`node-copy-paste` breaks on android (termux)

[brysgo]

When trying to create a new CRA project on android, node-copy-paste causes a crash because of a platform check.

[brysgo]

Confirmed with yarn link that the above PR fixes this.

[gaearon]

How do we use node-copy-paste?

[brysgo]

Not sure, I can investigate when I get some time.

[Timer]

JHaddad@W10LJHADDADSURF MINGW64 ~/Documents/Development/create-react-app (remove-cssm-docs)
$ yarn why copy-paste
yarn why v1.3.2
[1/4] Why do we have the module "copy-paste"...?
[2/4] Initialising dependency graph...
[3/4] Finding dependency...
[4/4] Calculating file sizes...
info This module exists because "workspace-aggregator-5c248a94-35ae-4f58-8b1e-45e710c97334#create-react-app#envinfo
" depends on it.
Done in 1.06s.

Our new --info flag.

[viankakrisna]

https://github.com/xavi-/node-copy-paste/issues/61 will it affect CRA users?

[bondz]

snyk reports a vulnerability as a result of the module

snyk test create-react-app
✗ Medium severity vulnerability found on sync-exec@0.6.2
- desc: Insecure use of Tmp files
- info: https://snyk.io/vuln/npm:sync-exec:20160124
- from: create-react-app@1.5.0 > envinfo@3.10.0 > copy-paste@1.3.0 > sync-exec@0.6.2
Fix: None available. Consider removing this dependency.

Tested create-react-app for known vulnerabilities, found 1 vulnerability, 1 vulnerable path.

cc @tabrindle

[bondz]

A possible solution is to pin the envinfo version to 3.4.2, the clipboard option that is the cause of this issue and the added vulnerability would be mitigated. We currently do not use the cliboard option anyways.

[tabrindle]

If it's causing problems, it's an easy fix to remove the module upstream in envinfo.

[gaearon]

For now I'll cut a patch to create-react-app with #3853 but happy to merge other solutions later.