我在下面有这个错误，但我的项目上没有这个包。其他人也遇到了同样的错误吗？该项目在我的本地env上正确编译和运行，只有当我将代码上传到heroku服务器时才会出现此错误。昨天我也犯了同样的错误event-stream@3.3.6但我删除了nodemodule文件夹，删除了package-lock.json并运行了npm安装，一切都正常了。
npm ERR！404未找到：flatmap-stream@0.1.1
{
"name": "myproj",
"version": "0.0.0",
"scripts": {
"ng": "ng",
"build": "ng build",
"start": "node server.js",
"test": "ng test",
"lint": "ng lint",
"e2e": "ng e2e",
"postinstall": "ng build --aot --prod"
},
"private": true,
"dependencies": {
"@agm/core": "^1.0.0-beta.5",
"@agm/js-marker-clusterer": "^1.0.0-beta.5",
"@agm/snazzy-info-window": "^1.0.0-beta.5",
"@angular/animations": "^6.1.0",
"@angular/cli": "^7.0.5",
"@angular/common": "^6.1.0",
"@angular/compiler": "^6.1.0",
"@angular/compiler-cli": "^6.1.0",
"@angular/core": "^6.1.0",
"@angular/elements": "^6.1.10",
"@angular/forms": "^6.1.0",
"@angular/http": "^6.1.0",
"@angular/platform-browser": "^6.1.0",
"@angular/platform-browser-dynamic": "^6.1.0",
"@angular/router": "^6.1.0",
"@asymmetrik/ngx-leaflet": "^4.0.0",
"@asymmetrik/ngx-leaflet-markercluster": "^1.0.0",
"@auth0/angular-jwt": "^2.0.0",
"@fortawesome/fontawesome-free": "^5.5.0",
"@hackages/ngxerrors": "^6.0.3",
"@ng-bootstrap/ng-bootstrap": "^3.3.1",
"@ngx-translate/core": "^11.0.0",
"@ngx-translate/http-loader": "^4.0.0",
"@types/leaflet": "^1.2.13",
"@types/leaflet.markercluster": "^1.0.3",
"@ultimate/ngxerrors": "^1.4.0",
"@webcomponents/custom-elements": "^1.2.1",
"bootstrap": "^4.1.3",
"core-js": "^2.5.4",
"document-register-element": "^1.7.2",
"express": "^4.16.4",
"hammerjs": "^2.0.8",
"js-marker-clusterer": "^1.0.0",
"jwt-decode": "^2.2.0",
"leaflet": "^1.3.4",
"leaflet.markercluster": "^1.4.1",
"ng4-loading-spinner": "^1.2.3",
"ngx-toastr": "^9.1.1",
"ngx-toggle": "^2.0.1",
"ngx-ui-switch": "^8.0.0-beta.0",
"rxjs": "^6.2.2",
"save": "^2.3.2",
"snazzy-info-window": "^1.1.1",
"zone.js": "~0.8.26"
},
"devDependencies": {
"@angular-devkit/build-angular": "~0.8.0",
"@angular/cli": "^7.0.5",
"@angular/compiler-cli": "^6.1.0",
"@angular/language-service": "^6.1.0",
"@types/jasmine": "~2.8.8",
"@types/jasminewd2": "~2.0.3",
"@types/node": "~8.9.4",
"codelyzer": "~4.3.0",
"jasmine-core": "~2.99.1",
"jasmine-spec-reporter": "~4.2.1",
"karma": "~3.0.0",
"karma-chrome-launcher": "~2.2.0",
"karma-coverage-istanbul-reporter": "~2.0.1",
"karma-jasmine": "~1.1.2",
"karma-jasmine-html-reporter": "^0.2.2",
"protractor": "~5.4.0",
"ts-node": "~7.0.0",
"tslint": "~5.11.0",
"typescript": "~2.9.2"
},
"engines": {
"node": "~8.12.0",
"npm": "~6.4.1"
}
}
您只需要从以下文件中删除以下代码行
- package.lock.json
===>"平面图流"："0.1.1">
和===>"平面图流"：{"版本"："0.1.1"，"已解决"："https://registry.npmjs.org/flatmap-stream/-/flatmap-stream-0.1.1.tgz"，"完整性"："sha512-lAq4tLb3sidmdCN8G3ExaxH7cUCtP5mgDvrYowsx84dcYkJJ4I28N7gkxA6+YlSXzaGLJYIDEi9WGfXzMiXdw=="}
基本上，node团队已经删除了那个模块，因为它有一些恶意代码。
这不是一个解决方案，而是警告
您不应该使用此软件包。这是一个恶意程序包，已作为依赖程序包添加到另一个名为event-stream的程序包中。flatmap-stream旨在窃取您的bitcoins或任何加密货币信息。看看这个。也检查一下这个。如前所述，你必须跳进去。
要继续工作，请遵循SuperUser Sudo解决方案。从.lock文件中删除程序包，然后重新安装。
如果其他答案不适用，请执行以下操作。
- 如果没有执行
yarn install，请检查是否仍有node_modules文件夹 - 执行
yarn audit - 你会发现正在尝试安装flatmap steam的模块
- 您必须用相关模块替换这些模块，或者升级这些模块的版本。在我的情况下，这是一种大口的有棱角的模板车
然后我建议您再次进行纱线安装。这个项目现在应该可行了。
注意：如果您使用的是私有存储库，npm audit可能不起作用，但yarn审计可以起作用。
要识别受攻击影响的包：
npm ls event-stream flatmap-stream
由于该包已删除，您需要更新依赖项或将其更改为另一个库。
在我的例子中是使用ps-tree的nodemon，它使用event-stream。我只需要更新nodemon，因为维护人员更新了源代码，现在它不再使用ps-tree。
我删除了node_modules和package-lock.json。然后运行以下命令解决问题
npm install