[VULNERABILITY/BREAKS] Impossible to build on CI / Possible vulnerability

Description

It seems that there’s a story about the colors npm package recently, which led to the author’s npm account suspension. Npm reverted to safe versions but RN is using one that does not exist anymore, throwing a 404… React Native depending on it, it makes me impossible to build my app with AppCenter

error An unexpected error occurred: "https://registry.yarnpkg.com/colors/-/colors-1.4.2.tgz: Request failed \"404 Not Found\"".
info If you think this is a bug, please open a bug report with the information provided in "/Users/runner/work/1/s/yarn-error.log".
info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.
##[error]/bin/sh failed with return code: 1
##[error]/bin/sh failed with error: /bin/sh failed with return code: 1

yarn why

=> Found "colors@1.4.2"
info Reasons this module exists
   - "react-native#react-native-codegen#jscodeshift" depends on it
   - Hoisted from "react-native#react-native-codegen#jscodeshift#colors"
info Disk size without dependencies: "120KB"
info Disk size with unique dependencies: "120KB"
info Disk size with transitive dependencies: "120KB"
info Number of shared dependencies: 0

Version

0.66.4

Output of npx react-native info

ystem: OS: macOS 12.0.1 CPU: (8) arm64 Apple M1 Memory: 155.75 MB / 16.00 GB Shell: 5.8 - /bin/zsh Binaries: Node: 16.13.1 - ~/.nvm/versions/node/v16.13.1/bin/node Yarn: 1.22.17 - ~/.nvm/versions/node/v16.13.1/bin/yarn npm: 8.1.2 - ~/.nvm/versions/node/v16.13.1/bin/npm Watchman: 2021.11.15.00 - /usr/local/bin/watchman Managers: CocoaPods: 1.11.2 - /usr/local/var/rbenv/shims/pod SDKs: iOS SDK: Platforms: DriverKit 21.2, iOS 15.2, macOS 12.1, tvOS 15.2, watchOS 8.3 Android SDK: API Levels: 23, 28, 29, 30, 31 Build Tools: 28.0.3, 29.0.2, 30.0.0, 30.0.2 System Images: android-30 | AOSP ATD ARM 64 v8a, android-30 | ARM 64 v8a, android-30 | Google APIs Intel x86 Atom, android-30 | Google Play Intel x86 Atom, android-30 | Google APIs ATD ARM 64 v8a, android-31 | ARM 64 v8a, android-31 | Google Play ARM 64 v8a Android NDK: Not Found IDEs: Android Studio: 2020.3 AI-203.7717.56.2031.7784292 Xcode: 13.2.1/13C100 - /usr/bin/xcodebuild Languages: Java: 1.8.0_292 - /usr/bin/javac npmPackages: @react-native-community/cli: Not Found react: 17.0.2 => 17.0.2 react-native: 0.66.4 => 0.66.4 react-native-macos: Not Found npmGlobalPackages:

Steps to reproduce

Install a stock react-native project, Setup AppCenter, Build.

Snack, code example, screenshot, or link to a repository

[waldenermonteiro]

I solved it by removing node modules and yarn.lock, and running yarn again. It will use version 1.4.0 of colors

[cortinico]

Fixed in https://github.com/facebook/react-native/commit/c279a186fa610c99a0b7dd8de43ec1752c2ab9fc via https://github.com/facebook/react-native/pull/32905