npm build using node/v10.18.0 fails to generate index.js files in Azure DevOps custom task extension ( File not found: index.js )

[ichodnic]

• Node.js Version: v10.18.0
• OS: Azure DevOps Hosted Agent
• Scope (install, code, runtime, meta, other?): Build
• Module (and version) (if relevant):

We use npm Azure DevOps task version 1.* to build Azure DevOps extension that includes some TypeScript custom tasks.
When using that npm task to build with node/v10.18.0, we see the following build error:

npm ERR! EEXIST: file already exists, cmd shim 'D:\a\1\s\dist\getKeyVaultValuesByKey\getKeyVaultValuesByKeyV1\node_modules\semver\bin\semver' -> 'D:\a\1\s\dist\getKeyVaultValuesByKey\getKeyVaultValuesByKeyV1\semver.cmd'

However, npm task does not fail, and thus the extension gets built with getKeyVaultValuesByKey\getKeyVaultValuesByKeyV1\index.js missing.
This later causes build errors when the extension is used ( File not found: '/home/vsts/work/_tasks/fngGetKeyVaultValuesByKey_39ae106b-656f-447f-8952-590b561aa14d/1.0.10/index.js' in getKeyVaultValuesByKeyTaskFailure.log
)

You will also notice that no index.js files are generated for all other TS custom tasks.
In npm_with_node_v10.17.0.log, we have the following:
Line 902: �[0m�[42m[INFO]�[0m�[32m Writing file to D:\a\1\s\deployApigeeProxy\deployApigeeProxyV0\index.js�[0m
Line 1608: �[0m�[42m[INFO]�[0m�[32m Writing file to D:\a\1\s\devopsNotification\devopsNotificationV2\index.js�[0m
Line 1691: �[0m�[42m[INFO]�[0m�[32m Writing file to D:\a\1\s\fngVariableDehydration\fngVariableDehydrationV1\index.js�[0m
Line 1767: �[0m�[42m[INFO]�[0m�[32m Writing file to D:\a\1\s\fngVariableRehydration\fngVariableRehydrationV1\index.js�[0m
Line 1878: �[0m�[42m[INFO]�[0m�[32m Writing file to D:\a\1\s\getKeyVaultValuesByKey\getKeyVaultValuesByKeyV1\index.js�[0m
Line 2604: �[0m�[42m[INFO]�[0m�[32m Writing file to D:\a\1\s\updateVersionInVSTS\UpdateVersionInVSTSV1\index.js�[0m
Line 2717: �[0m�[42m[INFO]�[0m�[32m Writing file to D:\a\1\s\writeBuildLogs\writeBuildLogsV1\index.js�[0m
while this is missing in npm_with_node_v10.18.0.log

This issue was resolved (without making any other changes in build definition and anywhere else) by switching back to node v10.17.0

getKeyVaultValuesByKeyTaskFailure.log
npm_with_node_v10.17.0.log
npm_with_node_v10.18.0.log

[Hakerh400]

It is hard to tell what the problem is without looking at the source code. Can you, at least, provide the content of your package.json and the install script?

The only commit between v10.17.0 and v10.18.0 is nodejs/node@94365f0, which is NPM update from v6.11.3 to v6.13.4 (in order to mitigate the Binary Planting vulnerability). The vulnerability was related to relative paths starting with a slash or containing two consecutive dots in package.json, which NPM banned in the new version. It is very probably that some of the non-normalized paths in your packages resolve to a wrong value.

Can you isolate the problem and provide a dependency-free test case that can be run locally?

[ichodnic]

Upon closer review, we determined that NPM update is the culprit - see npm/cli#678
This new NPM version errors when installing a dependency package that has already been installed.

[gireeshpunathil]

closing as resolved, feel free to re-open if that is not the case