Potential security threat detected in build errors in a fresh create-react-app install (script accessing "/initrd.img", "/vmlinuz" and others)

user_1804006 0
Viewed 6461

After I have created a new app with create-react-app or Razzle, error messages appear at build time which are quite concerning, security wise:

[Error: ENOENT: no such file or directory, stat '/initrd.img'] {
  errno: -2,
  code: 'ENOENT',
  syscall: 'stat',
  path: '/initrd.img'
}

Sometimes, a few other messages appear, with "/vmlinuz" "/initrd.img.old", "/vmlinuz.old" and ".steampath" instead.

Theses messages appear any time there's a build error (any build error that I generate).

This is basically the same problem as described in vue-CLI outputting very concerning error (security question) (but I was told to ask a new question). There were testimonies of three people having the same error messages in that thread.

I don't think there would be any valid reason for a React build script to stat the Linux kernel and a Steam directory, so there might be a malicious package at play here.

This only happens with npm, not yarn. (If your app has been created by CRA with yarn, you should do rm -rf node_modules && rm -rf yarn.lock && npm install);

The most minimal setup I could achieve while trying to isolate the culprits was:

  • creating a brand new app with create-react-app with npx create-react-app app1
  • and then generating an arbitrary build error in index.js, adding something like: import "nonexistent";

When I do that, I see the stat '/initrd.img'error mentioned above.

I'd like to know if you don't see the errors after executing the same exact steps. That would probably mean that it doesn't come from the packages installed but from elsewhere in my system.

It cannot come from my Node.js setup though, because I deleted my $HOME/.nvm, $HOME/.npm $HOME/node_modules, $HOME/.yarn and $HOME/.config/yarn before redoing the steps below.

There aren't many similar testimonials about this on the web, apparently. A bit more with "/.steampath" though.

I reported the issue to security@npmjs.com. They haven't replied yet.

If there is indeed a malicious script in the dependency tree of react-create-app (and Razzle), it should be investigated urgently.

Environment:

  • Node 14.14 installed with nvm 0.36.0
  • npm 6.14.8
  • create-react-app 3.4.1
  • Kubuntu 20.04

EDIT: I've also posted an issue at https://github.com/facebook/create-react-app/issues/9855. I thought this was serious and urgent enough that CRA maintainers should be notified now.

create-react-app reactjs security
10 Answers

I got the same error and struggled with it for 2 days. Everything was running well on my Mac but as soon as I cloned the GitHub repository and tried to run my react app on the Linux system as well as AWS-Amplify and it showed me this same error:

[Error: ENOENT: no such file or directory, stat '/initrd.img'].

But after checking the build error logs I found that it was the problem with an import from react-bootstrap. The problem was 'the case' of the component I was importing. In my case I was importing bootstrap Container and used container instead of Container. I simply corrected that and everything was resolved.

In my case: WRONG: import Container from 'react-bootstrap/container' RIGHT: import Container from 'react-bootstrap/Container'.

My Tip: Trivial mistakes like this can also give you this error. Check for incorrect imports and see the documentation for the libraries to check the cases.

In case your application is small and you have not gone too far with the development, then you can create a new react application and copy the component files one by one and run them to see which component is actually creating the problem. This is not the best idea but it worked for me the first time I got this error.

PS: Thank you for reading. This is my first answer on Stack Overflow. YAY!

user_88474660

There seems to be a simple answer: these messages could just come from Node searching for node_modules in the project parent directories all the way to the filesystem root. (See https://nodejs.org/api/modules.html#modules_loading_from_node_modules_folders). It might also try to follow symlinks in case they point to a node_modules directory, and emit an error each time it encounters a broken symlink in the process.

That's plausible and reassuring. No malicious script involved.

I removed initrd.img, /initrd.img.old, /vmlinuz and /vmlinuz.old, which were indeed broken symlinks. So I shouldn't get these errors anymore.

user_18040060

In my case it was an incorrect import statement of a static CSS file in my react-app.

VS Code for some reason auto imported a "classes" object from some random route when trying to declare const classes = useStyles(); using Material UI makeStyles method.

So check if you have any incorrect import statements of files.

user_116556070

In my case the message appeared when I installed new @mui/material ui lib without @emotion/react @emotion/styled complement

The missing library name was written in the error message in the console, but I had to catch it with PrtSc cause the message mentioned above replaces it almost immediately.

user_154142110

Node.js tries to find modules in the parent directories, up to the root. Possibly in your /boot there is a broken symlink. The message indicates that there is a package not found or a mispelled import in your codebase.

user_8334990

In my case this error fix manual installing react-router-dom npm i react-router-dom

user_91379800

For me, an npm package was missing in the package.json. Installing the package with npm install --save <package> solved the issue

user_65289440

In my case, an import syntax error. I had forgotten the first forward slash before 'components/MyComponent'.

In my App.js:

import MyComponent from '..components/MyComponent'

change by:

import MyComponent from '../components/MyComponent'

user_136665090

The same error message occurred to me. After removing all files at node_modules and running npm install to reinstall them, it says the node-sass dependency failed to run, then after rebuilt of the dep, the error disappeared.

user_109226120

I also saw this error. For me the reason was that I was not installing the npm package in my project directory but in some other directory.

I noticed package.json and package-lock.json in my project were not getting updated even after running npm install --save <package_name>

user_119532160
Related