Syncs package named "constructor" on new installation

[glen-84]

As mentioned here.

Clean installation of CNPM (no published packages): http://snag.gy/z02Z5.jpg

If you click the link to constructor, it takes you to a page that says Can not found package match constructor. You can SYNC from official npm registry or SEARCH in official npm website..

What is this package?

[glen-84]

@fengmk2 Could this also be about hasOwnProperty? (similar to this)

[fengmk2]

constructor is worked for me, see https://npm.taobao.org/package/constructor .

Which url show you this message Can not found package match constructor?

[glen-84]

I never installed a package named constructor, and I don't want it. However, when I install CNPM for the first time, it just starts syncing this package.

I was wondering if it's because the code is iterating over an object and not excluding inherited properties.

See here. Somewhere in the sync code I think it may be missing a hasOwnProperty check.

constructor is not a package in my case, it's just an inherited JavaScript property.

[glen-84]

@fengmk2 Do you follow what I'm saying?

[fengmk2]

Yep, can you tell me a simple way to reappear this?

[glen-84]

@fengmk2,

Our configuration looks similar to this:

const OurUserService = require("/path/to/our-user-service");

module.exports = {
    bindingHost: "0.0.0.0",
    registryHost: "registry.cnpm.dev.our-company.net",
    sessionSecret: "...",
    logdir: "/con/log/cnpm/",
    uploadDir: "/con/data/cnpm/downloads/",
    mail: {
        enable: true,
        appname: "Our Company CNPM",
        from: "CNPMJS <[email protected]>",
        host: "mail.our-company.net",
        port: 587,
        auth: {
            user: "[email protected]",
            pass: "..."
        }
    },
    npmClientName: "npm",
    admins: {
        one: "[email protected]",
        two: "[email protected]"
    },
    scopes: [
        "@our-company"
    ],
    syncModel: "exist",
    syncInterval: "24h",
    // Only admins can publish.
    enablePrivate: true,
    // Require authentication.
    alwaysAuth: true,
    // Use our custom user service.
    userService: new OurUserService()
};

Maybe it's something specific to syncModel: "exist"?

cnpmjs.org version: 2.9.2
Node.js version: v5.7.1

When we started the server for the first time (without installing any packages), it started to sync this constructor package, but obviously it doesn't really exist on our server.

[glen-84]

@fengmk2 Were you able to reproduce this issue?

[fengmk2]

I will try to reproduce this in these two days.