Can not create new react-app

[baszero]

macOS 10.14.6
npm version = 8.1.2
node version = 16.13.0 (I also tried 14.4.0, same error)

Output:

TheMATRIX@~/development/weiterbildung] npx create-react-app course

Creating a new React app in /Users/xx/development/weiterbildung/course.

Installing packages. This might take a couple of minutes.
Installing react, react-dom, and react-scripts with cra-template...

npm ERR! code 1
npm ERR! path /Users/xx/development/weiterbildung/course/node_modules/coa
npm ERR! command failed
npm ERR! command sh -c start /B node compile.js & node compile.js
npm ERR! sh: start: command not found
npm ERR! node:internal/modules/cjs/loader:936
npm ERR!   throw err;
npm ERR!   ^
npm ERR! 
npm ERR! Error: Cannot find module '/Users/xx/development/weiterbildung/course/node_modules/coa/compile.js'
npm ERR!     at Function.Module._resolveFilename (node:internal/modules/cjs/loader:933:15)
npm ERR!     at Function.Module._load (node:internal/modules/cjs/loader:778:27)
npm ERR!     at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)
npm ERR!     at node:internal/main/run_main_module:17:47 {
npm ERR!   code: 'MODULE_NOT_FOUND',
npm ERR!   requireStack: []
npm ERR! }

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/xx/.npm/_logs/2021-11-04T13_29_00_745Z-debug.log

Aborting installation.
  npm install --save --save-exact --loglevel error react react-dom react-scripts cra-template has failed.

Deleting generated file... package.json
Deleting course/ from /Users/xx/development/weiterbildung
Done.

And in the log file I see this (this time with v14.4.0):

9093 timing metavuln:cache:get:security-advisory:react-scripts:keJAYB+uyINLquff35kjTPcDcqM/6q1f6JaX5X0B1VLAqG1G4VcktJdrLGGYRCLiprEWg8/ljNSvoQBwHuHBhA== Completed in 32ms
9094 timing metavuln:load:security-advisory:react-scripts:gGYnIdLwfnZNHzqU5AFeRedEuk0JD0hpw2rMpR8KZDvMhUnKXM9KinfcLchu1IZtqWFcuE3jhbXtLpuIQVkn1A== Completed in 0ms
9095 timing metavuln:calculate:security-advisory:react-scripts:gGYnIdLwfnZNHzqU5AFeRedEuk0JD0hpw2rMpR8KZDvMhUnKXM9KinfcLchu1IZtqWFcuE3jhbXtLpuIQVkn1A== Completed in 33ms
9096 timing auditReport:init Completed in 12297ms
9097 timing reify:audit Completed in 17404ms
9098 timing reifyNode:node_modules/@typescript-eslint/scope-manager Completed in 17129ms
9099 timing reifyNode:node_modules/table/node_modules/ajv Completed in 17601ms
9100 timing reifyNode:node_modules/@typescript-eslint/eslint-plugin Completed in 17776ms
9101 timing reifyNode:node_modules/eslint Completed in 17825ms
9102 timing reifyNode:node_modules/jsdom Completed in 18291ms
9103 timing reifyNode:node_modules/caniuse-lite Completed in 18530ms
9104 timing reifyNode:node_modules/es5-ext Completed in 19036ms
9105 timing reifyNode:node_modules/lodash Completed in 19212ms
9106 timing reifyNode:node_modules/es-abstract Completed in 19439ms
9107 warn deprecated core-js@2.6.12: core-js@<3.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
9108 timing reifyNode:node_modules/babel-runtime/node_modules/core-js Completed in 20518ms
9109 timing reifyNode:node_modules/core-js-pure Completed in 20649ms
9110 timing reifyNode:node_modules/core-js Completed in 20772ms
9111 timing reifyNode:node_modules/typescript Completed in 20934ms
9112 timing reify:unpack Completed in 21228ms
9113 timing reify:unretire Completed in 2ms
9114 timing build:queue Completed in 50ms
9115 info run coa@2.1.3 preinstall node_modules/coa start /B node compile.js & node compile.js
9116 info run coa@2.1.3 preinstall { code: 1, signal: null }
9117 timing reify:rollback:createSparse Completed in 7110ms
9118 timing reify:rollback:retireShallow Completed in 0ms
9119 timing command:install Completed in 42646ms
9120 verbose stack Error: command failed
9120 verbose stack     at ChildProcess.<anonymous> (/Users/baszero/.nvm/versions/node/v14.4.0/lib/node_modules/npm/node_modules/@npmcli/promise-spawn/index.js:64:27)
9120 verbose stack     at ChildProcess.emit (events.js:315:20)
9120 verbose stack     at maybeClose (internal/child_process.js:1051:16)
9120 verbose stack     at Socket.<anonymous> (internal/child_process.js:442:11)
9120 verbose stack     at Socket.emit (events.js:315:20)
9120 verbose stack     at Pipe.<anonymous> (net.js:670:12)
9121 verbose pkgid coa@2.1.3
9122 verbose cwd /Users/baszero/development/weiterbildung/course
9123 verbose Darwin 18.7.0
9124 verbose argv "/Users/baszero/.nvm/versions/node/v14.4.0/bin/node" "/Users/baszero/.nvm/versions/node/v14.4.0/bin/npm" "install" "--save" "--save-exact" "--loglevel" "error" "react" "react-dom" "react-scripts" "cra-template"
9125 verbose node v14.4.0
9126 verbose npm  v7.23.0
9127 error code 1
9128 error path /Users/baszero/development/weiterbildung/course/node_modules/coa
9129 error command failed
9130 error command sh -c start /B node compile.js & node compile.js
9131 error sh: start: command not found
9131 error internal/modules/cjs/loader.js:1032
9131 error   throw err;
9131 error   ^
9131 error
9131 error Error: Cannot find module '/Users/baszero/development/weiterbildung/course/node_modules/coa/compile.js'
9131 error     at Function.Module._resolveFilename (internal/modules/cjs/loader.js:1029:15)
9131 error     at Function.Module._load (internal/modules/cjs/loader.js:898:27)
9131 error     at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:71:12)
9131 error     at internal/main/run_main_module.js:17:47 {
9131 error   code: 'MODULE_NOT_FOUND',
9131 error   requireStack: []
9131 error }
9132 verbose exit 1

[elliehachemjob]

npx create-react-app projectname --use-npm try

[baszero]

npx create-react-app projectname --use-npm try

does not work either, same error

[baszero]

updated initial post with log file end.

this looks suspicious:

9107 warn deprecated core-js@2.6.12: core-js@<3.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.


9115 info run coa@2.1.3 preinstall node_modules/coa start /B node compile.js & node compile.js
9116 info run coa@2.1.3 preinstall { code: 1, signal: null }

[jjnilton]

Having the same issue.

Windows 10 10.0.19042.0
npm: '7.19.1'
node: '16.6.0'

9115 warn deprecated core-js@2.6.12: core-js@<3.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
9116 timing reifyNode:node_modules/babel-runtime/node_modules/core-js Completed in 14731ms
9117 timing reifyNode:node_modules/core-js-pure Completed in 14869ms
9118 timing reifyNode:node_modules/core-js Completed in 14816ms
9119 timing reifyNode:node_modules/typescript Completed in 15012ms
9120 timing reify:unpack Completed in 15091ms
9121 timing reify:unretire Completed in 2ms
9122 timing build:queue Completed in 42ms
9123 info run coa@2.1.3 preinstall node_modules/coa start /B node compile.js & node compile.js
9124 info run coa@2.1.3 preinstall { code: 1, signal: null }
9125 timing reify:rollback:createSparse Completed in 6683ms
9126 timing reify:rollback:retireShallow Completed in 0ms
9127 timing command:install Completed in 53418ms
9128 verbose stack Error: command failed
9128 verbose stack     at ChildProcess.<anonymous> (C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\index.js:64:27)
9128 verbose stack     at ChildProcess.emit (node:events:394:28)
9128 verbose stack     at maybeClose (node:internal/child_process:1067:16)
9128 verbose stack     at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5)
9129 verbose pkgid coa@2.1.3
9130 verbose cwd C:\Users\JJ\Downloads\01-starting-project\01-starting-project
9131 verbose Windows_NT 10.0.19042
9132 verbose argv "C:\\Program Files\\nodejs\\node.exe" "C:\\Program Files\\nodejs\\node_modules\\npm\\bin\\npm-cli.js" "i"
9133 verbose node v16.6.0
9134 verbose npm  v7.19.1
9135 error code 1
9136 error path C:\Users\JJ\Downloads\01-starting-project\01-starting-project\node_modules\coa
9137 error command failed
9138 error command C:\Windows\system32\cmd.exe /d /s /c start /B node compile.js & node compile.js
9139 error node:internal/modules/cjs/loader:936
9139 error   throw err;
9139 error   ^
9139 error
9139 error Error: Cannot find module 'C:\Users\JJ\Downloads\01-starting-project\01-starting-project\node_modules\coa\compile.js'
9139 error     at Function.Module._resolveFilename (node:internal/modules/cjs/loader:933:15)
9139 error     at Function.Module._load (node:internal/modules/cjs/loader:778:27)
9139 error     at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:79:12)
9139 error     at node:internal/main/run_main_module:17:47 {
9139 error   code: 'MODULE_NOT_FOUND',
9139 error   requireStack: []
9139 error }
9139 error node:internal/modules/cjs/loader:936
9139 error   throw err;
9139 error   ^
9139 error
9139 error Error: Cannot find module 'C:\Users\JJ\Downloads\01-starting-project\01-starting-project\node_modules\coa\compile.js'
9139 error     at Function.Module._resolveFilename (node:internal/modules/cjs/loader:933:15)
9139 error     at Function.Module._load (node:internal/modules/cjs/loader:778:27)
9139 error     at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:79:12)
9139 error     at node:internal/main/run_main_module:17:47 {
9139 error   code: 'MODULE_NOT_FOUND',
9139 error   requireStack: []
9139 error }
9140 verbose exit 1

[rkl1994]

the same problem...

macOS: 12.0.1
npm version: 6.14.6
node version: 12.18.3

[socheatsok78]

coa has been mark as security compromised.

See veged/coa#99

[baszero]

coa has been mark as security compromised.

See veged/coa#99

I would say this issue is CRITICAL then, no?

[socheatsok78]

coa has been mark as security compromised.
See veged/coa#99

I would say this issue is CRITICAL then, no?

I afraid so!

See veged/coa#99 (comment)

[baszero]

I tried with nvm version 14.18.1 (latest v14), same error.

[socheatsok78]

Please do not attempt to run the create-react-app since coa contains malicious code.

[baszero]

According to veged/coa#99 , you have to install COA 2.0.2

npm remove coa
npm install coa@2.0.2

However I did that, and I see in the still remaining error that COA 2.1.3 is used. WHY? How can we force create-react-app to use COA 2.1.3 ?

[SoenkeHu]

Is it possible to use "create-react-app" for a new app without directly installing the dependencies?

[gesamples]

Should I be concerned if I was trying to run this all morning?

[hussamsindhu]

I also have this same Issue

[baszero]

I have added this to my package.json and it now works! Obviously the malicious COA version has also been removed by the NPM team now... maybe it works anyways again now.

"scripts": {
  "preinstall": "npx npm-force-resolutions",
  "postinstall": "npx patch-package"
},
"resolutions": {
  "coa": "2.0.2"
}

By adding this, it forces the whole build to use version 2.0.2, regardless the config of the create-react-app

[monim-es]

I have faced this problem and tried lots of possible solution to finally recognize is just because my slow wifi

[Renkiee]

npx create-react-app projectname --use-npm try

does not work either, same error

your npm origin maybe not taobao.org,please try set taobao.org