Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

node-ipc package includes peacenotwar as a dependency

See original GitHub issue

Version

5.0.3

Environment info

N/A

Steps to reproduce

Starting a new project from Vue CLI. When the project is run, the file “WITH-LOVE-FROM-AMERICA.txt” appears on the desktop.

What is expected?

No nasty surprises.

What is actually happening?

“WITH-LOVE-FROM-AMERICA.txt” appears on the desktop.

There are a lot of complaints under the node-ipc issue page: https://github.com/RIAEvangelist/node-ipc/issues

I discovered this by finding “WITH-LOVE-FROM-AMERICA.txt” on my desktop.

Issue Analytics

State:
Created 2 years ago
Reactions:2
Comments:6

Top GitHub Comments

5reactions

EJTHcommented, Mar 18, 2022

How can vue-cli be trusted after this? I wouldn’t touch any package downstream to node-ipc with a ten foot pole! As responsible developers you should replace node-ipc with an alternative package. It is only a matter of time before a country does something that the dev does not agree with, and decides to purge all user files from arbitrary countries.

Either vue.js changes this dependency, or I change out vue everywhere.

0reactions

lorand-horvathcommented, Mar 21, 2022

@rlidwka Well, node-ipc 9.2.1 itself is fine, but we cannot say the same about its transient dependencies, please see https://github.com/vuejs/vue-cli/issues/7051#issuecomment-1072279354 and further comments there.