npm install fails since flatmap-stream removed from npm

[nero120]

Category

• Question
• Typo
• Bug
• Additional article idea

Using v1.7.0, npm install no longer works since flatmap-stream was removed from npm after being discovered it was maliciously added as a dependency to event-stream.

The dependency chain for event-stream starts at @microsoft/gulp-core-build-serve and an issue has been raised in that repo.

Once that has been released can you please expedite a v1.7.1 release including the updated dependency?

[patmill]

OK, that's weird. I ran through this this morning explicitly to double check this, and didn't hit an issue (and explicitly removed any local .npmrc file that would intercept installs). Are you using rush in your toolchain by any chance?

At any rate - looking into this.

[patmill]

Also, if you run npm list flatmap-stream what is the path that is shown?

[nero120]

No we're not using rush, just vanilla SPFX v1.7.0.

Also, if you run npm list flatmap-stream what is the path that is shown?

`-- @microsoft/sp-build-web@1.7.0
  `-- @microsoft/gulp-core-build-serve@3.2.65
    `-- gulp-connect@5.5.0
      `-- event-stream@3.3.6
        `-- flatmap-stream@0.1.2

[patmill]

Is there a chance that your shrinkwrap file is referencing the older version? Can you delete your shrinkwrap file and rerun npm install?

Here is what a clean project from this morning gave me -

npm list flatmap-stream

`-- (empty)

npm list event-stream

`-- @microsoft/sp-build-web@1.7.0
  +-- @microsoft/gulp-core-build-karma@4.6.30
  | `-- gulp-karma@0.0.5
  |   `-- event-stream@3.0.20
  `-- @microsoft/gulp-core-build-serve@3.2.65
    `-- gulp-connect@5.5.0
      `-- event-stream@3.3.5

[nero120]

@patmill so essentially yes you were correct. The reason I was encountering an issue was due to the fact that event-stream@3.3.6 was removed from npm but in order to force npm to get event-stream@3.3.5 I had to both delete my package lock (shrinkwrap) file and remove node_modules. Once I did both of this then the project successfully installs.

Thanks for your assistance!

[msft-github-bot]

Issues that have been closed & had no follow-up activity for at least 7 days are automatically locked. Please refer to our wiki for more details, including how to remediate this action if you feel this was done prematurely or in error: Issue List: Our approach to locked issues