firebase-tools depends es5-ext (via cli-color), which prints messages when in Russia

[AviVahl]

(am I making a mistake by opening this Pandora box?)

[REQUIRED] Environment info

firebase-tools: 11.4.0

Platform: Fedora 36

[REQUIRED] Test case

This is happening upon installation.

[REQUIRED] Steps to reproduce

(when in russia)

mkdir fb-postinstall
cd fb-postinstall
npm init -y
npm i firebase firebase-tools

[REQUIRED] Expected behavior

Installation without additional unrelated messages.

[REQUIRED] Actual behavior

es5-ext/_postinstall.js has the following code:

#!/usr/bin/env node

// Broadcasts "Call for peace" message when package is installed in Russia, otherwise no-op

"use strict";

try {
	if (
		[
			"Asia/Anadyr", "Asia/Barnaul", "Asia/Chita", "Asia/Irkutsk", "Asia/Kamchatka",
			"Asia/Khandyga", "Asia/Krasnoyarsk", "Asia/Magadan", "Asia/Novokuznetsk",
			"Asia/Novosibirsk", "Asia/Omsk", "Asia/Sakhalin", "Asia/Srednekolymsk", "Asia/Tomsk",
			"Asia/Ust-Nera", "Asia/Vladivostok", "Asia/Yakutsk", "Asia/Yekaterinburg",
			"Europe/Astrakhan", "Europe/Kaliningrad", "Europe/Kirov", "Europe/Moscow",
			"Europe/Samara", "Europe/Saratov", "Europe/Simferopol", "Europe/Ulyanovsk",
			"Europe/Volgograd", "W-SU"
		].indexOf(new Intl.DateTimeFormat().resolvedOptions().timeZone) === -1
	) {
		return;
	}

	var bold = function (msg) { return "\x1b[97m\x1b[1m" + msg + "\x1b[22m\x1b[37m"; };

	var flags = function () {
		return (
			"🇷🇺  🇺🇦  🇷🇺  🇺🇦  🇷🇺  🇺🇦  🇷🇺  🇺🇦  🇷🇺  🇺🇦  🇷🇺  🇺🇦  🇷🇺  🇺🇦  🇷🇺  🇺🇦  🇷🇺  🇺🇦  🇷🇺  🇺🇦" +
			"  🇷🇺  🇺🇦  🇷🇺  🇺🇦  🇷🇺  🇺🇦"
		);
	};

	process._rawDebug(
		[
			"", flags(), "",
			"\x1b[37m24 февраля " +
				bold("Россия напала на Украину") +
				", что уже стало причиной " +
				bold("7000+ жертв среди российских военных") +
				" и примерно " +
				bold("2000-4000 - среди украинских") +
				", а также " +
				bold("780 убитых граждан, в том числе 36 детей") +
				".",
			"",
			"Народ Украины всеобще мобилизован и готов защищать свою страну от вражеского" +
				" вторжения. " +
				bold(
					"91% украинцев полностью поддерживает своего президента Владимира Зеленского"
				) +
				" и его ответные действия на нападение России.",
			"",
			"Весь мир осудил необоснованное вторжение и решил ввести " +
				bold("невиданные ранее санкции против России") +
				". С каждым новым днем они будут ощущаться все сильнее и сильнее среди мирных" +
				" граждан.",
			"",
			"В то же время, " +
				bold("российское правительство ограничивает доступ граждан к внешней информации") +
				", насаждая однобокие формулировки и версии происходящего.",
			"", "В качестве надежного источника информации загрузите безопасный браузер Tor:", "",
			bold(
				"https://forum.torproject.net/t/tor-blocked-in-russia-how-to-circumvent-censorship/982"
			),
			"", "И посетите:", "",
			bold(
				"https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6aucdccrad.onion/russian"
			),
			"", flags(), "",
			bold("Прекратите эту бессмысленную войну! Остановите военного преступника Путина!") +
				"\x1b[39m",
			"", flags(), ""
		].join("\n")
	);
} catch (error) {
	// ignore
}

Related:
microsoft/TypeScript#50061

Side note

I personally hope Russian aggression and the war in Ukraine will end. I hope less lives will be lost. I hope for lasting peace.

[AlexShemeshWix]

+1 its detected as a virus by antivirus software.

[bkendall]

Thanks for raising with us. While it's the prerogative of a developer to put something like this in their package, it makes that version of the package unusable by us.

Fixed by #4796

[AviVahl]

@bkendall
This was not fixed in firebase-tools@11.4.1. I've installed and same version of es5-ext was resolved. pinning the request to cli-color won't work, as it uses a caret when it requests es5-ext.

How about moving to colorette or similar?

[bkendall]

Hmmm - this is going to get into the weeds really, really quickly. npm-shrinkwrap.json is incredibly useful, until npm doesn't respect it. it should be pinned - the specific dependencies we require should resolve out to not using the later versions of es5-ext. But, if it's not being respected, I don't have the time to go dig into npm to discover why.

It may be the version of npm that causes this issue, but I'm able to npm pack and install the archive on my machine and it doesn't bring in the newer versions of those packages. Unfortunately, I don't have a bunch more time to dig into specifics of what's going on beyond what I've done - and even more unfortunately, cli-color is all over this codebase (163 files mention it), so it'd be quite the effort to remove (which would have a lower priority for me than some other things at the moemnt). Until then, a PR would be welcome to make the swap - maybe just swapping the require or import out would be 90% of the work - but I can't put much more time into this particular problem at the moment.

[AviVahl]

most functionality is implemented pretty similarly. I can open a PR that does most of the change.
thing is, there are also calls to strip ansi and cursor move, so I may need help in that final stretch. would you be able to assist then? :)

EDIT: also, can we re-open this issue until this is resolved?

[bkendall]

If you can get it 95% of the way there, I can try to help with the last 5%. we can use this issue to track the work, sure.