Package appears to be compromised.

[christiansmith]

Do you want to request a feature or report a bug?

It appears the package is compromised. Bug is a severe understatement.

What is the current behavior?

When running npx oclif generate mynewcli the command outputs the following:

$ oclif generate mycli
LIBERTY LIBERTY LIBERTY
LIBERTY LIBERTY LIBERTY
LIBERTY LIBERTY LIBERTY
                                   !             H|H|H|H|H           H__________________________________             H|§|§|§|H           H|* * * * * *|---------------
------|             H|§|∞|§|H           H| * * * * * |---------------------|             H|§|§|§|H           H|* * * * * *|---------------------|             H|H|H|H|
H           H| * * * * * |---------------------|             H|H|H|H|H           H|---------------------------------|          ===============        H|--------------
-------------------|            /| _   _ |          H|---------------------------------|            (| O   O |)          H|---------------------------------|
   /|   U   |          H-----------------------------------             |  =/  |           H              _..._/            H              _|I/|_            H      __
_____/| H |/_______    H     /           / /          H    |          | | /         |  H    |          ||o||          |  H    |    |     ||o||     |    |  H    |    |
     ||o||     |    |  H   Carl Pilcher
 ̖ ̭  ̜ ̳  ̺  ̭  ̠ ̸   ͈ ̱ ̻    ̭ ̤     ̼   ̣ ̐ ҉͞ ̰   ̂ͩ̚  ̪ ̻ ͡  ͓ ͡  ̭ ̮   ̭ ̙ ̸ ͈  ̙  ͓  ̼  ̜  ̳  ̪ ̟ ̖ ͖
 ̹ ̽̾̍ ҉ ͇ ̲ ͘   ̜   ͌ ͖  ̮  ͓ ͈    ͙ ̬  ̦ ̜  ̘ ͉  ̳  ̳ ̺ ̱    ͙   ͠  ͙    ͔  ̖     ̖ ͔   ̳ ̰  ̢  ͖    ͅ
 ͍ ̱ ͇  ͓ ̯   ̰  ̲ ̹ ̗  ̣  ͉  ͓ ͍  ͔ ̫ ̄ͦ͌ ҉̨ ͓   ͐    ͟   ̰ ̤  ͓ ͎     ̣ ͈ ͚  ͇  ̻    ̖   ͚   ̓ͮ̒
   ̭ ̰ ͅ ̗ ̤ ͡  ̞   ̠   ̩ ̻   ̫ ̫ ̪   ͇ ̹ ͈ ̤  ̹ ̹  ̺   ͉ ͎ ̱ ̬  ̪ ͯ  ̦ ̠  ͯ̓ ͎ ̲  ͖ ͇ ͪͧ͐ ͚ ͢ ͉ ͚ ̜ ̬  ̥ ̩
    ̖  ̼  ̫ ̹    ̭ ͚ ̠ ̮  ͖  ͙       ͋ ̼   ̪ ͎ ̀ ͎   ̙  ͙  ̩ ̣  ̦   ̖   ̳ ͚ ̛    ͙  ͕  ̖
     ̠  ͜     ̺ ͇ ̫   ̻ ̂̅̄  ͚    ̢ ̗  ̰   ͔   ͇   ͉ ̥ ͈   ̀͗ ̬ ̟        ̙ ̩   ͔ ̫ ̱ ̫ ̙  ̫ ͙  ̫ ̮
  ͚      ̱ ̫    ͚ ̩ ͖  ̮     ̫  ̺ ̝ ̣ ̙   ̺   ̜ ̖ ̲   ͅ ̙ ̦  ͉      ̳     ̺ ̷  ̩ ͈ ̱
  ̞ ̺ ͠  ̘ ̠ ̦  ̺   ̯   ̝ ͎ ͫ ͙ ̺   ͓ ̖   ̱  ̖   ̰ ̯ ͅ      ̥ ̤ ͙       ̫  ̙   ̙  ͎ ̼   ̱ ͕
 ͆̋͗  ͓ ̯ ͖   ̐ͩ ̝ ̗  ͞   ͚ ͉   ̺      ̩ ̖   ͣͧ̉ ̯  ̨    ̜ ̟  ͕   ̠  ̞ ͨ̔ ҉̸̵̀  ̦ ̺  ̠ ̖  ̝  ̖ ̠  ̬ ̼  ̴ ͇
        ̤        ͠  ̻ ̩     ̹  ̥ ̭  ̛ ̺ ̦  ̬  ̱ ̬  ̗    ͈ ̳ ̣ ̼ ͖      ͉ ͙  ̬   ̩ ̠ ̺ ̩  ̫
  ͕   ͍ ̻ ̙ ̹  ̣  ̘   ̕ ͅ  ̼    ̗ ͙ ̬ ͩ ̩ ̗     ̩  ̴  ͙ ̬ ̩   ̱      ̻ ̘ ̛  ̺    ͉  ̰  ̱ ͓ ̼ ͉ ͕
 ͍   ̣      ̷  ̜ ͈ ͢  ̻ ̼ ͠     ͇ ͉ ̻     ̘     ̗ ͜ ͙    ͇ ͍   ͉  ̯ ̪  ̗  ͇   ̮  ̟ ̰  ͇ ͍  ̺
   ̞  ̬ ͎    ̣ ͚ ̺  ̼ ̙ ̪ ̷    ̜  ̪ ̼  ̯  ̅̀ ̹  ̮ ̥  ̲  ̞ ̭ ̶  ͙ ̸ ̼  ̵      ̰     ̲ ͉  ͔  ̞ ͖
 ̒ ͔ ̥ ̣ ͍  ̠   ̻ ̣  ̯  ͅ  ͍  ̗ ̜ ̣ ̣  ̭ ̟ ͕ ̷ ̮     ̦ ̃̀̈    ̝ ̲   ̬ ̭ ͙ ̡ ̮  ̝    ̼ ̿ ҉͝  ͚ ͅ  ̗  ͇ ̯ ̧ ͕ ͕
  ͕ ͐̓̈ ̯ ̤  ̱   ͎    ͇ ̬   ̀ ͔ ̦ ̠  ̭ ͮͨ  ͓ ̅̊ ̯ ̙ ̪ ̭       ͉ ̥ ̫ ̥ ̠  ͚   ̣  ͇    ̥  ͙ ͙ ̦ ͜ ̺
  ̝ ̻ ̻    ͍ ̰  ͓  ̦ ̳ ͈ ̩ ͘ ̗ ̖  ͕ ̥   ͙ ̬ ̳ ̭ ̬  ̦ ͉    ͔  ̧  ̹      ͇ ̯  ̸  ͚    ͔  ̯ ̩
   ̩  ̯   ̄ ҉̵   ̬ ̪  ͈ ͍ ̻ ̳ ̪  ̲ ̥ ͇ ͍ ̜    ̻  ͅ    ̪ ̤ ͧͦ  ͎  ̷  ͙  ͙  ͇    ͇ ̯ ̘ ͚ ̳  ̪ ̘
  ͚       ͅ  ̘    ͇    ̩  ҉ ̯    ̲  ̲   ̬   ͌   ͝    ̝ ̞  ̝ ̙ ̩     ͬ̆̅ ҉ ̟ ͈  ͙ ̮ ̝ ̆ ̞   ̘    ̻ ͚ ̮
  ̲ ̸   ͍ ̓ͥ ̼   ̮   ̤  ̺ ͚ ͍ ̲  ͎  ̙ ̗  ̭ ̲ ̬ ͂ͧͧ   ̪  ̣  ̛ ͕ ͘  ̹   ̢ ͅ ͅ ̪    ̮ ̩  ͖ ̮ ͅ  ̼ ̰ ̦ ̙  ̦ ͎
 ̠  ̗  ͇ ̪ ͓    ̈̊̉ ͔   ̦    ̱ ̬ ͠    ̳   ͚ ̒̌     ̜ ̥ ̯  ͎ ͅ  ̫ ̭  ͙ ͍ ̩   ̘  ͠  ͈ ̻ ̩  ͟    ̳ ͎
  ̩ ͇  ̪ ̹  ̼  ̰  ̪  ͅ     ̠ ͉ ̻  ͖    ̳ ͉   ͜ ҉ ̳  ͖ ̠ ̘     ̻ ̮ ̙ ̗ ̘ ̰   ͕ ͚ ̞  ͍       ͅ ̙

This gibberish continues to output indefinitely until Ctrl-C.

What is the expected behavior?

The command should generate a new project as advertised.

My oclif version is oclif/2.1.0 darwin-arm64 node-v16.13.1 and my OS is MacOS Big Sur 11.5.2.

[christiansmith]

Additional context, this does appear to be an issue with oclif as opposed to npx, because I am able to run e.g., npx create-react-app ... successfully.

[christiansmith]

Appears to be related to Marak/colors.js#285

[mdonnalley]

@christiansmith Thanks for bringing this to our attention

I added a resolutions section to our package.json to force colors to resolve to 1.4.0 - however, that unfortunately won't have any affect on npm installs.

I could update our release process to generate a shrinkwrap - but given that it's a Saturday and the bug doesn't appear to be malicious I'd rather wait on that for now. Hopefully the bug gets fixed or they point latest to a working version before then

In the meantime, you can install oclif using yarn:

yarn global add oclif

[christiansmith]

Thanks for the quick response. Nothing urgent for me. Just Saturday morning tinkering :)

I'll try the package again once the issue is resolved.

[mii9000]

@christiansmith Thanks for bringing this to our attention

I added a resolutions section to our package.json to force colors to resolve to 1.4.0 - however, that unfortunately won't have any affect on npm installs.

I could update our release process to generate a shrinkwrap - but given that it's a Saturday and the bug doesn't appear to be malicious I'd rather wait on that for now. Hopefully the bug gets fixed or they point latest to a working version before then

In the meantime, you can install oclif using yarn:

yarn global add oclif

adding with yarn did not work for me
what other alternative is there?
i was in the midst of making changes to my cli program

[rsadr0pyz]

npx marak-free

[ghost]

@mii9000 I managed to have it working temporally with the following steps:

• clone the repo
• install deps and build the project
• go to lib dir and link it using npm link cmd

After that the oclif cli will be available globally in your shell.

The dist version should be fixed soon, as @mdonnalley mentioned. I can confirm for now that everything is working fine locally.

I use yarn as package manager, btw

[mdonnalley]

I just released v2.1.3 which upgraded all the dependencies that use(d) colors. Fortunately the maintainers of our dependencies jumped on the issue quickly and already pinned colors to a working version or migrated to a different library entirely.

Both npm and yarn installs of oclif should now be free of the colors "bug" but I'll leave this issue open for now in case anyone sill runs into it

[mhvelplund]

Maybe this is the issue https://developers.slashdot.org/story/22/01/09/2336239/open-source-developer-intentionally-corrupts-his-own-widely-used-libraries ?

[smyja]

Maybe this is the issue https://developers.slashdot.org/story/22/01/09/2336239/open-source-developer-intentionally-corrupts-his-own-widely-used-libraries ?

It is.