Error installing vue-cli due to security issue with dependency

[dlouwers]

Version

3.1.1

Reproduction link

https://cli.vuejs.org/guide/installation.html

Node and OS info

yarn 1.10.1, Windows 10

Steps to reproduce

Simply run yarn global add @vue/cli

What is expected?

Successful installation

What is actually happening?

Fatal error occurs:
error No valid versions found for "flatmap-stream". The package may be unpublished.

---

None

[xsaamiir]

I have the exact same error different environment.

Node and OS info
NPM 6.4.1, MacOS 10.14.1

[preetom]

Same error
node version 10.13.0 windows 10
yarn v1.12.3

[arism]

Same here
Node v11.2.0 Npm v6.4.1
Node v10.13.0 Npm v6.4.1

[danielbprice]

This is due to flatmap-stream being unpublished because it was the source of malware. The whole sordid story is here: dominictarr/event-stream#116

vue-cli maintainers: I think (I am not an expert) you need to ensure that vue-cli doesn't drag in the malware.

[danielbprice]

vue-cli users, I fixed this in my project by fixing the version of event-stream as follows:

package.json:
    "event-stream": "=3.3.4",

(please do your own evaluation before blindly following this advice).

Then you can check that you don't have flatmap-stream anymore with

$ npm ls event-stream flatmap-stream

[danielbprice]

@dlouwers can you retitle this issue to indicate that it is a security problem?

[haoqunjiang]

Should have been fixed now.

[haoqunjiang]

FYI there're 3 dependencies in @vue/cli-ui affected by this issue, 2 of which (nodemon, start-server-and-test) were not used in the published package.
The only affected one was the terminate package used to terminate a running task. Now it has been fixed by ps-tree@1.1.1. indexzero/ps-tree#34

We will investigate strategies to avoid recurrence of such issues.

[vladkras]

Should have been fixed now.

how?

[unionthugface]

I was not aware of this problem until my antivirus just now told me that it found a Trojan malware script inside this package . . . it was in my npm cache for Vue CLI! I would alert anybody who previously installed Vue CLI to update to latest immediately, and purge all old files.

[ezra126]

i got this error while installing @vue/cli
npm ERR! Unexpected end of JSON input while parsing near '...endencies":{"async":"'

npm ERR! A complete log of this run can be found in:
npm ERR! C:\Users\Ezra\AppData\Roaming\npm-cache_logs\2019-09-26T12_57_54_328Z-debug.log