Can not create new react-app

macOS 10.14.6 npm version = 8.1.2 node version = 16.13.0 (I also tried 14.4.0, same error)

Output:

TheMATRIX@~/development/weiterbildung] npx create-react-app course

Creating a new React app in /Users/xx/development/weiterbildung/course.

Installing packages. This might take a couple of minutes.
Installing react, react-dom, and react-scripts with cra-template...

npm ERR! code 1
npm ERR! path /Users/xx/development/weiterbildung/course/node_modules/coa
npm ERR! command failed
npm ERR! command sh -c start /B node compile.js & node compile.js
npm ERR! sh: start: command not found
npm ERR! node:internal/modules/cjs/loader:936
npm ERR!   throw err;
npm ERR!   ^
npm ERR! 
npm ERR! Error: Cannot find module '/Users/xx/development/weiterbildung/course/node_modules/coa/compile.js'
npm ERR!     at Function.Module._resolveFilename (node:internal/modules/cjs/loader:933:15)
npm ERR!     at Function.Module._load (node:internal/modules/cjs/loader:778:27)
npm ERR!     at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)
npm ERR!     at node:internal/main/run_main_module:17:47 {
npm ERR!   code: 'MODULE_NOT_FOUND',
npm ERR!   requireStack: []
npm ERR! }

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/xx/.npm/_logs/2021-11-04T13_29_00_745Z-debug.log

Aborting installation.
  npm install --save --save-exact --loglevel error react react-dom react-scripts cra-template has failed.

Deleting generated file... package.json
Deleting course/ from /Users/xx/development/weiterbildung
Done.

And in the log file I see this (this time with v14.4.0):

9093 timing metavuln:cache:get:security-advisory:react-scripts:keJAYB+uyINLquff35kjTPcDcqM/6q1f6JaX5X0B1VLAqG1G4VcktJdrLGGYRCLiprEWg8/ljNSvoQBwHuHBhA== Completed in 32ms
9094 timing metavuln:load:security-advisory:react-scripts:gGYnIdLwfnZNHzqU5AFeRedEuk0JD0hpw2rMpR8KZDvMhUnKXM9KinfcLchu1IZtqWFcuE3jhbXtLpuIQVkn1A== Completed in 0ms
9095 timing metavuln:calculate:security-advisory:react-scripts:gGYnIdLwfnZNHzqU5AFeRedEuk0JD0hpw2rMpR8KZDvMhUnKXM9KinfcLchu1IZtqWFcuE3jhbXtLpuIQVkn1A== Completed in 33ms
9096 timing auditReport:init Completed in 12297ms
9097 timing reify:audit Completed in 17404ms
9098 timing reifyNode:node_modules/@typescript-eslint/scope-manager Completed in 17129ms
9099 timing reifyNode:node_modules/table/node_modules/ajv Completed in 17601ms
9100 timing reifyNode:node_modules/@typescript-eslint/eslint-plugin Completed in 17776ms
9101 timing reifyNode:node_modules/eslint Completed in 17825ms
9102 timing reifyNode:node_modules/jsdom Completed in 18291ms
9103 timing reifyNode:node_modules/caniuse-lite Completed in 18530ms
9104 timing reifyNode:node_modules/es5-ext Completed in 19036ms
9105 timing reifyNode:node_modules/lodash Completed in 19212ms
9106 timing reifyNode:node_modules/es-abstract Completed in 19439ms
9107 warn deprecated core-js@2.6.12: core-js@<3.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
9108 timing reifyNode:node_modules/babel-runtime/node_modules/core-js Completed in 20518ms
9109 timing reifyNode:node_modules/core-js-pure Completed in 20649ms
9110 timing reifyNode:node_modules/core-js Completed in 20772ms
9111 timing reifyNode:node_modules/typescript Completed in 20934ms
9112 timing reify:unpack Completed in 21228ms
9113 timing reify:unretire Completed in 2ms
9114 timing build:queue Completed in 50ms
9115 info run coa@2.1.3 preinstall node_modules/coa start /B node compile.js & node compile.js
9116 info run coa@2.1.3 preinstall { code: 1, signal: null }
9117 timing reify:rollback:createSparse Completed in 7110ms
9118 timing reify:rollback:retireShallow Completed in 0ms
9119 timing command:install Completed in 42646ms
9120 verbose stack Error: command failed
9120 verbose stack     at ChildProcess.<anonymous> (/Users/baszero/.nvm/versions/node/v14.4.0/lib/node_modules/npm/node_modules/@npmcli/promise-spawn/index.js:64:27)
9120 verbose stack     at ChildProcess.emit (events.js:315:20)
9120 verbose stack     at maybeClose (internal/child_process.js:1051:16)
9120 verbose stack     at Socket.<anonymous> (internal/child_process.js:442:11)
9120 verbose stack     at Socket.emit (events.js:315:20)
9120 verbose stack     at Pipe.<anonymous> (net.js:670:12)
9121 verbose pkgid coa@2.1.3
9122 verbose cwd /Users/baszero/development/weiterbildung/course
9123 verbose Darwin 18.7.0
9124 verbose argv "/Users/baszero/.nvm/versions/node/v14.4.0/bin/node" "/Users/baszero/.nvm/versions/node/v14.4.0/bin/npm" "install" "--save" "--save-exact" "--loglevel" "error" "react" "react-dom" "react-scripts" "cra-template"
9125 verbose node v14.4.0
9126 verbose npm  v7.23.0
9127 error code 1
9128 error path /Users/baszero/development/weiterbildung/course/node_modules/coa
9129 error command failed
9130 error command sh -c start /B node compile.js & node compile.js
9131 error sh: start: command not found
9131 error internal/modules/cjs/loader.js:1032
9131 error   throw err;
9131 error   ^
9131 error
9131 error Error: Cannot find module '/Users/baszero/development/weiterbildung/course/node_modules/coa/compile.js'
9131 error     at Function.Module._resolveFilename (internal/modules/cjs/loader.js:1029:15)
9131 error     at Function.Module._load (internal/modules/cjs/loader.js:898:27)
9131 error     at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:71:12)
9131 error     at internal/main/run_main_module.js:17:47 {
9131 error   code: 'MODULE_NOT_FOUND',
9131 error   requireStack: []
9131 error }
9132 verbose exit 1

[baszero]

I have added this to my package.json and it now works! Obviously the malicious COA version has also been removed by the NPM team now… maybe it works anyways again now.

"scripts": {
  "preinstall": "npx npm-force-resolutions",
  "postinstall": "npx patch-package"
},
"resolutions": {
  "coa": "2.0.2"
}

By adding this, it forces the whole build to use version 2.0.2, regardless the config of the create-react-app

[socheatsok78]

coa has been mark as security compromised.

See https://github.com/veged/coa/issues/99