NPM security warnings on fresh install

justjim1220 · Oct 30, 2018, 1:32 AM

I did a fresh install of Ubuntu 18.04 to dual boot with Windows 7 then added MM and didn’t get any warnings and this was about a week after MM 2.5.0 came out.

When I did the fresh install of MM on a Windows PC, I got the warnings, Always have, but I have always done the ‘npm audit fix’ and they were fixed. Or, at least most of them, some required manual fix.

I have always had those warnings, even get them quite often when installing modules with certain types of dependencies.

but, with Ubuntu, I never had the warnings.

awsoo · Nov 2, 2018, 4:32 PM

@macko76 Did you have resolved all NPM issues on Linux?
I’m using Raspbian Jessie Lite on RP3 and getting the same issues which I could get fixed with npm audit fix and manual fix but I can not start the Magic Mirror.

lavolp3 · Nov 2, 2018, 7:29 PM

@macko76 I have gotten the same problems just today, however not with a really fresh install.

You COULD do an

npm audit

and see the audit report.
You will find in the report what to do to resolve a number of issues. Look into the headers of the tables

Also,

npm audit fix

should resolve some of these.

HOWEVER!!!, one major issue for example (spectron) is a dependency of electron, and I wouldn’t recommend touching these without being clear about the risk that you could destroy your running system.
So make a backup and be careful!
I resolved nearly all issues and it’s still running but for obvious reasons I can’t recommend…

lavolp3 · Nov 2, 2018, 7:29 PM

@awsoo But you know that you cannot run the MagicMirror on a Raspbian Lite System per se?
You need the x server and a desktop environment.

awsoo · Nov 2, 2018, 9:24 PM

@lavolp3 thank you for your suggestion. I’ve used the npm audit and fix: https://forum.magicmirror.builders/topic/9015/outdated-npm-packages-occur-several-vulnerabilities

awsoo · Nov 2, 2018, 9:29 PM

@lavolp3 No, I didn’t know it :D Really?
Why do I need a desktop environment? Is it possible that this is the reason why I coulnd’t get electron to work?
Okay, as I see there is a tutorial how to install it on Jessie Lite :)
I will try it tomorrow.

awsoo · Nov 2, 2018, 10:08 PM

Ok, works after installing desktop environment :D o_O
Thank you!