Threat detected: Coinminer.JS.MALb (flatmap-stream)

Current behavior:

Unable to extract cypress because a dependency (flatmap-stream) is compromised.

Desired behavior:

To be able to extract cypress without errors from an AV software.

Steps to reproduce:

Pre-requisites: have an anti-virus software (TrendMicro in my case)

1. Download the archive from the endpoint supplied below
2. Extract the contents
3. Extraction process is halted because a threat is detected.

Problematic file:

.\Cypress\resources\app\packages\server\node_modules\flatmap-stream\test\data.js

flatmap-stream has been removed from npm

Versions

Latest version, downloaded from https://cdn.cypress.io/desktop/3.1.2/win64/cypress.zip

Further information

Looking at the package-lock.json in .\Cypress\resources\app\packages\server\, it seems like flatmap-stream is being pulled, indirectly, by nodemon

• nodemon@1.18.6 (seems like the issue’s been fixed)
  • pstree.remy@1.1.0
    • ps-tree@1.1.0
      • event-stream@3.3.0
        • flatmap-stream@0.1.0

[chrisbreiding]

Can’t promise a date, but if not today, then certainly sometime this week.

We’re still looking into why a dev dependency made it into the production binary, as that should not happen. Seems that it only happens with the windows binary ~and it’s only nodemon, no other dev dependencies.~ On second look, it appears to have all the dev dependencies, at least from packages/server.

[jpmnteiro]

Interesting, nodemon is also a dev dependency on the server.

Why would the production package on the CDN contain the development dependencies?