npm安装wss疑问：依赖安装是否正常及漏洞修复失败求助

1. 安装wss时附带istanbul和47个包是否正常？ #

完全正常。wss@3.3.4这个版本的包依赖了旧版的istanbul作为测试覆盖率工具，虽然终端提示istanbul已废弃（推荐使用nyc替代），但这是该版本wss的固有依赖，并非安装异常。

而安装时附带的47个包，是wss及其依赖的完整依赖树——Node.js包的依赖通常会层层嵌套，一个包依赖多个子包，子包又可能依赖其他包，所以出现几十个子包是很常见的情况，不用担心。

2. 解决ln: creating symbolic link... No such file or directory错误 #

这个错误是因为你在虚拟node环境（nodevenv）中执行全局安装时，npm试图向不存在的路径创建软链接。更重要的是：你全局安装的os、fs、http、https、crypto等都是Node.js内置模块，根本不需要通过npm安装！Node.js默认已经包含这些模块，直接在代码里require('fs')就能用，全局安装反而可能导致模块冲突。

建议：

• 停止全局安装这些内置模块
• 只在项目本地安装实际需要的第三方包（比如wss）

3. 解决npm audit fix的EAUDITNOLOCK错误 #

你遇到的错误是因为lock文件（package-lock.json）没有正确生成或被识别，按照以下步骤操作即可解决：

步骤1：清理现有依赖和lock文件 #

rm -rf node_modules package-lock.json

步骤2：重新安装本地依赖 #

npm install

步骤3：强制生成lock文件 #

npm i --package-lock-only

步骤4：执行audit修复 #

npm audit fix

如果执行完还是报错，检查一下当前目录是否存在package-lock.json文件，或者尝试给命令加上--force参数（谨慎使用，可能会升级依赖版本）：

npm audit fix --force

附你提供的终端完整输出：

[letlziml@premium88 ~]$ source /home/letlziml/nodevenv/public_html/0/0/0/0/1/0/1/NodeTest/12/bin/activate && cd /home/letlziml/public_html/0/0/0/0/1/0/1/NodeTest
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g https
ln: creating symbolic link `/home/letlziml/nodevenv/public_html/0/0/0/0/1/0/1/NodeTest/12/lib/package.json': No such file or directory
+ https@1.0.0 added 1 package from 1 contributor in 0.457s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g ws
ln: creating symbolic link `/home/letlziml/nodevenv/public_html/0/0/0/0/1/0/1/NodeTest/12/lib/package.json': No such file or directory
+ ws@7.3.1 added 1 package from 1 contributor in 0.434s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g wss
ln: creating symbolic link `/home/letlziml/nodevenv/public_html/0/0/0/0/1/0/1/NodeTest/12/lib/package.json': No such file or directory
npm WARN deprecated istanbul@0.4.5: This module is no longer maintained, try this instead:
npm WARN deprecated npm i nyc
npm WARN deprecated Visit https://istanbul.js.org/integrations for other alternatives.
+ wss@3.3.4 added 47 packages from 148 contributors in 3.006s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g os
ln: creating symbolic link `/home/letlziml/nodevenv/public_html/0/0/0/0/1/0/1/NodeTest/12/lib/package.json': No such file or directory
+ os@0.1.1 added 1 package from 1 contributor in 0.511s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm init
This utility will walk you through creating a package.json file.
It only covers the most common items, and tries to guess sensible defaults.
See `npm help init` for definitive documentation on these fields and exactly what they do.
Use `npm install <pkg>` afterwards to install a package and save it as a dependency in the package.json file.
Press ^C at any time to quit.
package name: (nodetest) ^C
Sorry, name can only contain URL-friendly characters and name can no longer contain capital letters.
package name: (nodetest)
npm WARN init canceled
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm int -y
Usage: npm <command>
where <command> is one of:
access, adduser, audit, bin, bugs, c, cache, ci, cit, clean-install, clean-install-test, completion, config, create, ddp, dedupe, deprecate, dist-tag, docs, doctor, edit, explore, fund, get, help, help-search, hook, i, init, install, install-ci-test, install-test, it, link, list, ln, login, logout, ls, org, outdated, owner, pack, ping, prefix, profile, prune, publish, rb, rebuild, repo, restart, root, run, run-script, s, se, search, set, shrinkwrap, star, stars, start, stop, t, team, test, token, tst, un, uninstall, unpublish, unstar, up, update, v, version, view, whoami
npm <command> -h quick help on <command>
npm -l display full usage info
npm help <term> search for help on <term>
npm help npm involved overview
Specify configs in the ini-formatted file: /home/letlziml/.npmrc
or on the command line via: npm <command> --key value
Config info can be viewed via: npm help config
npm@6.14.6 /opt/alt/alt-nodejs12/root/usr/lib/node_modules/npm
Did you mean one of these?
init it
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm init -y
Wrote to /home/letlziml/public_html/0/0/0/0/1/0/1/NodeTest/package.json:
{ "name": "NodeTest", "version": "1.0.0", "description": "", "main": "app.js", "dependencies": {}, "devDependencies": {}, "scripts": { "test": "echo \"Error: no test specified\" && exit 1" }, "keywords": [], "author": "", "license": "ISC" }
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g os
+ os@0.1.1 updated 1 package in 0.377s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g fs
+ fs@0.0.1-security added 1 package in 0.341s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g url
+ url@0.11.0 added 3 packages from 3 contributors in 0.748s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g util
+ util@0.12.3 added 27 packages from 17 contributors in 2.589s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g path
+ path@0.12.7 added 4 packages from 2 contributors in 0.772s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g http
+ http@0.0.1-security added 1 package in 0.351s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g https
+ https@1.0.0 updated 1 package in 0.326s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g crypto
npm WARN deprecated crypto@1.0.1: This package is no longer supported. It's now a built-in Node module. If you've depended on crypto, you should switch to the one that's built-in.
+ crypto@1.0.1 added 1 package in 0.327s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g events
+ events@3.2.0 added 1 package from 1 contributor in 0.358s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install -g querystring
+ querystring@0.2.0 added 1 package from 1 contributor in 0.341s
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm init -y
Wrote to /home/letlziml/public_html/0/0/0/0/1/0/1/NodeTest/package.json:
{ "name": "NodeTest", "version": "1.0.0", "main": "app.js", "dependencies": {}, "devDependencies": {}, "scripts": { "test": "echo \"Error: no test specified\" && exit 1" }, "keywords": [], "author": "", "license": "ISC", "description": "" }
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm install --save wss
npm WARN deprecated istanbul@0.4.5: This module is no longer maintained, try this instead:
npm WARN deprecated npm i nyc
npm WARN deprecated Visit https://istanbul.js.org/integrations for other alternatives.
npm WARN NodeTest@1.0.0 No description
npm WARN NodeTest@1.0.0 No repository field.
+ wss@3.3.4 added 47 packages from 148 contributors and audited 47 packages in 43.684s
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm audit
npm ERR! code EAUDITNOLOCK
npm ERR! audit Neither npm-shrinkwrap.json nor package-lock.json found: Cannot audit a project without a lockfile
npm ERR! audit Try creating one first with: npm i --package-lock-only
npm ERR! A complete log of this run can be found in:
npm ERR! /home/letlziml/.npm/_logs/2020-10-09T14_58_00_189Z-debug.log
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm audit fix
npm ERR! code EAUDITNOLOCK
npm ERR! audit Neither npm-shrinkwrap.json nor package-lock.json found: Cannot audit a project without a lockfile
npm ERR! audit Try creating one first with: npm i --package-lock-only
npm ERR! A complete log of this run can be found in:
npm ERR! /home/letlziml/.npm/_logs/2020-10-09T14_58_24_982Z-debug.log
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm i --package-lock-only
npm WARN NodeTest@1.0.0 No description
npm WARN NodeTest@1.0.0 No repository field.
audited 47 packages in 0.911s
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ npm audit fix
npm ERR! code EAUDITNOLOCK
npm ERR! audit Neither npm-shrinkwrap.json nor package-lock.json found: Cannot audit a project without a lockfile
npm ERR! audit Try creating one first with: npm i --package-lock-only
npm ERR! A complete log of this run can be found in:
npm ERR! /home/letlziml/.npm/_logs/2020-10-09T15_00_00_845Z-debug.log
[public_html/0/0/0/0/1/0/1/NodeTest (12)] [letlziml@premium88 NodeTest]$ 

内容的提问来源于stack exchange，提问作者Ryan Stone