Is react-scripts trying access my .steampath? Why?

[ghost]

Failed to compile.

./src/containers/Preview/layout.tsx
Attempted import error: 'react-svg' does not contain a default export (imported as 'ReactSVG').
/home/rawieo/[redacted]/node_modules/react-scripts/scripts/start.js:19
  throw err;
  ^

[Error: ENOENT: no such file or directory, stat '/home/rawieo/.steampath'] {
  errno: -2,
  code: 'ENOENT',
  syscall: 'stat',
  path: '/home/rawieo/.steampath'
}
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

react-scripts version is 3.4.1

[petetnt]

I wonder if you have a node_modules folder under your home root? Sounds like the react-svg import is resolving to some totally wrong folder due to the NodeJS resolution algorithm

[ghost]

That does not seem to be the case. But I believe it might be true that some dependency is trying to access .steampath. I can not, however, successfully replicate the problem. Though given numerous security vulnerabilities found in node, that does not seem implausible.

Could running node in a docker container help avoid those situations?

[cullenr]

I also had this issue today, it surfaced when one of my JS imports was not installed (redux). Adding the dependency fixed the issue. When the dependency was absent from the node_modules directory, something (i didn't dig far enough) would stat my entire home directory. With the dependency present the ~ directory was left alone.

Incidentally, on my machine the file .steampath is actually a broken symlink which is why stat failed.

[petetnt]

@Rawieo I think @cullenr has it right, .steampath is a broken symlink.

When the dependency was absent from the node_modules directory, something (i didn't dig far enough) would stat my entire home directory

Yes, this is how Node module resolution algorithm works. It backs off folders until it finds the module and then fails (we warn about this with the core CRA modules too).

Closing this as answered, but feel free to ask any other questions too :)

Now that I looked it closer (the .steampath threw me off the loop :)), the other issue is that you should be using the named export from ReactSVG instead of the default one

- import ReactSVG from 'react-svg';
+ import { ReactSVG } from 'react-svg';

[ghost]

It backs off folders until it finds the module

I sure am not comfortable with it even leaving project directory, let alone stating anything.

Running the project inside docker container could help (at least hypothetically) avoid security risks, right?