux-x64/share/systemtap/tapset/

So, a new directory is created in /usr/local, and the files get dumped there.

However, with --strip-components=1, one directory component from the extracted path is removed, so node-v6.10.1-linux-x64/bin/ becomes bin/ and node-v6.10.1-linux-x64/bin/npm becomes bin/npm:

/usr/local/
/usr/local/bin/
/usr/local/bin/npm
/usr/local/bin/node
/usr/local/share/
/usr/local/share/man/
/usr/local/share/man/man1/
/usr/local/share/man/man1/node.1
/usr/local/share/systemtap/
/usr/local/share/systemtap/tapset/

And /usr/local/bin is already in PATH, so you don't need to do anything else to execute npm and node.

2 of 2
14

This is sort of a cool (yet annoying) way of installing NodeJS.

If you run tar tf /usr/save/node-v4.2.1-linux-x64.tar.gz on the file, you'll see something like this:

node-v4.2.1-linux-x64/
node-v4.2.1-linux-x64/bin/
node-v4.2.1-linux-x64/bin/npm
node-v4.2.1-linux-x64/bin/node
node-v4.2.1-linux-x64/share/
node-v4.2.1-linux-x64/share/man/
node-v4.2.1-linux-x64/share/man/man1/

Basically, this means that when you extract this tar archive, it'll extract to a folder called node-v4.2.1-linux-x64 with all of these subfolders (and the node installation) inside of it. In fact, you can even try this extraction to get a better idea:

mkdir /tmp/node
cd /tmp/node
tar xvf /usr/save/node-v4.2.1-linux-x64.tar.gz

If you run ls, you'll see a node-v4.2.1-linux-x64 folder.

Now, --strip-components 1 does something interesting to the extraction process. From man tar:

 --strip-components=NUMBER
       strip NUMBER leading components from file names on extraction

Basically, this means that when tar is going to extract your archive, it's going to pretend like the node-v4.2.1-linux-x64 folder isn't there. Instead, it's going to extract bin/, share/ and all the other folders directly.

In fact, you can try it:

mkdir /tmp/node
cd /tmp/node
tar xvf /usr/save/node-v4.2.1-linux-x64.tar.gz --strip-components=1

If you run ls, you'll see there's no longer a node-v4.2.1-linux-x64 folder. It's just bin/, include/, lib/, and share/ (all coincidentally folders in /usr/local/).

Your second command wouldn't have worked because it would have just extracted the node-v4.2.1-linux-x64 folder to /usr/local (if it even ran at all). If you run ls /usr/local, you might even see this folder hanging around. It's useless, feel free to delete with rm. As for why it's useless, keep reading...


Now that we've explained how the tar command works, we can explain how this gets installed.

Every Linux system has something called the $PATH variable, which determines where executable files are stored. Among these places is /usr/local/bin. When you extract that binary inside /usr/local (which I'm confident is what your install instructions say), the NodeJS binary is being written to /usr/local/bin/node as per how extractions are done. Similarly, all the libraries are being added to the local library folder and everything pretty much just goes where it belongs.

Now, the caveat (and why this is annoying) is that apt won't see or understand or realize what's going on. You won't be able to update it through sudo apt upgrade or similar. You'd need to manually go in and clean the old NodeJS install and then put in the new one in case you ever want to upgrade.

I would recommend you just run sudo apt install nodejs-legacy instead. Less pain, and it automatically updates for you.

🌐
GitHub
github.com › isaacs › node-tar
GitHub - isaacs/node-tar: tar for node · GitHub
tar for node. Contribute to isaacs/node-tar development by creating an account on GitHub.
Starred by 911 users
Forked by 255 users
Languages   JavaScript 55.3% | TypeScript 44.6% | Shell 0.1%
🌐
npm
npmjs.com › package › node-tar
node-tar - npm
Latest version: 1.0.0, last published: 3 years ago. Start using node-tar in your project by running `npm i node-tar`. There are 5 other projects in the npm registry using node-tar.
      » npm install node-tar
    
Published   Nov 08, 2022
Version   1.0.0
🌐
npm
npmjs.com › search
tar - npm search
Zero dependency streaming tar parser and writer for JavaScript.
🌐
Debian
tracker.debian.org › pkg › node-tar
node-tar - Debian Package Tracker
CVE-2024-28863: (needs triaging) node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process.
🌐
Debian
packages.debian.org › source › oldstable › node-tar
Debian -- Details of source package node-tar in bookworm
read and write portable tar archives module for Node.js · adep: debhelper-compat (= 13) Package not available · adep: dh-sequence-nodejs · Package not available · adep: dh-nodejs · debhelper addon to build Node.js modules · adep: node-chownr · like chown -R ·
🌐
Node.js
nodejs.org › en › blog › release › v24.13.0
Node.js — Node.js 24.13.0 (LTS)
Windows 64-bit Installer: https://nodejs.org/dist/v24.13.0/node-v24.13.0-x64.msi Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.13.0/node-v24.13.0-arm64.msi Windows 64-bit Binary: https://nodejs.org/dist/v24.13.0/win-x64/node.exe Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.13.0/win-arm64/node.exe macOS 64-bit Installer: https://nodejs.org/dist/v24.13.0/node-v24.13.0.pkg macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.13.0/node-v24.13.0-darwin-arm64.tar.gz macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.13.0/node-v24.13.0-darwin-x64.tar.gz Linux 64-bi
🌐
Ubuntu
launchpad.net › ubuntu › +source › node-tar
node-tar package : Ubuntu
The following unsupported and untrusted Personal Archives (PPAs) provide packages of 'node-tar':
🌐
Node.js
nodejs.org › en › blog › release › v6.2.1
Node.js — Node.js 6.2.1 (Current)
Windows 32-bit Installer: https://nodejs.org/dist/v6.2.1/node-v6.2.1-x86.msi Windows 64-bit Installer: https://nodejs.org/dist/v6.2.1/node-v6.2.1-x64.msi Windows 32-bit Binary: https://nodejs.org/dist/v6.2.1/win-x86/node.exe Windows 64-bit Binary: https://nodejs.org/dist/v6.2.1/win-x64/node.exe Mac OS X 64-bit Installer: https://nodejs.org/dist/v6.2.1/node-v6.2.1.pkg Mac OS X 64-bit Binary: https://nodejs.org/dist/v6.2.1/node-v6.2.1-darwin-x64.tar.gz Linux 32-bit Binary: https://nodejs.org/dist/v6.2.1/node-v6.2.1-linux-x86.tar.xz Linux 64-bit Binary: https://nodejs.org/dist/v6.2.1/node-v6.2.1-