全局安装@vue/cli执行npm audit fix --force报错，安装是否异常？

问题描述 #

执行npm install -g @vue/cli后，终端显示变更851个包，检测出4个漏洞（2个中等、2个高危），提示执行npm audit fix --force修复。执行该命令后出现如下错误：

npm WARN using --force Recommended protections disabled.
npm ERR! code ENOLOCK
npm ERR! audit This command requires an existing lockfile.
npm ERR! audit Try creating one first with: npm i --package-lock-only
npm ERR! audit Original error: loadVirtual requires existing shrinkwrap file

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\Users\user\AppData\Local\npm-cache\_logs\2022-12-31T23_04_36_391Z-debug-0.log       

up to date, audited 1 package in 640ms

found 0 vulnerabilities

同时生成的日志文件内容如下：

0 verbose cli D:\nodejs\node.exe D:\nodejs\node_modules\npm\bin\npm-cli.js
1 info using npm@8.19.2
2 info using node@v18.12.1
3 timing npm:load:whichnode Completed in 1ms
4 timing config:load:defaults Completed in 3ms
5 timing config:load:file:D:\nodejs\node_modules\npm\npmrc Completed in 14ms
6 timing config:load:builtin Completed in 16ms
7 timing config:load:cli Completed in 3ms
8 timing config:load:env Completed in 1ms
9 timing config:load:file:D:\node-project\.npmrc Completed in 1ms
10 timing config:load:project Completed in 2ms
11 timing config:load:file:C:\Users\user\.npmrc Completed in 0ms
12 timing config:load:user Completed in 1ms
13 timing config:load:file:C:\Users\user\AppData\Roaming\npm\etc\npmrc Completed in 0ms
14 timing config:load:global Completed in 0ms
15 timing config:load:validate Completed in 0ms
16 timing config:load:credentials Completed in 1ms
17 timing config:load:setEnvs Completed in 2ms
18 timing config:load Completed in 31ms
19 timing npm:load:configload Completed in 31ms
20 timing npm:load:mkdirpcache Completed in 2ms
21 timing npm:load:mkdirplogs Completed in 1ms
22 verbose title npm audit fix
23 verbose argv "audit" "fix" "--force"
24 timing npm:load:setTitle Completed in 2ms
25 timing config:load:flatten Completed in 7ms
26 timing npm:load:display Completed in 11ms
27 verbose logfile logs-max:10 dir:C:\Users\user\AppData\Local\npm-cache\_logs
28 verbose logfile C:\Users\user\AppData\Local\npm-cache\_logs\2022-12-31T23_04_36_391Z-debug-0.log
29 timing npm:load:logFile Completed in 14ms
30 timing npm:load:timers Completed in 1ms
31 timing npm:load:configScope Completed in 0ms
32 warn using --force Recommended protections disabled.
33 timing npm:load Completed in 68ms
34 timing arborist:ctor Completed in 1ms
35 silly logfile start cleaning logs, removing 2 files
36 timing command:audit Completed in 29ms
37 verbose stack Error: loadVirtual requires existing shrinkwrap file
37 verbose stack     at Arborist.loadVirtual (D:\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\load-virtual.js:63:18)
37 verbose stack     at async Arborist.audit (D:\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\audit.js:25:18)
37 verbose stack     at async Audit.auditAdvisories (D:\nodejs\node_modules\npm\lib\commands\audit.js:390:5)
37 verbose stack     at async Audit.exec (D:\nodejs\node_modules\npm\lib\commands\audit.js:374:7)
37 verbose stack     at async module.exports (D:\nodejs\node_modules\npm\lib\cli.js:78:5)
38 verbose cwd D:\node-project
39 verbose Windows_NT 10.0.19044
40 verbose node v18.12.1
41 verbose npm  v8.19.2
42 error code ENOLOCK
43 error audit This command requires an existing lockfile.
44 error audit Try creating one first with: npm i --package-lock-only
45 error audit Original error: loadVirtual requires existing shrinkwrap file
46 verbose exit 1
47 timing npm Completed in 403ms
48 verbose unfinished npm timer audit 1672527876747
49 verbose code 1
50 error A complete log of this run can be found in:
50 error     C:\Users\user\AppData\Local\npm-cache\_logs\2022-12-31T23_04_36_391Z-debug-0.log

疑问：此次@vue/cli的安装是否属于正常情况？因出现大量ERR!信息，怀疑存在问题，请求协助解决。

问题分析 #

1. 安装本身正常：npm install -g @vue/cli显示变更851个包是正常现象——@vue/cli作为全局工具，依赖大量子包；检测出漏洞是npm的常规安全提示，不代表安装失败，仅说明依赖中存在已知安全风险。
2. 报错核心原因：执行npm audit fix --force时触发ENOLOCK错误，是因为当前操作目录（D:\node-project）没有生成package-lock.json或npm-shrinkwrap.json锁文件，而npm audit fix需要基于锁文件分析依赖树并执行修复。

解决步骤 #

针对全局@vue/cli的漏洞修复 #

全局安装的包需要使用全局参数执行审计和修复：

• 先执行全局依赖审计：

  npm audit -g
  

• 再执行全局漏洞修复：

  npm audit fix -g --force
  

针对本地目录的锁文件问题（若需在项目内操作） #

如果是要在D:\node-project目录下执行审计修复，先生成锁文件：

npm i --package-lock-only

生成锁文件后再执行修复命令：

npm audit fix --force

验证安装状态 #

执行以下命令确认@vue/cli是否安装成功：

vue --version

若能正常输出版本号，说明安装本身无问题，漏洞修复属于可选的安全优化操作。

内容的提问来源于stack exchange，提问作者Lim