vue-CLI outputting very concerning error (security question)

问题

I'm building an application with Vue.js. Suddenly, vue-cli has begun outputting errors that have me concerned that perhaps one or more of my dependencies has something nefarious in it.

When I run npm run serve (vue-cli serve), the command succeeds, but outputs several lines of error messages like the following:

(node:366423) UnhandledPromiseRejectionWarning: Error: ENOENT: no such file or directory, stat '/initrd.img'

It also fails to stat /home/jordan/.steampath, /initrd.img.old, /vmlinuz, and /vmlinuz.old.

It also sometimes outputs these lines when hot-reloading.

I'm concerned because it seems there should be ZERO reason for it to even try to stat kernel files or my steampath. It seems to be looking at things it shouldn't need to (but is apparently being prevented from doing so).

Should I be concerned about security? Is this evidence that I'm using a vue or NPM plugin with nefarious code in it? Or is this a simple misconfiguration somewhere?

Here's my package.json:

{
  "name": "pp10-client",
  "version": "0.1.0",
  "private": true,
  "scripts": {
    "serve": "vue-cli-service serve",
    "build": "vue-cli-service build",
    "lint": "vue-cli-service lint"
  },
  "dependencies": {
    "@sentry/browser": "^5.15.5",
    "@sentry/integrations": "^5.15.5",
    "@tinymce/tinymce-vue": "^2.1.0",
    "apexcharts": "^3.19.2",
    "axios": "^0.19.2",
    "blueimp-md5": "^2.16.0",
    "core-js": "^2.6.11",
    "filepond": "^4.13.6",
    "moment": "^2.26.0",
    "npm-cache": "^0.7.0",
    "pdfjs": "^2.3.7",
    "pdfjs-dist": "^2.3.200",
    "save": "^2.4.0",
    "sortablejs": "^1.10.2",
    "tinymce": "^5.3.0",
    "underscore": "^1.10.2",
    "v-calendar": "^1.0.8",
    "v-tooltip": "^2.0.2",
    "vue": "^2.6.11",
    "vue-apexcharts": "^1.5.3",
    "vue-color": "^2.7.1",
    "vue-filepond": "^5.1.3",
    "vue-js-modal": "^1.3.35",
    "vue-js-toggle-button": "^1.3.3",
    "vue-phone-number-input": "^1.1.9",
    "vue-router": "^3.2.0",
    "vue-stepper-component": "^1.0.0",
    "vue-tour": "^1.3.1",
    "vue-worker": "^1.2.1",
    "vuedraggable": "^2.23.2",
    "vuex": "^3.4.0"
  },
  "devDependencies": {
    "@vue/cli-plugin-babel": "^3.12.1",
    "@vue/cli-plugin-eslint": "^3.12.1",
    "@vue/cli-service": "^3.12.1",
    "babel-eslint": "^10.1.0",
    "eslint": "^5.16.0",
    "eslint-plugin-vue": "^5.2.3",
    "pug": "^2.0.4",
    "pug-plain-loader": "^1.0.0",
    "sass": "^1.26.5",
    "sass-loader": "^7.3.1",
    "stylus": "^0.54.7",
    "stylus-loader": "^3.0.2",
    "vue-template-compiler": "^2.6.11"
  }
}

EDIT: Solution:

Removed nodejs and npm, deleted all associated folders, and reinstalled nodejs and npm by using nvm (node version manager). I chose the current version of node (14 as of this writing).
Removed node_modules and package-lock.json within the project.
Ran npm install (in project folder)
Installed vue-cli globally: npm install -g @vue/cli
When builds failed, followed prompts to install missing dependencies.
FINALLY it worked.

回答1:

facing the same issue with nuxt.js, audit does not mention anything regarding this. Howto find the npm module? String steam is not present, likely obfuscated as bytearray or else

回答2:

On Ubuntu 20.04, upgrading to node 12.18.3 and running npm rebuild node-sass solved the problem for me.

回答3:

Make sure you use the latest dependencies in your package.json (manually check on npmjs.com or your npm registry)

Delete the entire node modules dir and package-lock.json, and then running npm install helped me.

来源：https://stackoverflow.com/questions/63165044/vue-cli-outputting-very-concerning-error-security-question

标签

Vue.js

security

npm

vue-cli