es5-ext VS vue-cli

Don't tell me he's a victim of the regime, when other library authors add banners about the war in Ukraine he does not like it https://github.com/medikoo/es5-ext/issues/116 https://github.com/mdn/content/pull/18946 and like the comments about Poland becoming “Russia Poland People's Republic” doesn't look like a victim https://github.com/medikoo/es5-ext/issues/116#issuecomment-1066989820 https://monosnap.com/file/zZl6PrsxPTCtI0qx9XH6AZSb19eX6t and like comments about “Ukraine hit Donetsk with Tochka-U” https://github.com/medikoo/es5-ext/issues/116#issuecomment-1068768522 https://monosnap.com/file/bczy9oIIMSKz48P6K4MlkttrJ5jo5C

P.S. if you open the file in a text editor, you can see the soyness in all it's glory. It's this little bitch, BTW

It's a false positive, it's just - https://github.com/medikoo/es5-ext

The popular npm package es5-shim checks location on install and logs a Russian call for peace for Russian users.

Kaspersky (Russian AV) flags this file as a virus.

https://github.com/medikoo/es5-ext/blob/main/_postinstall.js

I noticed Kaspersky on my mac deleted a file and I saw that file was from a lib used in a work project. I got curious and looked at the file and it included an anti-war message..... I can't tell if Kaspersky deleted it by mistake thinking it's malware or if Kaspersky is being nefarious. The message is in Japanese but it just says "a file has been deleted" and lists the path. This is the file it deleted https://github.com/medikoo/es5-ext/blob/main/_postinstall.js

Other projects adopted non-malicious approach, where they publish anti war manifests: https://github.com/medikoo/es5-ext/blob/main/_postinstall.js

Yet another manifest found in es5-ext: https://github.com/medikoo/es5-ext/issues/116

Immerse yourself in the official Vue CLI documentation for a deeper understanding.

Security would be a useful benefit/section to add to this post:

A.) If maintainers of your dependencies edited an existing version.

B.) If your dependencies did not pin their dependencies.

For instance, if you installed vue-cli in May of last year from NPM with --prefer-offline (basically the same as checking in your node_modules), you were fine. But because vue-cli doesn't pin its dependencies ("node-ipc"), installing fresh/online would create WITH-LOVE-FROM-AMERICA.txt on your desktop [1], which was at the very least a scare, but for some, very problematic.

[1] https://github.com/vuejs/vue-cli/issues/7054

Vue CLI documentation: https://cli.vuejs.org/

An interesting fact is that this dependency was used in vue-cli.

Vue CLI 3

Open issue for half a year https://github.com/vuejs/vue-cli/issues/7234

Vue CLI (command-line interface), which is used to install and create the main Vue framework libraries and third-party plugins.

Is there a reason you've used the old Vue CLI though, with webpack and babel?Imho you're missing a lot not using Vite... npm init vue@latest (create-vue) is the recommended way to scaffold a new Vue app, Vue CLI is in Maintenance Mode

The official Vue CLI UI is made with Vue + Apollo GraphQL. You'll know it when you run vue ui in your terminal. - https://github.com/vuejs/vue-cli/tree/dev/packages/%40vue/cli-ui

Both Vue.js and React have their own set of tools and libraries to help developers build and maintain their applications. Vue.js has Vue CLI and Nuxt.js, while React has Create React App and Next.js.