Prevent blowing up on audit malformed response by framp · Pull Request #42 · npm/cli

framp · 2018-08-08T16:23:33Z

npm is failing our builds with:

npm ERR! Cannot read property 'totalDependencies' of undefined

which it's coming out of auditing

There must be something wrong in whatever code is generating the response - this only prevents blowing up a valid installation because of this.

ljharb

More defensive programming in general would help use with things like artifactory, that may not meet the CLI’s implicit assumptions about data format.

zkat

This seems fine, but I'd like to have a warning if metadata is missing like this. There's definitely a bug in our services somewhere if that happens (or in npm-audit-report, so I'd like to make sure we don't just hide the problem.

zkat · 2018-08-13T21:29:29Z

 if (updated) actions.push('updated ' + packages(updated))
 if (moved) actions.push('moved ' + packages(moved))
- if (auditResult && auditResult.metadata.totalDependencies) {
+ if (auditResult && auditResult.metadata && auditResult.metadata.totalDependencies) {


If this is missing, there's definitely an issue with the endpoint. I'd rather spit out a warning here if this happens, so we can make sure to track it down. In the future, it might also be good to have npm-audit-report verify the data we get from the server and warn accordingly, and we can remove the warning from lib/install.js at that point.

There could also be a bug in a non-npm registry - like artifactory - if they implemented audit support but did it incorrectly?

yes, the intention is also to cover non-npm registries, but I didn't think this was necessarily an artifactory issue. If so, then yeah, they should fix their stuff.

framp · 2018-08-14T15:21:46Z

I added a warn using npmlog - hope I didn't miss some internal conventions

zkat

👍 LGTM

I poked at it a little, but this works :)

zkat

Everything looks awesome. Thank you!

@framp

PR-URL: #42 Credit: @framp Reviewed-By: @zkat

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

npm#42)

…writes fix: atomic credential file writes to prevent corruption on crash (fixesnpm#42)

framp · 2018-08-08T16:23:33Z

npm is failing our builds with:

npm ERR! Cannot read property 'totalDependencies' of undefined

which it's coming out of auditing

There must be something wrong in whatever code is generating the response - this only prevents blowing up a valid installation because of this.

ljharb

More defensive programming in general would help use with things like artifactory, that may not meet the CLI’s implicit assumptions about data format.

zkat

This seems fine, but I'd like to have a warning if metadata is missing like this. There's definitely a bug in our services somewhere if that happens (or in npm-audit-report, so I'd like to make sure we don't just hide the problem.

zkat · 2018-08-13T21:29:29Z

 if (updated) actions.push('updated ' + packages(updated))
 if (moved) actions.push('moved ' + packages(moved))
- if (auditResult && auditResult.metadata.totalDependencies) {
+ if (auditResult && auditResult.metadata && auditResult.metadata.totalDependencies) {


If this is missing, there's definitely an issue with the endpoint. I'd rather spit out a warning here if this happens, so we can make sure to track it down. In the future, it might also be good to have npm-audit-report verify the data we get from the server and warn accordingly, and we can remove the warning from lib/install.js at that point.

There could also be a bug in a non-npm registry - like artifactory - if they implemented audit support but did it incorrectly?

yes, the intention is also to cover non-npm registries, but I didn't think this was necessarily an artifactory issue. If so, then yeah, they should fix their stuff.

framp · 2018-08-14T15:21:46Z

I added a warn using npmlog - hope I didn't miss some internal conventions

zkat

👍 LGTM

I poked at it a little, but this works :)

zkat

Everything looks awesome. Thank you!

@framp

PR-URL: #42 Credit: @framp Reviewed-By: @zkat

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

npm#42)

…writes fix: atomic credential file writes to prevent corruption on crash (fixesnpm#42)

framp · 2018-08-08T16:23:33Z

npm is failing our builds with:

npm ERR! Cannot read property 'totalDependencies' of undefined

which it's coming out of auditing

There must be something wrong in whatever code is generating the response - this only prevents blowing up a valid installation because of this.

ljharb

More defensive programming in general would help use with things like artifactory, that may not meet the CLI’s implicit assumptions about data format.

zkat

This seems fine, but I'd like to have a warning if metadata is missing like this. There's definitely a bug in our services somewhere if that happens (or in npm-audit-report, so I'd like to make sure we don't just hide the problem.

zkat · 2018-08-13T21:29:29Z

 if (updated) actions.push('updated ' + packages(updated))
 if (moved) actions.push('moved ' + packages(moved))
- if (auditResult && auditResult.metadata.totalDependencies) {
+ if (auditResult && auditResult.metadata && auditResult.metadata.totalDependencies) {


If this is missing, there's definitely an issue with the endpoint. I'd rather spit out a warning here if this happens, so we can make sure to track it down. In the future, it might also be good to have npm-audit-report verify the data we get from the server and warn accordingly, and we can remove the warning from lib/install.js at that point.

There could also be a bug in a non-npm registry - like artifactory - if they implemented audit support but did it incorrectly?

yes, the intention is also to cover non-npm registries, but I didn't think this was necessarily an artifactory issue. If so, then yeah, they should fix their stuff.

framp · 2018-08-14T15:21:46Z

I added a warn using npmlog - hope I didn't miss some internal conventions

zkat

👍 LGTM

I poked at it a little, but this works :)

zkat

Everything looks awesome. Thank you!

@framp

PR-URL: #42 Credit: @framp Reviewed-By: @zkat

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

npm#42)

…writes fix: atomic credential file writes to prevent corruption on crash (fixesnpm#42)

framp · 2018-08-08T16:23:33Z

npm is failing our builds with:

npm ERR! Cannot read property 'totalDependencies' of undefined

which it's coming out of auditing

There must be something wrong in whatever code is generating the response - this only prevents blowing up a valid installation because of this.

ljharb

More defensive programming in general would help use with things like artifactory, that may not meet the CLI’s implicit assumptions about data format.

zkat

This seems fine, but I'd like to have a warning if metadata is missing like this. There's definitely a bug in our services somewhere if that happens (or in npm-audit-report, so I'd like to make sure we don't just hide the problem.

zkat · 2018-08-13T21:29:29Z

 if (updated) actions.push('updated ' + packages(updated))
 if (moved) actions.push('moved ' + packages(moved))
- if (auditResult && auditResult.metadata.totalDependencies) {
+ if (auditResult && auditResult.metadata && auditResult.metadata.totalDependencies) {


If this is missing, there's definitely an issue with the endpoint. I'd rather spit out a warning here if this happens, so we can make sure to track it down. In the future, it might also be good to have npm-audit-report verify the data we get from the server and warn accordingly, and we can remove the warning from lib/install.js at that point.

There could also be a bug in a non-npm registry - like artifactory - if they implemented audit support but did it incorrectly?

yes, the intention is also to cover non-npm registries, but I didn't think this was necessarily an artifactory issue. If so, then yeah, they should fix their stuff.

framp · 2018-08-14T15:21:46Z

I added a warn using npmlog - hope I didn't miss some internal conventions

zkat

👍 LGTM

I poked at it a little, but this works :)

zkat

Everything looks awesome. Thank you!

@framp

PR-URL: #42 Credit: @framp Reviewed-By: @zkat

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

npm#42)

…writes fix: atomic credential file writes to prevent corruption on crash (fixesnpm#42)

framp · 2018-08-08T16:23:33Z

npm is failing our builds with:

npm ERR! Cannot read property 'totalDependencies' of undefined

which it's coming out of auditing

There must be something wrong in whatever code is generating the response - this only prevents blowing up a valid installation because of this.

ljharb

More defensive programming in general would help use with things like artifactory, that may not meet the CLI’s implicit assumptions about data format.

zkat

This seems fine, but I'd like to have a warning if metadata is missing like this. There's definitely a bug in our services somewhere if that happens (or in npm-audit-report, so I'd like to make sure we don't just hide the problem.

zkat · 2018-08-13T21:29:29Z

 if (updated) actions.push('updated ' + packages(updated))
 if (moved) actions.push('moved ' + packages(moved))
- if (auditResult && auditResult.metadata.totalDependencies) {
+ if (auditResult && auditResult.metadata && auditResult.metadata.totalDependencies) {


If this is missing, there's definitely an issue with the endpoint. I'd rather spit out a warning here if this happens, so we can make sure to track it down. In the future, it might also be good to have npm-audit-report verify the data we get from the server and warn accordingly, and we can remove the warning from lib/install.js at that point.

There could also be a bug in a non-npm registry - like artifactory - if they implemented audit support but did it incorrectly?

yes, the intention is also to cover non-npm registries, but I didn't think this was necessarily an artifactory issue. If so, then yeah, they should fix their stuff.

framp · 2018-08-14T15:21:46Z

I added a warn using npmlog - hope I didn't miss some internal conventions

zkat

👍 LGTM

I poked at it a little, but this works :)

zkat

Everything looks awesome. Thank you!

@framp

PR-URL: #42 Credit: @framp Reviewed-By: @zkat

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

npm#42)

…writes fix: atomic credential file writes to prevent corruption on crash (fixesnpm#42)

framp · 2018-08-08T16:23:33Z

npm is failing our builds with:

npm ERR! Cannot read property 'totalDependencies' of undefined

which it's coming out of auditing

There must be something wrong in whatever code is generating the response - this only prevents blowing up a valid installation because of this.

ljharb

More defensive programming in general would help use with things like artifactory, that may not meet the CLI’s implicit assumptions about data format.

zkat

This seems fine, but I'd like to have a warning if metadata is missing like this. There's definitely a bug in our services somewhere if that happens (or in npm-audit-report, so I'd like to make sure we don't just hide the problem.

zkat · 2018-08-13T21:29:29Z

 if (updated) actions.push('updated ' + packages(updated))
 if (moved) actions.push('moved ' + packages(moved))
- if (auditResult && auditResult.metadata.totalDependencies) {
+ if (auditResult && auditResult.metadata && auditResult.metadata.totalDependencies) {


If this is missing, there's definitely an issue with the endpoint. I'd rather spit out a warning here if this happens, so we can make sure to track it down. In the future, it might also be good to have npm-audit-report verify the data we get from the server and warn accordingly, and we can remove the warning from lib/install.js at that point.

There could also be a bug in a non-npm registry - like artifactory - if they implemented audit support but did it incorrectly?

yes, the intention is also to cover non-npm registries, but I didn't think this was necessarily an artifactory issue. If so, then yeah, they should fix their stuff.

framp · 2018-08-14T15:21:46Z

I added a warn using npmlog - hope I didn't miss some internal conventions

zkat

👍 LGTM

I poked at it a little, but this works :)

zkat

Everything looks awesome. Thank you!

@framp

PR-URL: #42 Credit: @framp Reviewed-By: @zkat

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

npm#42)

…writes fix: atomic credential file writes to prevent corruption on crash (fixesnpm#42)

framp · 2018-08-08T16:23:33Z

npm is failing our builds with:

npm ERR! Cannot read property 'totalDependencies' of undefined

which it's coming out of auditing

There must be something wrong in whatever code is generating the response - this only prevents blowing up a valid installation because of this.

ljharb

More defensive programming in general would help use with things like artifactory, that may not meet the CLI’s implicit assumptions about data format.

zkat

This seems fine, but I'd like to have a warning if metadata is missing like this. There's definitely a bug in our services somewhere if that happens (or in npm-audit-report, so I'd like to make sure we don't just hide the problem.

zkat · 2018-08-13T21:29:29Z

 if (updated) actions.push('updated ' + packages(updated))
 if (moved) actions.push('moved ' + packages(moved))
- if (auditResult && auditResult.metadata.totalDependencies) {
+ if (auditResult && auditResult.metadata && auditResult.metadata.totalDependencies) {


If this is missing, there's definitely an issue with the endpoint. I'd rather spit out a warning here if this happens, so we can make sure to track it down. In the future, it might also be good to have npm-audit-report verify the data we get from the server and warn accordingly, and we can remove the warning from lib/install.js at that point.

There could also be a bug in a non-npm registry - like artifactory - if they implemented audit support but did it incorrectly?

yes, the intention is also to cover non-npm registries, but I didn't think this was necessarily an artifactory issue. If so, then yeah, they should fix their stuff.

framp · 2018-08-14T15:21:46Z

I added a warn using npmlog - hope I didn't miss some internal conventions

zkat

👍 LGTM

I poked at it a little, but this works :)

zkat

Everything looks awesome. Thank you!

@framp

PR-URL: #42 Credit: @framp Reviewed-By: @zkat

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

npm#42)

…writes fix: atomic credential file writes to prevent corruption on crash (fixesnpm#42)

framp · 2018-08-08T16:23:33Z

npm is failing our builds with:

npm ERR! Cannot read property 'totalDependencies' of undefined

which it's coming out of auditing

There must be something wrong in whatever code is generating the response - this only prevents blowing up a valid installation because of this.

ljharb

More defensive programming in general would help use with things like artifactory, that may not meet the CLI’s implicit assumptions about data format.

zkat

This seems fine, but I'd like to have a warning if metadata is missing like this. There's definitely a bug in our services somewhere if that happens (or in npm-audit-report, so I'd like to make sure we don't just hide the problem.

zkat · 2018-08-13T21:29:29Z

 if (updated) actions.push('updated ' + packages(updated))
 if (moved) actions.push('moved ' + packages(moved))
- if (auditResult && auditResult.metadata.totalDependencies) {
+ if (auditResult && auditResult.metadata && auditResult.metadata.totalDependencies) {


If this is missing, there's definitely an issue with the endpoint. I'd rather spit out a warning here if this happens, so we can make sure to track it down. In the future, it might also be good to have npm-audit-report verify the data we get from the server and warn accordingly, and we can remove the warning from lib/install.js at that point.

There could also be a bug in a non-npm registry - like artifactory - if they implemented audit support but did it incorrectly?

yes, the intention is also to cover non-npm registries, but I didn't think this was necessarily an artifactory issue. If so, then yeah, they should fix their stuff.

framp · 2018-08-14T15:21:46Z

I added a warn using npmlog - hope I didn't miss some internal conventions

zkat

👍 LGTM

I poked at it a little, but this works :)

zkat

Everything looks awesome. Thank you!

@framp

PR-URL: #42 Credit: @framp Reviewed-By: @zkat

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

npm#42)

…writes fix: atomic credential file writes to prevent corruption on crash (fixesnpm#42)

Prevent blowing up on audit malformed response
55e0237

framp requested a review from a team as a code owner August 8, 2018 16:23

ljharb approved these changes Aug 8, 2018
View reviewed changes

zkat added semver:patch semver patch level for changes security labels Aug 9, 2018

zkat suggested changes Aug 13, 2018
View reviewed changes

zkat removed the needs-discussion label Aug 13, 2018

Add warn when audit result doesn't have metadata
c8a4aa7

tweak message
c52b013

zkat approved these changes Aug 14, 2018
View reviewed changes

Join ifs handling audit metadata
0f80d72

zkat changed the base branch from latest to release-nextAugust 20, 2018 22:28

zkat approved these changes Aug 20, 2018
View reviewed changes

zkat merged commit 8d1b322 into npm:release-nextAug 20, 2018

zkat pushed a commit that referenced this pull request Aug 20, 2018
install: Prevent blowing up on audit malformed response (#42)
4bd40f5
PR-URL: #42 Credit: @framp Reviewed-By: @zkat

mattrussell-sonocent mentioned this pull request May 7, 2019
Error on npm install: Cannot read property 'totalDependencies' of undefined verdaccio/verdaccio#1304
Closed

varmakarthik12 mentioned this pull request Nov 30, 2023
[Snyk] Fix for 1 vulnerabilities varmakarthik12/cli#38
Closed

antongolub pushed a commit to antongolub-forks/npm-cli that referenced this pull request May 18, 2024
chore(main): release 3.0.1 (npm#42)
492a1be
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Jah-yee pushed a commit to Jah-yee/cli that referenced this pull request Apr 16, 2026
fix: atomic credential file writes to prevent corruption on crash (fixes
0603bce
npm#42)

Jah-yee pushed a commit to Jah-yee/cli that referenced this pull request Apr 16, 2026
Merge pull requestnpm#52from googleworkspace/fix/atomic-credential-…
77f0f04
…writes fix: atomic credential file writes to prevent corruption on crash (fixesnpm#42)

github-actionsBot referenced this pull request in Kevinlee7250/cli Jun 9, 2026
📊 대시보드 데이터 업데이트 (#42)
8c2d028

github-actionsBot referenced this pull request in Kevinlee7250/cli Jul 7, 2026
🔧 자동 수리 완료 (#42)
fa7ec2e

github-actionsBot referenced this pull request in Kevinlee7250/cli Jul 28, 2026
🔥 트렌드 선점 후보 갱신 (#42)
d940c98

github-actionsBot referenced this pull request in Kevinlee7250/cli Aug 21, 2026
🔍 구글 색인 상태 리포트 (#42)
d5eb78b

coderabbitaiBot mentioned this pull request Aug 23, 2026
fix: production-readiness pass — adapter parity, crash recovery, LLM fallback surfacing, config/store hardening fernandogarzaaa/experience-validation-engine#29
Merged
9 tasks