Claims all ports occupied on macOS high sierra

[tko]

For every port I've tried detect-port claims the port is occupied but lsof finds nothing. Turning on DEBUG shows errors similar to

detect-port listen localhost:3009 error: Error: getaddrinfo ENOTFOUND localhost +1ms

It appears default macos installation does not include localhost in /etc/hosts -- the file is completely empty. Adding an entry fixes this, but IMO it shouldn't be required.

macOS 10.13.3

[popomore]

Yeah, localhost should be optional, it depends on /etc/hosts.

[fengmk2]

Can you tell me the version of detect-port? Dns notfound error it has been handled and ignore on https://github.com/node-modules/detect-port/blob/master/lib/detect-port.js#L82

[tko]

Mine's detect-port-alt@1.1.5 as installed by create-react-app@1.5.1

└─┬ react-scripts@1.1.1
  ├─┬ react-dev-utils@5.0.0
  │ ├─┬ detect-port-alt@1.1.5
  │ │ ├── address@1.0.3 deduped
  │ │ └── debug@2.6.9 deduped

(I've no idea about the differences between different detect-ports in npmjs, they all seemed to point to this github project.)

[fengmk2]

detect-port-alt is not the detect-port. I don't know why they publish the detect-port-alt package and the source code not from https://github.com/node-modules/detect-port

[gabrielcaires]

I solved it populating my /etc/hosts file with the content:

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1       localhost
255.255.255.255 broadcasthost
::1             localhost

[G-Rath]

@fengmk2 I came across this after noticing detect-port & detect-port-alt, and wondering what the difference is.

I strongly recommend contacting npm support about this - while it looks like this is just the publishing of a forked version of detect-port that has maybe slight behavior differences? (it's hard to tell, but it actually looks like it's just had a minor change to the internal implementation), the fact that it acts & looks exactly like this repo isn't good - I've not been able to find the repo that sources this yet has almost three times the weekly downloads as detect-port.

Personally this scares the crap out of me, as if someone got control of that repo they could easily publish a patch version that'd do all sorts of nasty things.

npm are usually pretty good about this because of the huge security risk this represents - ideally what you want is for the detect-port-alt package to be locked & deprecated so that new versions of it can't be published. It would be nice to look into what the actual differences are, and if there are features, see if they could be implemented into detect-port to make it easier for the community to switch over.

I'm happy to help out with this :)