trojan in one of your dependencies, supply chain attack...

[cedricwalter]

I did empty NPM cache, mine at C:\Users\{username}\AppData\Roaming\npm-cache

git clone https://github.com/corda/node-explorer.git
npm install

a Windows Defender scan find:
virus Trojan:Win32/Woreflint.A!cl

file: C:\Users\{username}\AppData\Roaming\npm-cache\_cacache\content-v2\sha512\81\8f\400685798e1ebb22b3c4c05f3547c97d2f013746a1d4c94deb20a8adc2a3292a1a653793990ba5841ce5cedd787088b08896bf4b2c8e8e3e1af76e6b5022->(GZip)->package/win/ia32/app-builder.exe

[anixon604]

@cedricwalter wasn't present for us during dev. I'm taking a look into it. Thanks for the report!

[cedricwalter]

you can not do anything about it, maybe upgrade this dependency and hope trojan is not inside, The maintainer of that dependencies need to act. Poisonning 3rd party dependencies is more and more common these days :-(

[anixon604]

@cedricwalter happy to report these Trojan's were false positives interacting with Windows Defender, related tickets. For reference, here, and here.

Regardless it makes sense to rollback the offending electron-build devDependency to unaffected 21.2.0 which is still compatible with create distributions of node-explorer.

Note: this issue had no affect on Window's Release binaries. The package was devDependency affecting windows users with Windows Defender.

You can now npm install without issue. Thank you so much for your reporting the issue and your patience. :-)