I installed the wrong NPM package. Should I be worried?

user_13166126 0
Viewed 1148

I run this in CMD. I was trying to install gulp, but I run the wrong command:

npm install glup

Did it install some bad package, and will this harm my PC? What should I do now? I am very new to using npm so I am afraid about it.

Here are the error message display in console.

npm WARN deprecated babel-preset-es2015@6.24.1:   Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN deprecated bower-files@3.14.1: This module is no longer being maintained. Please reach out to package author if you wish to take over maintenance. For alternatives, use wiredep, or migrate to something like webpack
npm WARN deprecated core-js@2.6.12: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
npm WARN deprecated debug@4.1.1: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm WARN deprecated gulp-util@3.0.8: gulp-util is deprecated - replace it, following the guidelines at https://medium.com/gulpjs/gulp-util-ca3b1f9f9ac5
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated minimatch@0.2.14: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated graceful-fs@1.2.3: please upgrade to graceful-fs 4 for compatibility with current and future versions of Node.js
npm WARN deprecated natives@1.1.6: This module relies on Node.js's internals and will break at some point. Do not use it, and update to graceful-fs@4.x.
npm WARN deprecated browserslist@1.7.7: Browserslist 2 could fail on reading Browserslist >3.0 config used in other tools.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported

> node-sass@3.13.1 install C:\Users\ABHIJIT\node_modules\node-sass
> node scripts/install.js

Downloading binary from https://github.com/sass/node-sass/releases/download/v3.13.1/win32-x64-83_binding.node
Cannot download "https://github.com/sass/node-sass/releases/download/v3.13.1/win32-x64-83_binding.node":

HTTP error 404 Not Found

Hint: If github.com is not accessible in your location
      try setting a proxy via HTTP_PROXY, e.g.

      export HTTP_PROXY=http://example.com:1234

or configure npm proxy via

      npm config set proxy http://example.com:8080

> core-js@2.6.12 postinstall C:\Users\ABHIJIT\node_modules\core-js
> node -e "try{require('./postinstall')}catch(e){}"

Thank you for using core-js ( https://github.com/zloirock/core-js ) for polyfilling JavaScript standard library!

The project needs your help! Please consider supporting of core-js on Open Collective or Patreon:
> https://opencollective.com/core-js
> https://www.patreon.com/zloirock

Also, the author of core-js ( https://github.com/zloirock ) is looking for a good job -)


> node-sass@3.13.1 postinstall C:\Users\ABHIJIT\node_modules\node-sass
> node scripts/build.js

Building: C:\Program Files\nodejs\node.exe C:\Users\ABHIJIT\node_modules\node-gyp\bin\node-gyp.js rebuild --verbose --libsass_ext= --libsass_cflags= --libsass_ldflags= --libsass_library=
gyp info it worked if it ends with ok
gyp verb cli [
gyp verb cli   'C:\\Program Files\\nodejs\\node.exe',
gyp verb cli   'C:\\Users\\ABHIJIT\\node_modules\\node-gyp\\bin\\node-gyp.js',
gyp verb cli   'rebuild',
gyp verb cli   '--verbose',
gyp verb cli   '--libsass_ext=',
gyp verb cli   '--libsass_cflags=',
gyp verb cli   '--libsass_ldflags=',
gyp verb cli   '--libsass_library='
gyp verb cli ]
gyp info using node-gyp@3.8.0
gyp info using node@14.15.5 | win32 | x64
gyp verb command rebuild []
gyp verb command clean []
gyp verb clean removing "build" directory
gyp verb command configure []
gyp verb check python checking for Python executable "python2" in the PATH
gyp verb `which` failed Error: not found: python2
gyp verb `which` failed     at getNotFoundError (C:\Users\ABHIJIT\node_modules\which\which.js:13:12)
gyp verb `which` failed     at F (C:\Users\ABHIJIT\node_modules\which\which.js:68:19)
gyp verb `which` failed     at E (C:\Users\ABHIJIT\node_modules\which\which.js:80:29)
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\which\which.js:89:16
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\isexe\index.js:42:5
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\isexe\windows.js:36:5
gyp verb `which` failed     at FSReqCallback.oncomplete (fs.js:183:21)
gyp verb `which` failed  python2 Error: not found: python2
gyp verb `which` failed     at getNotFoundError (C:\Users\ABHIJIT\node_modules\which\which.js:13:12)
gyp verb `which` failed     at F (C:\Users\ABHIJIT\node_modules\which\which.js:68:19)
gyp verb `which` failed     at E (C:\Users\ABHIJIT\node_modules\which\which.js:80:29)
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\which\which.js:89:16
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\isexe\index.js:42:5
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\isexe\windows.js:36:5
gyp verb `which` failed     at FSReqCallback.oncomplete (fs.js:183:21) {
gyp verb `which` failed   code: 'ENOENT'
gyp verb `which` failed }
gyp verb check python checking for Python executable "python" in the PATH
gyp verb `which` failed Error: not found: python
gyp verb `which` failed     at getNotFoundError (C:\Users\ABHIJIT\node_modules\which\which.js:13:12)
gyp verb `which` failed     at F (C:\Users\ABHIJIT\node_modules\which\which.js:68:19)
gyp verb `which` failed     at E (C:\Users\ABHIJIT\node_modules\which\which.js:80:29)
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\which\which.js:89:16
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\isexe\index.js:42:5
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\isexe\windows.js:36:5
gyp verb `which` failed     at FSReqCallback.oncomplete (fs.js:183:21)
gyp verb `which` failed  python Error: not found: python
gyp verb `which` failed     at getNotFoundError (C:\Users\ABHIJIT\node_modules\which\which.js:13:12)
gyp verb `which` failed     at F (C:\Users\ABHIJIT\node_modules\which\which.js:68:19)
gyp verb `which` failed     at E (C:\Users\ABHIJIT\node_modules\which\which.js:80:29)
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\which\which.js:89:16
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\isexe\index.js:42:5
gyp verb `which` failed     at C:\Users\ABHIJIT\node_modules\isexe\windows.js:36:5
gyp verb `which` failed     at FSReqCallback.oncomplete (fs.js:183:21) {
gyp verb `which` failed   code: 'ENOENT'
gyp verb `which` failed }
gyp verb could not find "python". checking python launcher
gyp verb could not find "python". guessing location
gyp verb ensuring that file exists: C:\Python27\python.exe
gyp ERR! configure error
gyp ERR! stack Error: Can't find Python executable "python", you can set the PYTHON env variable.
gyp ERR! stack     at PythonFinder.failNoPython (C:\Users\ABHIJIT\node_modules\node-gyp\lib\configure.js:484:19)
gyp ERR! stack     at PythonFinder.<anonymous> (C:\Users\ABHIJIT\node_modules\node-gyp\lib\configure.js:509:16)
gyp ERR! stack     at callback (C:\Users\ABHIJIT\node_modules\graceful-fs\polyfills.js:299:20)
gyp ERR! stack     at FSReqCallback.oncomplete (fs.js:183:21)
gyp ERR! System Windows_NT 10.0.15063
gyp ERR! command "C:\\Program Files\\nodejs\\node.exe" "C:\\Users\\ABHIJIT\\node_modules\\node-gyp\\bin\\node-gyp.js" "rebuild" "--verbose" "--libsass_ext=" "--libsass_cflags=" "--libsass_ldflags=" "--libsass_library="
gyp ERR! cwd C:\Users\ABHIJIT\node_modules\node-sass
gyp ERR! node -v v14.15.5
gyp ERR! node-gyp -v v3.8.0
gyp ERR! not ok
Build failed with error code: 1
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.1 (node_modules\chokidar\node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.2: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})
npm WARN enoent ENOENT: no such file or directory, open 'C:\Users\ABHIJIT\package.json'
npm WARN ABHIJIT No description
npm WARN ABHIJIT No repository field.
npm WARN ABHIJIT No README data
npm WARN ABHIJIT No license field.

npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! node-sass@3.13.1 postinstall: `node scripts/build.js`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the node-sass@3.13.1 postinstall script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\Users\ABHIJIT\AppData\Roaming\npm-cache\_logs\2021-02-24T23_00_41_588Z-debug.log

Can someone let me know if anything bad will happen because of this?

npm node.js javascript
2 Answers

It looks like glup is just someone's personal gulp setup. You can view the code for it here: https://github.com/karlhepler/glup

Just run npm uninstall glup to get rid of it.

user_53517210

To uninstall a package simply run:

npm uninstall <package-name>

Should you be worried?

Yes you should as typosquatting attacks are real and are just one "fat finger" away from reaching your system. All an attacker has to do is identify a popular package and submit their exploit using a name similar enough to confuse people or one that you could type out by mistake.

The attacker also relies on the fact that most people will simply "install" the package which triggers all the pre and post install scripts.

Let's say I have this package.json:

{
  "name": "attack",
  "version": "1.0.0",
  "main": "index.js",
  "license": "MIT",
  "scripts": {
    "preinstall": "echo 'i could do some damage here'",
    "postinstall": "echo 'i could do some damage here too'"
  }
}

Now I'll create a package for it:

$ yarn pack
$ ls
attack-v1.0.0.tgz

Then I go to my burrito directory and install that package:

$ npm install ../attack-v1.0.0.tgz 

> attack@1.0.0 preinstall /private/tmp/burrito/node_modules/attack
> echo 'i could do some damage here'

i could do some damage here

> attack@1.0.0 postinstall /private/tmp/burrito/node_modules/attack
> echo 'i could do some damage here too'

i could do some damage here too
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN burrito@1.0.0 No description
npm WARN burrito@1.0.0 No repository field.

+ attack@1.0.0
updated 1 package and audited 1 package in 0.423s
found 0 vulnerabilities

See how that executed the code in both the preinstall and postinstall scripts?

To avoid running these scripts you should install with the --ignore-scripts flag:

$ npm install --ignore-scripts ../attack/attack-v1.0.0.tgz 
npm WARN burrito@1.0.0 No description
npm WARN burrito@1.0.0 No repository field.

+ attack@1.0.0
updated 1 package and audited 1 package in 0.913s
found 0 vulnerabilities

enter image description here

https://github.com/advisories?query=ecosystem%3Anpm+babel

In this particular case there doesn't seem to be any reason to be worried though. glup seems to be a honest and harmless package.

user_12448840
Related