Cannot run audit #20604

micahalcorn · 2018-05-13T01:32:46Z

I'm opening this issue because:

npm is crashing.
npm is producing an incorrect install.
npm is doing something I don't understand.
npm is producing incorrect or undesirable behavior.
Other (see below for feature requests):

What's going wrong?

npm audit results in a 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits

How can the CLI team reproduce the problem?

Run npm audit with n managing node installations

0 info it worked if it ends with ok
1 verbose cli [ '/usr/local/bin/node', '/usr/local/bin/npm', 'audit' ]
2 info using npm@6.0.1
3 info using node@v10.0.0
4 verbose npm-session d540b974d0d3057d
5 timing audit compress Completed in 21ms
6 info audit Submitting payload of 110438 bytes
7 http fetch POST 400 https://registry.npmjs.org/-/npm/v1/security/audits 681ms
8 verbose stack Error: 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits
8 verbose stack     at res.buffer.catch.then.body (/usr/local/lib/node_modules/npm/node_modules/npm-registry-fetch/check-response.js:94:15)
8 verbose stack     at process._tickCallback (internal/process/next_tick.js:178:7)
9 verbose statusCode 400
10 verbose cwd /Users/kgb/Dropbox/Origin/demo-dapp
11 verbose Darwin 16.1.0
12 verbose argv "/usr/local/bin/node" "/usr/local/bin/npm" "audit"
13 verbose node v10.0.0
14 verbose npm  v6.0.1
15 error code E400
16 error 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits
17 verbose exit [ 1, true ]

supporting information:

npm -v prints: 6.0.1
node -v prints: v10.0.0 (same result with v8.5.0)
npm config get registry prints: https://registry.npmjs.org/
Windows, OS X/macOS, or Linux?: macOS Sierra Version 10.12.1
Network issues:
- Geographic location where npm was run: Oklahoma, United States?
- I use a proxy to connect to the npm registry.
- I use a proxy to connect to the web.
- I use a proxy when downloading Git repos.
- I access the npm registry via a VPN
- I don't use a proxy, but have limited or unreliable internet access.
Container:
- I develop using Vagrant on Windows.
- I develop using Vagrant on OS X or Linux.
- I develop / deploy using Docker.
- I deploy to a PaaS (Triton, Heroku).

The text was updated successfully, but these errors were encountered:

XinfinityoO · 2018-05-13T22:10:04Z

facing similar issue, npm is 6.0.1 and node is 8.11.1

ihutc · 2018-05-13T23:29:12Z

I have the same problem with npm audit if my dependencies include a reference to a tarball, for example with the following in package.json

    "node-sass": "https://github.com/sass/node-sass/tarball/v5",

yields the following

0 info it worked if it ends with ok
1 verbose cli [ '/usr/local/bin/node', '/usr/local/bin/npm', 'audit' ]
2 info using npm@6.0.1
3 info using node@v8.9.4
4 verbose npm-session 3db686a5bad6017f
5 timing audit compress Completed in 7ms
6 info audit Submitting payload of 40362 bytes
7 http fetch POST 400 https://registry.npmjs.org/-/npm/v1/security/audits 1139ms
8 verbose stack Error: 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits
8 verbose stack     at res.buffer.catch.then.body (/usr/local/lib/node_modules/npm/node_modules/npm-registry-fetch/check-response.js:94:15)
8 verbose stack     at <anonymous>
8 verbose stack     at process._tickCallback (internal/process/next_tick.js:188:7)
9 verbose statusCode 400
10 verbose cwd /Users/ihutc/Repos/ihutc-tweet-delete
11 verbose Darwin 17.5.0
12 verbose argv "/usr/local/bin/node" "/usr/local/bin/npm" "audit"
13 verbose node v8.9.4
14 verbose npm  v6.0.1
15 error code E400
16 error 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits
17 verbose exit [ 1, true ]

Otherwise with a package reference like

    "node-sass": "^4.9.0",

then npm audit works as expected.

I'm using Node 8.9.4 and NPM 6.0.1

sanxing-chen · 2018-05-15T13:37:54Z

Face the same problem

0 info it worked if it ends with ok
1 verbose cli [ 'C:\\Program Files\\nodejs\\node.exe',
1 verbose cli   'C:\\Users\\hhhh\\AppData\\Roaming\\npm\\node_modules\\npm\\bin\\npm-cli.js',
1 verbose cli   'audit' ]
2 info using npm@6.0.1
3 info using node@v8.9.4
4 verbose npm-session ba8cfa9f640250b8
5 timing audit compress Completed in 11ms
6 info audit Submitting payload of 42855 bytes
7 http fetch POST 400 https://registry.npmjs.org/-/npm/v1/security/audits 983ms
8 verbose stack Error: 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits
8 verbose stack     at res.buffer.catch.then.body (C:\Users\hhhh\AppData\Roaming\npm\node_modules\npm\node_modules\npm-registry-fetch\check-response.js:94:15)
8 verbose stack     at <anonymous>
8 verbose stack     at process._tickCallback (internal/process/next_tick.js:188:7)
9 verbose statusCode 400
10 verbose cwd C:\Users\hhhh\source\repos\Recognizers-Text\JavaScript
11 verbose Windows_NT 10.0.16299
12 verbose argv "C:\\Program Files\\nodejs\\node.exe" "C:\\Users\\hhhh\\AppData\\Roaming\\npm\\node_modules\\npm\\bin\\npm-cli.js" "audit"
13 verbose node v8.9.4
14 verbose npm  v6.0.1
15 error code E400
16 error 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits
17 verbose exit [ 1, true ]

for my case

npm install --dev ava@0.25.0

causes this issue

yadu-bolder · 2018-05-18T08:00:25Z

Facing the same issue.

npm ERR! code E400
npm ERR! 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits

npm --version = 6.0.1
node --version = v8.9.4

NejcZdovc · 2018-05-21T08:47:24Z

+1 from me as well

ujeshurun · 2018-05-22T22:44:21Z

Need help resolving the same issue.

antoniovj1 · 2018-05-23T08:30:28Z

Same here

info using npm@6.1.0
info using node@v8.9.4

seishin4real · 2018-05-26T11:29:26Z

same here

"node-sass": "^4.7.2"
npm@5.10.0
node@10.2.1

vhanla · 2018-05-28T22:11:26Z

Returns: GET method not allowed, even though is POST method (tested sending POST requests to that endpoint)

 http fetch POST 301 http://registry.npmjs.org/-/npm/v1/security/audits 218ms
 verbose stack SyntaxError: Unexpected end of JSON input while parsing near ''

williamchong · 2018-05-29T13:11:32Z

same on npm@6.1.0 node@9.11.1
is this project dependency related?

matrunchyk · 2018-05-30T08:51:27Z

npm -v
6.1.0

node -v
v8.11.1

matrunchyk · 2018-05-30T09:00:06Z

Solved with:

rm package-lock.json
npm i
npm audit fix

quinnlangille · 2018-05-30T16:04:50Z

Looks as if references to any package that isn't a version number breaks the audit. I had one package pointing to a local directory and audit would break, to fix I

1. removed that dependency manually from package.json
2. rm -rf node_modules
2. rm package-lock.json
3. npm i (npm audit ran automatically on install this time)
4. npm audit fix
5. manually re-add package and reinstall node modules

Definitely not ideal, any idea if this is a bug or expected behaviour?

matrunchyk · 2018-05-30T16:08:15Z

@quinnlangille thanks for the research. Btw there's a small typo:
npm audiit fix -> npm audit fix

bantic · 2018-05-30T19:58:14Z

I was getting the same error as @vhanla:

 http fetch POST 301 http://registry.npmjs.org/-/npm/v1/security/audits 218ms
 verbose stack SyntaxError: Unexpected end of JSON input while parsing near ''

This appears to be due to the fact that registry URL is http instead of https. That POST is returning a 301 redirect to the https url. I'm not sure why the redirect is not followed, but this seems to be the source of the problem. The JSON parsing error that is logged comes from when npm attempts to decode the JSON from the empty response body (via a call to body.json() here).

@vhanla I think your problem will be resolved if you use the https registry instead:

 npm config set registry https://registry.npmjs.org/

I also have the same problem @quinnlangille describes above, and removing the dependency that points to a local file also fixed the issue for me.

XinfinityoO · 2018-05-30T21:26:38Z

the above does not work for me. I think the issue is something else. My registry is pointing to the correct HTTPS link and I also don't have any local files dependencies in my package.json file

{ "name": "*****", "version": "2.2.2", "repository": "https://git-codecommit.us-east-1.amazonaws.com/*********i", "dependencies": { "async": "^2.6.1", "aws-sdk": "^2.248.1", "bluebird": "", "node-fetch": "^2.1.2", "serverless-mocha-plugin": "^1.8.3", "serverless-plugin-stage-variables": "1.7.8" }, "devDependencies": {}, "license": "UNLICENSED", "private": true }

and i still get errors

wearhere · 2018-05-30T22:12:18Z

Similar to what @quinnlangille reports, a package installed from GitHub was breaking it for me. This works around it #20604 (comment)

paranoico · 2018-06-13T17:58:05Z

Why is this issue closed if it still is unresolved???

quinnlangille · 2018-06-13T19:23:10Z

@XinfinityoO if you remove the empty string from bluebird then delete your node_modules and package-lock.json, does the audit work? From what I've experienced on a few different repos, I think it needs to see a version number

quinnlangille · 2018-06-13T19:24:09Z

@paranoico this issue isn't closed. Post #20661 was closed, which is what the closed sign above is indicating

francisrod01 · 2018-06-14T14:12:57Z

I'm thinking... Remove the package-lock.json and run npm i again is check two way the packages?

tutuca · 2018-06-19T01:26:27Z

Workaround doesn't work for me:

➜ less /home/tutuca/.npm/_logs/2018-06-19T01_22_38_059Z-debug.log
0 info it worked if it ends with ok
1 verbose cli [ '/home/tutuca/.venvs/potaje/bin/node',
1 verbose cli   '/home/tutuca/.venvs/potaje/bin/npm',
1 verbose cli   'audit' ]
2 info using npm@6.1.0
3 info using node@v10.4.1
4 verbose npm-session 7db8e1f7f26d798e
5 timing audit compress Completed in 8ms
6 info audit Submitting payload of 43919 bytes
7 http fetch POST 400 https://registry.npmjs.org/-/npm/v1/security/audits 1546ms
8 verbose stack Error: 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits
8 verbose stack     at res.buffer.catch.then.body (/home/tutuca/.venvs/potaje/lib/node_modules/npm/node_modules/npm-registry-fetch/check-response.js:94:15)
8 verbose stack     at process._tickCallback (internal/process/next_tick.js:68:7)
9 verbose statusCode 400
10 verbose cwd /home/tutuca/Proyectos/potaje
11 verbose Linux 4.15.0-23-generic
12 verbose argv "/home/tutuca/.venvs/potaje/bin/node" "/home/tutuca/.venvs/potaje/bin/npm" "audit"
13 verbose node v10.4.1
14 verbose npm  v6.1.0
15 error code E400
16 error 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits
17 verbose exit [ 1, true ]

codevbus · 2018-06-27T15:53:46Z

👍

itsmepetrov · 2018-06-27T20:17:43Z

I have the same issue if my package.json includes samlp@3.4.0 module.

npm --version = 6.0.1
node --version = v8.9.4

I think it's because samlp contains this dependency:

"xmldom": "auth0/xmldom#v0.1.19-auth0_1"

Paqrat76 · 2018-07-11T19:53:07Z

Same issue:
node --version -> 8.11.3
npm --version -> 6.1.0
npm install -> up to date in 3.959s
All dependencies/devDependencies have version numbers in package.json.
Deleted node_modules and package-lock.json and re-ran npm install.

npm ERR! 400 Bad Request - POST https://artifactory.aws.xxx.com:443/api/npm/npm/-/npm/v1/security/audits

From npm config list: registry = "https://artifactory.aws.xxx.com:443/api/npm/npm/"

Putting https://artifactory.aws.xxx.com:443/api/npm/npm/-/npm/v1/security/audits into browser results in the following:

{
  "errors" : [ {
    "status" : 404,
    "message" : "Not Found"
  } ]
}

while putting https://registry.npmjs.org/-/npm/v1/security/audits into browser results in the following:
{"code":"MethodNotAllowedError","message":"GET is not allowed"}.

Does something need to be done on the repository to make npm audit work? We are using jFrog Artifactory Enterprise v5.4.6.

DanielRuf · 2018-07-12T11:05:04Z

Does something need to be done on the repository to make npm audit work? We are using jFrog Artifactory Enterprise v5.4.6.

Ah so you use your own private registry / proxy?

Paqrat76 · 2018-07-12T14:30:04Z

@DanielRuf Yes... we access the npm repo via a proxy. Just found this (https://www.jfrog.com/jira/browse/RTFACT-16670), so it is definitely a jFrog Artifactory issue.

wearhere · 2018-07-12T15:03:24Z

This issue happens for me without using a private registry / proxy though.

adeguntoro · 2018-07-12T19:05:31Z

So, is this issue because our internet connection or something else ?
because I have same issue in here.

micahalcorn changed the title ~~Cannot run npm audit~~ Cannot run audit May 13, 2018

kenany added registry support labels May 19, 2018

NejcZdovc mentioned this issue May 21, 2018

Replaces nsp with audit brave/browser-laptop#14192

Closed

10 tasks

eli8levit mentioned this issue Jun 4, 2018

npm audit - Error 400 - Bad Resquest #20661

Closed

5 tasks

francisrod01 mentioned this issue Jun 14, 2018

NPM audit fails with 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits npm/registry-issue-archive#320

Open

YannickMeeus mentioned this issue Oct 29, 2018

Tarball dependency on listr-update-renderer breaks npm audit lint-staged/lint-staged#516

Closed

itaisteinherz mentioned this issue Feb 22, 2019

Response code 400 (Bad Request) sindresorhus/np#350

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cannot run audit #20604

Cannot run audit #20604

micahalcorn commented May 13, 2018 •

edited

XinfinityoO commented May 13, 2018

ihutc commented May 13, 2018 •

edited

sanxing-chen commented May 15, 2018 •

edited

yadu-bolder commented May 18, 2018

NejcZdovc commented May 21, 2018

ujeshurun commented May 22, 2018

antoniovj1 commented May 23, 2018 •

edited

seishin4real commented May 26, 2018

vhanla commented May 28, 2018

williamchong commented May 29, 2018

matrunchyk commented May 30, 2018

matrunchyk commented May 30, 2018

quinnlangille commented May 30, 2018 •

edited

matrunchyk commented May 30, 2018

bantic commented May 30, 2018

XinfinityoO commented May 30, 2018

wearhere commented May 30, 2018

paranoico commented Jun 13, 2018

quinnlangille commented Jun 13, 2018 •

edited

quinnlangille commented Jun 13, 2018 •

edited

francisrod01 commented Jun 14, 2018

tutuca commented Jun 19, 2018

codevbus commented Jun 27, 2018

itsmepetrov commented Jun 27, 2018 •

edited

Paqrat76 commented Jul 11, 2018 •

edited

DanielRuf commented Jul 12, 2018

Paqrat76 commented Jul 12, 2018

wearhere commented Jul 12, 2018

adeguntoro commented Jul 12, 2018

Navigation Menu

Cannot run audit #20604

Cannot run audit #20604

Comments

micahalcorn commented May 13, 2018 • edited

I'm opening this issue because:

What's going wrong?

How can the CLI team reproduce the problem?

supporting information:

XinfinityoO commented May 13, 2018

ihutc commented May 13, 2018 • edited

sanxing-chen commented May 15, 2018 • edited

yadu-bolder commented May 18, 2018

NejcZdovc commented May 21, 2018

ujeshurun commented May 22, 2018

antoniovj1 commented May 23, 2018 • edited

seishin4real commented May 26, 2018

vhanla commented May 28, 2018

williamchong commented May 29, 2018

matrunchyk commented May 30, 2018

matrunchyk commented May 30, 2018

quinnlangille commented May 30, 2018 • edited

matrunchyk commented May 30, 2018

bantic commented May 30, 2018

XinfinityoO commented May 30, 2018

wearhere commented May 30, 2018

paranoico commented Jun 13, 2018

quinnlangille commented Jun 13, 2018 • edited

quinnlangille commented Jun 13, 2018 • edited

francisrod01 commented Jun 14, 2018

tutuca commented Jun 19, 2018

codevbus commented Jun 27, 2018

itsmepetrov commented Jun 27, 2018 • edited

Paqrat76 commented Jul 11, 2018 • edited

DanielRuf commented Jul 12, 2018

Paqrat76 commented Jul 12, 2018

wearhere commented Jul 12, 2018

adeguntoro commented Jul 12, 2018

micahalcorn commented May 13, 2018 •

edited

ihutc commented May 13, 2018 •

edited

sanxing-chen commented May 15, 2018 •

edited

antoniovj1 commented May 23, 2018 •

edited

quinnlangille commented May 30, 2018 •

edited

quinnlangille commented Jun 13, 2018 •

edited

quinnlangille commented Jun 13, 2018 •

edited

itsmepetrov commented Jun 27, 2018 •

edited

Paqrat76 commented Jul 11, 2018 •

edited