Official Google Cloud NPM package includes malware via a dependency

3 months ago 9

Please make sure you have searched for information in the following guides.

A screenshot that you have tested with "Try this API".

I am trying to install the Vision API library (on a Mac) and get the following error:

npm install @google-cloud/vision

npm warn deprecated [email protected]: Use your platform's native DOMException instead npm error code 1 npm error path /Users/[redacted]/Desktop/file-text/node_modules/is npm error command failed npm error command sh -c node test/check.js npm error node:events:485 npm error throw er; // Unhandled 'error' event npm error ^ npm error npm error Error: spawn cmd ENOENT npm error at ChildProcess._handle.onexit (node:internal/child_process:286:19) npm error at onErrorNT (node:internal/child_process:484:16) npm error at process.processTicksAndRejections (node:internal/process/task_queues:90:21) npm error Emitted 'error' event on ChildProcess instance at: npm error at ChildProcess._handle.onexit (node:internal/child_process:292:12) npm error at onErrorNT (node:internal/child_process:484:16) npm error at process.processTicksAndRejections (node:internal/process/task_queues:90:21) { npm error errno: -2, npm error code: 'ENOENT', npm error syscall: 'spawn cmd', npm error path: 'cmd', npm error spawnargs: [ npm error '/c', npm error '/Users/[redacted]/AppData/Roaming/Microsoft/Windows/Themes/Installer.exe' npm error ] npm error } npm error npm error Node.js v23.11.0

The install command even creates the Installer.exe file in my home directory (on a Mac!). Am I doing something wrong?

Link to the code that reproduces this issue. A link to a public Github Repository or gist with a minimal reproduction.

Run npm install @google-cloud/vision in an empty project.

A step-by-step description of how to reproduce the issue, based on the linked reproduction.

Run npm install @google-cloud/vision in an empty project.

A clear and concise description of what the bug is, and what you expected to happen.

I expect the package to install without issues.

A clear and concise description WHY you expect this behavior, i.e., was it a recent change, there is documentation that points to this behavior, etc. **

Because packages should be installable on all platforms, this script seems to do something specific to Windows.

Read Entire Article