Problem with bcrypt's 'node-pre-gyp' dependency

Encountered error

When I execute this esbuild command:

esbuild index.ts --bundle --platform=node --target=es2020 --outdir=${npm_package_config_buildpath}

I encounter the following error:

[ERROR] Could not resolve "mock-aws-s3"
    node_modules/@mapbox/node-pre-gyp/lib/util/s3_setup.js:43:28:
      43 │     const AWSMock = require('mock-aws-s3');

[ERROR] Could not resolve "aws-sdk"
    node_modules/@mapbox/node-pre-gyp/lib/util/s3_setup.js:76:22:
      76 │   const AWS = require('aws-sdk');

Analysis

As you can see, the bcrypt lib is using the node-pre-gyp:1.0.10 dependency that has a s3_setup.js production file that contains mock-aws-s3 (a testing library) and aws-sdk ... does bcrypt need that? Isn't this a security issue?

Question

Am I really supposed to embbed mock-aws-s3 and aws-sdk dependencies in order to use bcrypt?

The bcrypt README file does not tell to install these AWS dependencies
If these AWS dependencies are required, maybe bcrypt should add them in its packge.json dependencies block, no?

My env: NodeJS: v16.17.1 on Ubuntu 20.04 LTS, I'm using npm + esbuild

Thanks

These are dev dependencies, bcrypt doesn't need mock-aws-sdk to run.

Bcrypt however needs node-pre-gyp to install itself, node-pre-gyp requires AWS-sdk. It should be possible to exclude certain modules from embedding.

PS: bcrypt and other native addons don't like to be embedded and may not work due to differences in paths for their native counterparts.

Yes mock-aws-s3 and even aws-sdk are declared as dev dependencies but they're used in a production file.

When I import bcrypt, bcrypt itself imports var nodePreGyp = require('@mapbox/node-pre-gyp');, and if I check node_modules/@mapbox/node-pre-gyp/lib/node-pre-gyp.js it imports exports.mockS3Http = require('./util/s3_setup').get_mockS3Http(); that contains const AWSMock = require('mock-aws-s3');

Maybe these AWS dependencies are never used and I just encounter them because I use esbuild (very powerful but not very configurable) that recursively analyze imported dependencies. Anyway in order to make bcrypt work, I had to install aws-sdk and mock-aws-s3 explicitely, but these indirect requirements from @mapbox/node-pre-gyp are not mentioned in bcrypt's README

Just noticed there's a node-pre-gyp issue about this problem that exists since July 6!

Yeah, we don't have control over what node-pre-gyp is doing.

We are trying to move away from node-pre-gyp and use prebuildify, should land in v6 which is due soon.

Yeah, we don't have control over what node-pre-gyp is doing.

We are trying to move away from node-pre-gyp and use prebuildify, should land in v6 which is due soon.

How soon will this happen?

No work around for this, no?

Yeah, we don't have control over what node-pre-gyp is doing.
We are trying to move away from node-pre-gyp and use prebuildify, should land in v6 which is due soon.

Any word on a fix? I'm having the most frustrating time bundling my app with esbuild because of this. Anybody find a workaround that does not require changing my dependencies, etc.?

@Aid19801

No work around for this, no?

Hi @Aid19801 , for me the solution was to use bcryptjs (it's bcrypt with pure JS implementation)

Advantages:

Completely fits bcrypt contract, I just had to change the dependency from bcrypt to bcryptjs in package.json, zero code to change
Implementation is pure JS, there's no problem related to third party dependencies

Drawbacks:

bcryptjs is slower than bcrypt, but the bcrypt algorithm is slow in general. That drawback wasn't really a problem for me because I already execute the bcrypt algorithm in a AWS Lambda Authorizer which has a 5 minutes cache

Sorry for my naivety, but is it ok to use a lib that has not been updated for 6 years ?? Last update of bcryptjs 6 years!

I noticed some of the difficulty in installation happens when trying to install bcrypt on a nodejs 19 engine.
I had to downgrade my nodejs before it worked.

the same problem

✘ [ERROR] Could not resolve "mock-aws-s3"

    node_modules/@mapbox/node-pre-gyp/lib/util/s3_setup.js:43:28:
      43 │     const AWSMock = require('mock-aws-s3');
         ╵                             ~~~~~~~~~~~~~

  You can mark the path "mock-aws-s3" as external to
  exclude it from the bundle, which will remove this
  error. You can also surround this "require" call with
  a try/catch block to handle this failure at run-time
  instead of bundle-time.

✘ [ERROR] Could not resolve "aws-sdk"

    node_modules/@mapbox/node-pre-gyp/lib/util/s3_setup.js:76:22:
      76 │   const AWS = require('aws-sdk');
         ╵                       ~~~~~~~~~

  You can mark the path "aws-sdk" as external to
  exclude it from the bundle, which will remove this
  error. You can also surround this "require" call with
  a try/catch block to handle this failure at run-time
  instead of bundle-time.

✘ [ERROR] Could not resolve "nock"

    node_modules/@mapbox/node-pre-gyp/lib/util/s3_setup.js:112:23:
      112 │   const nock = require('nock');
          ╵

I use nx and node.s( v18.12.1)

fix(core): use bcryptjs instead of bcrypt (kelektiv/node.bcrypt.js#964)

Still getting this issue!

The Same is here

I'm facing the same issue even after installing https://www.npmjs.com/package/node-gyp.

catastrophical exception. Are there any other solution?

You can exclude it from the bundle.

Sen help please, I'm stuck too.

Still got it. 2024...

The fix for the issue for me was excluding those packages when building;

"build": "esbuild src/index.ts --bundle --minify --sourcemap --platform=node --target=es2022 --outfile=dist/index.js --external:aws-sdk --external:nock --external:mock-aws-s3 --loader:.html=text",

I added these lines in the build code and worked fine for me.

@Aid19801

No work around for this, no?

Hi @Aid19801 , for me the solution was to use bcryptjs (it's bcrypt with pure JS implementation)

Advantages:

Completely fits bcrypt contract, I just had to change the dependency from bcrypt to bcryptjs in package.json, zero code to change

Implementation is pure JS, there's no problem related to third party dependencies

Drawbacks:

bcryptjs is slower than bcrypt, but the bcrypt algorithm is slow in general. That drawback wasn't really a problem for me because I already execute the bcrypt algorithm in a AWS Lambda Authorizer which has a 5 minutes cache

This solved my problem! Just replaced bcrypt with bcryptjs and it just worked. No coding changes required. Even though is 6-7 years without updates, seem to work fine.

It's unbelievable that it hasn't been fixed for so long!

still got the issue as of today

Hi all,

the solution was to use the alternative package of bcrypt.
In the package.json i have this entry: "bcryptjs": "^2.4.3",
For any questions lett me know!

Best regards
Cem

Still have this problem :(

how the heck is this still broken on 5.1.1

@ConnorBP

@ConnorBP Im using it with elysia bun and its killing me

The solution https://stackoverflow.com/questions/19822643/what-is-an-alternative-for-bcrypt-to-use-with-node

Also getting (create-next-app):

Module not found: Can't resolve 'mock-aws-s3'
// here we're mocking. node_pre_gyp_mock_s3 is the scratch directory
// for the mock code.
const AWSMock = require('mock-aws-s3');

Just another dev experiencing the same issue. PLEASE FIX!

For anyone dealing with this issue, it just got solved (for me) when upgrading bcrypt to the version 6.0.0 (https://www.npmjs.com/package/bcrypt/v/6.0.0)

My environment:

Node.js 22.21.1
Bcrypt 6.0.0
Esbuild params: --bundle=true, --minify=false, --sourcemap=false --platform=node --target=node22

Navigation Menu

Repository navigation

Problem with bcrypt's 'node-pre-gyp' dependency #964

Encountered error

Analysis

Question

9 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Problem with bcrypt's 'node-pre-gyp' dependency #964

Description

Encountered error

Analysis

Question

Activity

recrsn commented on Oct 10, 2022

eau-de-la-seine commented on Oct 10, 2022

eau-de-la-seine commented on Oct 11, 2022

recrsn commented on Oct 11, 2022

Joepolymath commented on Oct 23, 2022

Aid19801 commented on Nov 21, 2022

joshuagraber commented on Jan 11, 2023

eau-de-la-seine commented on Jan 17, 2023

cptflammin commented on Jan 24, 2023

Joepolymath commented on Jan 25, 2023

franktronics commented on Jan 28, 2023

JClackett commented on Apr 5, 2023

bete7512 commented on Jun 5, 2023

navalega0109 commented on Jun 27, 2023

9 remaining items

Intevel commented on Dec 25, 2023

enmanuelmag commented on Jan 11, 2024

vamman commented on Apr 1, 2024

Nethsara commented on Apr 3, 2024

acf77 commented on Jun 16, 2024

fanqie commented on Jul 24, 2024

dinnme commented on Aug 5, 2024

cemk31 commented on Aug 6, 2024

PeterBaker0 commented on Sep 19, 2024

ConnorBP commented on Dec 28, 2024

ChoaibMouhrachAkera commented on Jan 17, 2025

JulianMiguelAngle commented on Feb 26, 2025

gmoniava commented on Mar 8, 2025

edwinmartinson commented on Mar 21, 2025

feliperamis commented on Feb 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions