diff --git a/npm/private/BUILD.bazel b/npm/private/BUILD.bazel
index 3efc7c60d..13e19da16 100644
--- a/npm/private/BUILD.bazel
+++ b/npm/private/BUILD.bazel
@@ -114,6 +114,7 @@ bzl_library(
     ],
     deps = [
         ":starlark_codegen_utils",
+        ":tar",
         ":utils",
         "@aspect_bazel_lib//lib:repo_utils",
         "@aspect_bazel_lib//lib:repositories",
@@ -139,6 +140,7 @@ bzl_library(
     visibility = ["//npm:__subpackages__"],
     deps = [
         ":starlark_codegen_utils",
+        ":tar",
         ":utils",
         "@aspect_bazel_lib//lib:base64",
         "@bazel_skylib//lib:dicts",
@@ -305,6 +307,13 @@ bzl_library(
     visibility = ["//npm:__subpackages__"],
 )
 
+bzl_library(
+    name = "tar",
+    srcs = ["tar.bzl"],
+    visibility = ["//npm:__subpackages__"],
+    deps = ["@aspect_bazel_lib//lib:repo_utils"],
+)
+
 bzl_library(
     name = "versions",
     srcs = ["versions.bzl"],
diff --git a/npm/private/npm_import.bzl b/npm/private/npm_import.bzl
index 02e432204..85691ad5a 100644
--- a/npm/private/npm_import.bzl
+++ b/npm/private/npm_import.bzl
@@ -449,7 +449,8 @@ def _download_and_extract_archive(rctx, package_json_only):
     # so we use tar here which takes a --strip-components N argument instead of rctx.download_and_extract
     tar_args = ["tar", "-xf", _TARBALL_FILENAME, "--strip-components", "1", "-C", _EXTRACT_TO_DIRNAME, "--no-same-owner", "--no-same-permissions"]
 
-    if rctx.attr.is_gnu_tar == "True" or (rctx.attr.is_gnu_tar == "" and check_is_gnu_tar(rctx)):
+    is_gnu_tar = rctx.attr.is_gnu_tar == "True" or (rctx.attr.is_gnu_tar == "" and check_is_gnu_tar(rctx))
+    if is_gnu_tar:
         # Some packages have directory permissions missing the executable bit, which prevents GNU tar from
         # extracting files into the directory. Delay permission restoration for directories until all files
         # have been extracted.
diff --git a/npm/private/npm_translate_lock_generate.bzl b/npm/private/npm_translate_lock_generate.bzl
index 7f27d1b72..59b63e399 100644
--- a/npm/private/npm_translate_lock_generate.bzl
+++ b/npm/private/npm_translate_lock_generate.bzl
@@ -17,7 +17,7 @@ _NPM_IMPORT_TMPL = \
         package = "{package}",
         version = "{version}",
         url = "{url}",
-        is_gnu_tar = {gnu_tar},
+        is_gnu_tar = "{is_gnu_tar}",
         package_visibility = {package_visibility},{maybe_dev}{maybe_commit}{maybe_generate_bzl_library_targets}{maybe_integrity}{maybe_deps}{maybe_transitive_closure}{maybe_patches}{maybe_patch_args}{maybe_lifecycle_hooks}{maybe_custom_postinstall}{maybe_lifecycle_hooks_env}{maybe_lifecycle_hooks_execution_requirements}{maybe_bins}{maybe_npm_auth}{maybe_npm_auth_basic}{maybe_npm_auth_username}{maybe_npm_auth_password}{maybe_replace_package}{maybe_lifecycle_hooks_use_default_shell_env}
     )
 """
@@ -477,10 +477,10 @@ def _generate_repositories(rctx, npm_imports, pnpm_lock_label, link_workspace):
         repositories_bzl.append("    pass")
         repositories_bzl.append("")
 
-    is_gnu_tar = check_is_gnu_tar(rctx)
+    is_gnu_tar = str(check_is_gnu_tar(rctx))
 
     for _, _import in enumerate(npm_imports):
-        repositories_bzl.append(_gen_npm_import(rctx, is_gnu_tar, is_gnu_tar, link_workspace))
+        repositories_bzl.append(_gen_npm_import(rctx, is_gnu_tar, _import, link_workspace))
 
     return repositories_bzl
 
diff --git a/npm/private/tar.bzl b/npm/private/tar.bzl
index dd8bd19b5..63a1886dd 100644
--- a/npm/private/tar.bzl
+++ b/npm/private/tar.bzl
@@ -1,7 +1,10 @@
+"""Tar helpers."""
+
 load("@aspect_bazel_lib//lib:repo_utils.bzl", "repo_utils")
 
+# TODO: use a hermetic tar from aspect_bazel_lib and remove this.
 def check_is_gnu_tar(rctx):
-    """# TODO: use a hermetic tar from aspect_bazel_lib and we can drop the "if _is_gnu_tar" branch
+    """Check if the host tar command is GNU tar.
 
     Args:
       rctx: the repository context