Issue with optipng-bin about imagemin-optipng HOT 9 OPEN

Looking in to this problem. Here's what I see:

1. imagemin-optipng depends on optipng-bin
2. optipng-bin has a postinstall script which attempts to run the package
3. This run likely fails on CI as there’s no optipng binary. The install script then attempts to download the correct binary from sourceforge.net
4. The binary download definitely fails (our CI boxes don't have web access)
5. The download script appears to log an error, but this is either a silent log or a noop. This doesn't exit with a >0 code as it should.
6. When attempting to spawn with optipng-bin’s path spawn fails with a ENOENT because there's no binary at that path: it never was download.

from imagemin-optipng.

Appearently opti-png bin file is infected with ML/PE-A malware. If you have an antimalware or similar tool, it will detect and remove the file. At least that's the case on my end that fails to install from npm

from imagemin-optipng.

npm rebuild solved the problem for me.

from imagemin-optipng.

@kevva @shinnn @sindresorhus @jdalton @ihodev ^^

from imagemin-optipng.

Experiencing the same issue.

from imagemin-optipng.

+1

from imagemin-optipng.

This is a major issue breaking our builds.

from imagemin-optipng.

+1 to major issue breaking builds

from imagemin-optipng.

Shoot, the bad download could also come from this download method. Rough stack trace:

1. Install script calls BinWrapper#run
2. which calls BinWrapper#findExisting
3. BinWrapper#findExisting stats for the vendor directory, which fails
4. which calls BinWrapper#download, which triggers a download based on the OS/architecture

This process could fail, too, maybe?!

from imagemin-optipng.