(cli): liberty liberty liberty? #18323
Comments
plmwd
added
bug
|
These are my global modules: |
|
Duplicate of #18322 |
|
Please check open issues before creating new ones. I guess this one here can be closed. |
|
My bad. I did only a brief look. I'll close it. |
|
Fixes #18322 and #18323 Clarifying question: I'm not sure if the `yarn.lock` file should have automatically updated itself to only refer to `colors@1.4.0` when I set the dependency within the workspace _and_ added the resolution for child dependencies. If it's expected behavior for it _not_ to update the `yarn.lock` file after adding `resolutions`, great! If I need to do something else for that to happen, let me know! ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Fixes #18322 and #18323 Clarifying question: I'm not sure if the `yarn.lock` file should have automatically updated itself to only refer to `colors@1.4.0` when I set the dependency within the workspace _and_ added the resolution for child dependencies. If it's expected behavior for it _not_ to update the `yarn.lock` file after adding `resolutions`, great! If I need to do something else for that to happen, let me know! ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Fixes #18322 and #18323 Clarifying question: I'm not sure if the `yarn.lock` file should have automatically updated itself to only refer to `colors@1.4.0` when I set the dependency within the workspace _and_ added the resolution for child dependencies. If it's expected behavior for it _not_ to update the `yarn.lock` file after adding `resolutions`, great! If I need to do something else for that to happen, let me know! ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
|
npx marak-free |
|
How many projects are affected? Damn I came across two in the last 5 min |
|
@ondbyte Ours too. Building the product just prints rubbish on the console. |
Literally everything that uses colors.js is affected |
|
Does this mean Amazon is including code from external sources without reviewing it? |
|
The CDK is for local development and does not run on their servers afaik. These are completely different things. The CDK is a tool to build products. Provisioning is not done with this and the projects also do not run with this in production. Like any SDK, a CDK is a development tool, nothing more. |
|
More on why the developer has done it here. https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/ |
Check the link. |
|
The solution can be to lock the version in package.json |
|
Ars Technica is covering this issue too. |
|
What's ironic is, the developer has been locked out of his/her account and npm has reverted to last working version of these packages. |
|
What the heck, I also found a tweet from the developer if this package. |
Fixes aws#18322 and aws#18323 Clarifying question: I'm not sure if the `yarn.lock` file should have automatically updated itself to only refer to `colors@1.4.0` when I set the dependency within the workspace _and_ added the resolution for child dependencies. If it's expected behavior for it _not_ to update the `yarn.lock` file after adding `resolutions`, great! If I need to do something else for that to happen, let me know! ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
What is the problem?
Installing cdk with pnpm:
Causes weird output due to faker.js (I presume) :
❯ cdk LIBERTY LIBERTY LIBERTY LIBERTY LIBERTY LIBERTY LIBERTY LIBERTY LIBERTY ! H|H|H|H|H H__________________________________ H|§|§|§|H H|* * * * * *|---------------------| H|§|∞|§|H H| * * * * * |---------------------| H|§|§|§|H H|* * * * * *|---------------------| H|H|H|H|H H| * * * * * |---------------------| H|H|H|H|H H|---------------------------------| =============== H|---------------------------------| /| _ _ | H|---------------------------------| (| O O |) H|---------------------------------| /| U | H----------------------------------- | =/ | H _..._/ H _|I/|_ H _______/| H |/_______ H / / / H | | | / | H | ||o|| | H | | ||o|| | | H | | ||o|| | | H Carl Pilcher t͙͒e͇ͭs͉ͯt̳̒i͗͡ ҉̟n̙ͬg͉ͩ ͈̄t̘̂e̲ͮś͍t̜̔ì̮n͍͛g͙̀ ͎̓t̖̍e̮̊s̞͊t̯ͧi̗͋n̗̐ĝ̺ ̳̐t͓͒e̠ͨs̙͛t͎̓i̜̓ň͔g̤̋ ͍̊t̥͆eͧ͟ ҉͈s͍̏t̆͢ ҉͚i̟ͣn͇ͫgͦ̕ ҉̬ ͎̆t͗͜ ҉̗ẹ͋s̯ͮt̝ͭi̬̇n̝͋g͇̒ ͚̈t͒̈ ҉̺e̮͒s̯͛t̯ͭi̟ͨṉ̒g͚͂ t͍̆e̮͛s͌͡ ҉̝t̪͐i̠̒ṋ̔g̒́ ҉̗ ̬̐t͉ͯe͕̒s͇͂t͈͊ị̇n̘ͤg͔ͣ ͕̓t̖̑e̻̊s͈̑t̤̂i͍̓n̜̿g̻͋ ̥̊t̛͌ ҉ͅe̪ͫs̲͂t̤̒ï̪n̥̐g̖͛ ͚͛t͇ͩẽ͇s̻̑t͇̚ȋ̞n̩̋g͔ͫ ͉̓t̙̽e̮ͭs͉͋t̃ͫ ҉̯i̻̊n͇ͪg̦ͩ ͈̉ṭ̈e̠͆s̤̑t̨ͮ ҉ͅī͙n̴͛ ҉͖g̹͗ t̰̓e̟̿ṡ̶ ҉͇t̠ͯĭ͉n͙̈ǵ̺ ͕ͨt͔̿ȅ͉s͎ͪt̬̎ï̺n̬̔g̫ͤ ̙̚t̨̆ ҉͙e̠͊s̤̎t̫ͤi͎ͦn͍̓g̩ͨ ̓̆ ҉̹tͫ̀ ҉͚ě̼s͇̊ṱ̈i̤̋n̗ͨg̫̈ ̪ͦṱ̏ė̞s͓ͧt̥ͧǐ̬n̘͗g̪ͤ ̓ͧ ҉̬t̠͆e̘̽s̟̚t̼̚i̟̋n̜̉g̠ͮ ́ͅt̡́ ҉͙eͯ͝ ҉̰s̜ͭt͙͌i̤̓n͓͆gͧ͞ ҉̟ t̯̆e͗͡ ҉͍s̨̽ ҉̗t̰ͭiͥ͂ ҉̻ṇ̓g̩̔ ̡̈ ҉̭tͩ͌ ҉͘ ҉͙e̠̿s̭̚t̹͑i̴̊ ҉̜n̩͗g͚ͮ ͉̑t͚ͬȅͦ ҉̟s̘͐t͎̅i̫̍ṉ̄g̼ͭ ̰ͥt̖̔e͌ͯ ҉ ҉̩s̙ͣt͕̆i̷ͭ ҉͓n̚͞ ҉͕g̲̎ ̘̾t̙͐ẻ̼s̃̎ ҉̶ ҉̪t̘̆i̲͂n̮̔g͓͌ ̣̋t̰̀e̜ͮș̽t̳ͤi̙̾n̞̏g͉͑ ̷̏ ҉̜t̥̒e͍̍s̻͒t̫ͭi̯̋ņͤ ҉̪g̳͐ t̼ͤe̗͗s̱ͦt̜̚ȋ̳n͚̄g͙ͫ ̭̚t͊͝ ҉̳e̞̽s͕̑ṯ̂i̳ͯn̹͋g̪ͭ ͓ͩt̰͒e̱ͤs̲͆t͎ͭi̞̔n̮ͦg͇ͥ ̞̂t̬ͪe̗ͨs̞ͪtͬ̔ ҉̖i̋̔ ҉̣n̛̎ ҉̟ǧ̬ ̭ͧt͖̃ě̞s̼̿ṫ̬i̽͢ ҉̼n͖̋ǧ͈ ̞ͧt̰̓e̯̐s̐͞ ҉͍t̮ͦí̘n̔̓ ҉͢ ҉̩g̥̽ ͖͛t̺̒e̜ͧṣ͋t̠ͭiͨ͝ ҉̯ň͇g͔̋ t̩̾e̥̔ŝ̰ṫ͢ ҉̰i̚ͅn̟͛g̸͊ ҉͖ ̯̚t̊ͦ ҉ ҉͇ě̥s̺̆t̰ͩi͊̆ ҉͙n̜ͫg͕ͪ ̭̌t̳̊e͕͂s̰͂t͇̒i̸̍ ҉̯n͎ͮg̝̒ ̫́t̆ͅe̒̀ ҉̞s̜ͫt̲ͬi̹͑n͙͛g̪ͨ ̡͗ ҉̱t̰ͮḛ́ś̝t̬̒i̘̽ṇͭg̤̍ ̟̊t͈ͬẹ̉s̠̃t̠ͥi̯̿ṋ̂g̭̏ ͖̋t̙͒e͒́ ҉̠s̪̋t͛͟ ҉ ҉̜ȉ̬n̒͝ ҉ͅg͓̽ t̘̀e̺ͦș̊t̓͢ ҉̀ ҉̘i͔̔n̞̏g͕ͥ ͖̂t͕͊ê̻ś͕ẗ͕i̞ͯn̹̐ǵ͛ ҉͚ ̥̈t̷͛ ҉͝ ҉͔e̘͗s̳͂t̬̔ỉ̜n̼͒g̼ͫ ̮̎ṱ̓e̤͆s̝͑t̺͛i͛͑ ҉͉n̲̂g͓̈ ̿ͅt̖̐e̤̅s̝̆ț́ĩ͍n͖̏g̠͛ ̞̒t̳ͮe͒̊ ҉̰ṣ́t̩̿î̘n̎̊ ҉̖g̯̓ ̳͂t̰͌e͊͡ ҉͓s̰̓t͍̆i̭͌n̻̎g̤̓ t̖ͩe̥ͥs̥ͧt̘̓i͋ͭ ҉̜n͚̆g̻̍ ̜́t͖̿ḛͪsͬ͗ ҉ͅẗ͚i̸̒ ҉͖n̚͟ ҉͜ ҉͕g͚ͤ ̳̔t̥̑ĕ͙s̱͆ẗ͇i̼ͤṇ͌g̭͛ ̝͊t͈ͧe̦̍s͍͛t̬͋í̸ ҉̖n͚͛g͉ͬ ̲̃t̰͂e̮̅s̎̀ ҉̫ṫ́ ҉ ҉̬i̘ͥṋ͋g̭͌ ͖̄ṭͭe̿̓ ҉͇ṣ̑t̯͗i̴͆ ҉͉n̯͂gͨͣ ҉ ҉̗ ͧ͠ ҉̩t̬̒ĕ͟ ҉̯s͑͜ ҉̜t̗̍į͌ ҉̮ṇ̔g͑ͅ t͙ͤe̳̔s̺ͤt̺̀î̝n̞̉g̭ͪ ̝͗t̠͂e͇̒s̤ͭt̼̉i̥ͨn̦̊g̻̉ ̳̿ẗ̞e̙̓s̴̎ ҉ ҉͈t̼̿i͔ͪn̲̊g̟̓ ̲̇t̔̆ ҉̜è͜ ҉̠s̆͋ ҉͢ ҉̤t́ͅi͇̍n̞͌g͕ͥ ̳̎t͙ͯe̙͐s̝ͫț̌i̎ͅn̞̎g̲̍ ̬̌t̥̚ḙ̀s̶͛ ҉̭t̼͛ï͚n͉͗g͍̍ ̟͂t̘̿ẻ̪s̥̑t̮ͣǐ̼n̻̋g͎ͫ t͈̅é̳s͚̓t͍̓i̥̋n̻͆ġ̐ ҉ ҉ͅ ̓̑ ҉̖t̥̒e̯ͬs͕͑t̹͒i̿͑ ҉̟n͔̓g̤ͤ ̝̓ẗ̗ȇ̦ș̎t̞͌i̟͌n̳ͨg̥͌ ̖͌t̤̀ĕ̪s̝̅ṱ̈iͩ͠ ҉̩n͍̎g͍ͤ ̣̾ẗ͙è̮š͘ ҉͙t͎̔i̘̓ñ̞g͖ͦ ͫ͢ ҉̯t̟̃e̮̎s͔ͯțͭi̭͌nͬ́ ҉͕g͓͒ ̭ͯt͈͐ě͠ ҉͚ṡ͞ ҉͎ṯ̆i̝ͬn̢̐ ҉͈ğ̳ t̻ͬe̠͆s̹̓t̘̽i̠ͭn͉̍g̒͞ ҉̮ ̬ͧtͨ͞ ҉̥e̮ͬs̗̃ṭ̊ǐ̬n̪ͫg̼͌ ̯̀t͇ͭẻ̞s̘ͫt̟ͩi̓ͅň̰g͌͝ ҉̜ ̤̅t͕̑e̍̅ ҉̳s̺̽t̋́ ҉ ҉͍i͓ͤn̎ͅg̦̽ ͕ͤț̿ẹ͌s̱̋t̮̚i̟ͣnͣͦ ҉͎ğ͚ ̴̌ ҉ͅt̯̉e̮͆s̲̆t͍͒i̳ͧn͎ͨg̲͆ ̰̐t̜͑ě͓s̚͢ ҉̻t̯ͣi̿ͅṅ̙g̳͗ t̪͆e̥͒ṣ͊t̤̍i͖̓n̖̽g̗̔ ̖̏ẗ̩e̝ͧs͉̑t̜͛i̼̒n͕̏g̱̍ ͈ͩt̜̍e͋͘ ҉̞s̹̉t͚́i̦̅ṅ̤g̖̚ ̴̅ ҉̠ṫ͚é̟ṡ̘ṱ̋i̽̀ ҉̺n̖̿g͂͢ ҉̖ ̱̊ṫ͇e̫͒s̖ͬt̡͆ ҉͇i̹̒n̤̑g̴̋ ҉̗ ̰̏t̰ͨḙ͗s̗̉t͔ͩi̜͊n̹ͯg̹̏ ͍ͬt̩̔e̯̍s͎̋t̟̊i͓̊ǹ̼g̭̓ t̮̍e͚̿s͎͆tͫͅi͓͐n̮͂g̞ͧ ̭̌ṯ̂ê̖s̼̏tͩͩ ҉̺ï̮n͍ͩḡ͔ ̪ͤtͣ͋ ҉̟e̩̍s̳͗tͣ͜ ҉̱i͎͑n̩ͬg̲ͨ ͎̔t͎̋e̙ͬs͎ͪt̠̉ĩ̳n̸̎ ҉̦g͇͋ ͕̓t̮̃ẻͅsͧ͝ ҉̥t̮̃i͉̐n̻̓g͎ͦ ͚̍t̯͛e̵͂ ҉̤s͑́ ҉ ҉̯t̲̂i͕ͩň̤g̈ͩ ҉̰ ͇̈t̜͊e͖̿s̗̽t̹͗î̷ ҉̩n̘̋g̰ͧ ț̾ẻ͇s̢ͧ ҉̻ţͬ ҉͙i̼̓n͙̍g̗̒ ̱͛t͙̓e̪ͮs̪̽tͨͅi͕ͣn̗̐g̭ͬ ̯ͭt͙̎è̤s͑ͅt̟͗i̬ͪn̩̔ḡ͍ ̝̊ẗ̬e̩̎sͦ͆ ҉̞t̬͒i͒ͅn̉͜ ҉̟ḡ̫ ͓̈t͚͗e̦̿ș̂t͙͊i͂͝ ҉̮n͙ͯg͙ͯ ̰͆t̥͛ē̩s̠̈t̯͂ï͎n̲̂g̬̈ ̥͒t͙̃ḛͤs̫̅t̯͐i̻ͬn̼ͦg̺̉ t̻ͨe͕ͩs͓̾t̼̊í̦n͎̓g̡͑ ҉̥ ͔̌t͙̓e͇ͨs͈͛t̫̑ị͋n̤̎g̹ͪ ̗͌ṭ̊e̺͛š̬t͓ͯi̝͋n̷͆ ҉̼g̥̿ ̦ͨt̞̋e̲̐s̥̚t̠ͩi̼ͥn̖̈g̫̐ ̣̿t̘ͧe̲̓s͉̃t͕ͫi͓̅n̻ͬg͎͛ ̜ͬt̳ͩĕ̻s̥̋t̢ͨ ҉̫i̟̓n̪͛g̥̓ ̯̅t͈͛e͓͌s̝͐ţͦ ҉̹i̯̔ň͢ ҉̰g̳ͤ t̳ͯe̪̒s̳̍t̻̋i̞̔n̞̏ğ̹ ̙́t̺ͥe̹ͣs̩̽t͈́i̺ͨn͉͂g̭̈ ̃̐ ҉̷ ҉̰t̪ͬe̹͆s̤̎t͎͗ĩ̯ṅ̸ ҉͔g̏ͅ ̪ͥt̞ͭe̥̊s͈̅ẗ̝i̯͐ǹ̪g̠̎ ̼̉t̳̄ệs̬̏t͕͆ï͙ñ͎g̸̽ ҉͚ ̥̅t̞͗e͔͌s̬ͧt͕ͧĩ͙n̺ͥg̗̀ ̖́t̥ͫe̛ͪ ҉̰s̷ͮ ҉͓ẗ̲i̛̎ ҉̥nͣͅg͊͒ ҉̳ t͍̒e̹ͪș͊ṯͤi̎̈ ҉̨ ҉̖ṋͨg̥̽ ͇ͮt͇͐e̳̓ṡ̟t͚͋iͮ̐ ҉̘n͇͆g̣ͪ ̗̌t̻ͭeͤͅs̭͊t̍̀ ҉ ҉̬i̻̎n͇͒g͕ͭ ̦ͫt̯ͩe͖̍sͯ͝ ҉̳t̡̓ ҉̼í̺n̸ͤ ҉͍g̦ͮ ̗ͣṭ̈ȇ̤s̘̓t͒͠ ҉̲i̗ͩn̼̈g̝͛ ̖ͩt̼͐ȇ̖s̤̉t̗̚i̱ͣṋ̊g̳̿ ͇̚t͖̑e̮͊ś͇t̞̋ị̅n̹̎g̱͒colors.js is having the same issue..
Reproduction Steps
What did you expect to happen?
cdk help...any sane/normal output.
What actually happened?
Insane output.
CDK CLI Version
2.4.0
Framework Version
No response
Node.js Version
16.3.0
OS
Arch Linux x86_64 (up to date)
Language
Typescript
Language Version
No response
Other information
No response
The text was updated successfully, but these errors were encountered: