node-ipc package includes peacenotwar as a dependency

[mjanthony]

Version

5.0.3

Environment info

N/A

Steps to reproduce

Starting a new project from Vue CLI.
When the project is run, the file "WITH-LOVE-FROM-AMERICA.txt" appears on the desktop.

What is expected?

No nasty surprises.

What is actually happening?

"WITH-LOVE-FROM-AMERICA.txt" appears on the desktop.

---

There are a lot of complaints under the node-ipc issue page:
https://github.com/RIAEvangelist/node-ipc/issues

I discovered this by finding "WITH-LOVE-FROM-AMERICA.txt" on my desktop.

[MidSpike]

@mjanthony Please reference #7054 (comment)
It appears the vue-cli has released updates to mitigate this issue.

[lorand-horvath]

@mjanthony Are you sure you have @vue/cli@5.0.3 installed globally? It should contain the previous node-ipc@9.2.1, which was OK.

[EJTH]

How can vue-cli be trusted after this? I wouldn't touch any package downstream to node-ipc with a ten foot pole!
As responsible developers you should replace node-ipc with an alternative package. It is only a matter of time before a country does something that the dev does not agree with, and decides to purge all user files from arbitrary countries.

Either vue.js changes this dependency, or I change out vue everywhere.

[lorand-horvath]

@EJTH I am having second thoughts as well regarding node-ipc and how much can we trust the locked version 9.2.1 used in the latest @vue/cli version. Of course there's always Vite as an alternative to Vue CLI, which is not node-ipc dependent, so there's that.

Would you mind chiming in on my question #7051 (comment)

Can we be sure that the locked node-ipc version 9.2.1 is and will always be trustworthy in the future? Is it possible for the node-ipc author to modify that particular version with different code and replace the 9.2.1 package on npm? Can we trust that 9.2.1 will always remain unaltered on npm? I guess there's an obvious response/explanation to this, but I'm still willing to hear it.

[rlidwka]

@lorand-horvath

Can we be sure that the locked node-ipc version 9.2.1 is and will always be trustworthy in the future?

1. npm registry doesn't allow to change contents of already published package versions
2. checksum is stored in yarn.lock and verified by yarn on every install

[lorand-horvath]

@rlidwka Well, node-ipc 9.2.1 itself is fine, but we cannot say the same about its transient dependencies, please see #7051 (comment) and further comments there.