MODULE_NOT_FOUND warnings for @mitre/emass_client axios dependency at startup

[aaronlippold]

Description

When SAF CLI starts, it outputs many MODULE_NOT_FOUND warnings related to the @mitre/emass_client package trying to find axios:

(node:13864) [MODULE_NOT_FOUND] Warning: ModuleLoadError
module: @oclif/core@3.27.0
task: findCommand (emasser:delete:artifacts)
plugin: @mitre/saf
root: /usr/local/lib/node_modules/@mitre/saf
code: MODULE_NOT_FOUND
message: [MODULE_NOT_FOUND] require failed to load /usr/local/lib/node_modules/@mitre/saf/lib/commands/emasser/delete/artifacts.js: Cannot find module '@mitre/emass_client/node_modules/axios'

This warning repeats for all emasser commands (~1200+ lines of warnings).

Impact

• Functional: Commands still work - this is a warning, not an error
• User Experience: Very noisy output obscures actual results
• CI/CD: Pollutes logs, makes debugging harder

Root Cause Analysis

1. @mitre/emass_client (v3.22.0) declares axios: ^1.6.1 as a direct dependency
2. SAF CLI also has axios: ^1.5.0 as a dependency
3. npm hoists axios to SAF's top-level node_modules/axios
4. The emass_client code does normal require("axios") which should resolve via Node's module resolution
5. However, something is causing Node to look specifically in @mitre/emass_client/node_modules/axios instead of walking up the tree

The generated emass_client code is standard:

// dist/api.js:93
var axios_1 = require("axios");

This happens during oclif's findCommand discovery phase at startup.

Possible Fixes

1. In emass_client: Change axios from dependencies to peerDependencies
2. In SAF CLI: Add axios version resolution/override
3. Investigation needed: Check if this is an npm/node version issue or oclif module resolution behavior

Environment

• Observed in GitHub Actions CI (ubuntu-latest)
• SAF CLI installed globally via npm
• Node.js version from CI runner

Workaround

For now, stderr can be suppressed:

export NODE_NO_WARNINGS=1
saf summary --input results.json 2>/dev/null

Related

• @mitre/emass_client: https://github.com/mitre/emass_client
• axios dependency declared at: src/typescript_client/package.json

[bfield308]

@aaronlippold This is now causing some pipeline runs to faile when attempting conversions in some pipelines. the trufflehog2hdf converter did not work in 1.5.3 but is working in 1.4.21 (yes lots of versions between).