Threat detected: Coinminer.JS.MALb (flatmap-stream)

[jpmnteiro]

Current behavior:

Unable to extract cypress because a dependency (flatmap-stream) is compromised.

Desired behavior:

To be able to extract cypress without errors from an AV software.

Steps to reproduce:

Pre-requisites: have an anti-virus software (TrendMicro in my case)

1. Download the archive from the endpoint supplied below
2. Extract the contents
3. Extraction process is halted because a threat is detected.

Problematic file:

.\Cypress\resources\app\packages\server\node_modules\flatmap-stream\test\data.js

flatmap-stream has been removed from npm

Versions

Latest version, downloaded from https://cdn.cypress.io/desktop/3.1.2/win64/cypress.zip

Further information

Looking at the package-lock.json in .\Cypress\resources\app\packages\server\, it seems like flatmap-stream is being pulled, indirectly, by nodemon

• nodemon@1.18.6 (seems like the issue's been fixed)
  • pstree.remy@1.1.0
    • ps-tree@1.1.0
      • event-stream@3.3.0
        • flatmap-stream@0.1.0

[paul-sachs]

There also seems to be an issue in the dev dependencies for cypress:

npm ls event-stream flatmap-stream

• @cypress/npm-run-all@4.0.4
  • ps-tree@1.1.0
    • event-stream@3.3.6
      • flatmap-stream@0.1.2

It's less of a concern due to it being a dev dep, but still alarming. I tried looking into npm-run-all but the cypress fork has not been updated in a while. The original package no longer depends on ps-tree.

[jpmnteiro]

Interesting, nodemon is also a dev dependency on the server.

Why would the production package on the CDN contain the development dependencies?

[jpmnteiro]

Still no word official word about this? (cc @chrisbreiding)

[jennifer-shehane]

Thanks for opening this issue. I do indeed see that pstree.remy is being installed at version 1.1.0 which has the vulnerability. I've notified our server team.

[chrisbreiding]

We've updgraded the necessary dependencies to either remove event-stream or lock it at 3.3.4, removing flatmap-stream from the dependency chain. This will be released in the next version of Cypress.

[jpmnteiro]

@chrisbreiding Do you have a release date?

[chrisbreiding]

Can't promise a date, but if not today, then certainly sometime this week.

We're still looking into why a dev dependency made it into the production binary, as that should not happen. Seems that it only happens with the windows binary and it's only nodemon, no other dev dependencies. On second look, it appears to have all the dev dependencies, at least from packages/server.

[bahmutov]

Let me open a new issue about devDependencies present in the built Windows binary

[brian-mann]

Released in 3.1.4.