Is this project aware that a dependency is now using the Scarfjs package?

[nzacca]

Hello!

I recently updated Storybook and discovered this mysterious message in my logs:

> @scarf/[email protected] postinstall /mnt/c/dev/node_modules/@scarf/scarf
> node ./report.js

I'm not here to debate the ethics of this (or however else you'd like to view it) but just curious if the package maintainers here are aware of this recent addition.

Further discussions about this can be found on the Scarfjs Issues list such as:

• Discussion around Scarf's analytics scarf-sh/scarf-js#24
• Why wasn't I warned about this? scarf-sh/scarf-js#31

Thank you!

[phated]

I just searched the yarn lockfile and that module doesn't exist. It seems that something else you are using is adding that.

[nzacca]

Hello!

It is added by polished which is added by @storybook/addon-actions. Pasted a snippet of lock file below.

"@storybook/addon-actions": {
	"version": "6.1.17",
	"resolved": "https://registry.npmjs.org/@storybook/addon-actions/-/addon-actions-6.1.17.tgz",
	"integrity": "sha512-4hyAvmjnI4C1ZQ7/t21jKKXE0jO1zAk310BkYin0NJf77Qi0tUE1DNOwirJY/xzRih36wWi1V79c/ZOJNsLv9Q==",
	"dev": true,
	"requires": {
		... removed for brevity
		"polished": "^3.4.4",
		...
	}
},
...
"polished": {
	"version": "3.7.0",
	"resolved": "https://registry.npmjs.org/polished/-/polished-3.7.0.tgz",
	"integrity": "sha512-1tnvQ2wsxfR/DyPE2Xu9sRbnLAwXAarCWiZJ8Hfirw59bTigqjbzEWSAmzYizT6ocQW995V8n7RP48jq50DjJA==",
	"dev": true,
	"requires": {
		"@babel/runtime": "^7.12.5",
		"@scarf/scarf": "^1.1.0"
	}
},

[nzacca]

@phated

Just to clarify my previous comment, this is the only reference to polished. We are not using polished directly in our codebase.

[phated]

Thanks for that information. It seems that we lock polished to 3.6.7 in the monorepo config and it was added in 3.7.0

I'm unsure how the team wants to handle this (or not).

[nzacca]

Thanks for looking into this. FWIW, I think folks should at least be aware about this change so that, if they need/want to, they can disable scarf in their own repository.

Again, I'm not here to debate what Storybook's response should be to this but I do feel the community should be aware that this package will eventually end up in their chain and will need to opt-out of this behavior themselves (if they don't want it).