MODULE_NOT_FOUND warnings for @mitre/emass_client axios dependency at startup

[aaronlippold]

Description

When SAF CLI starts, it outputs many MODULE_NOT_FOUND warnings related to the @mitre/emass_client package trying to find axios:

(node:13864) [MODULE_NOT_FOUND] Warning: ModuleLoadError
module: @oclif/core@3.27.0
task: findCommand (emasser:delete:artifacts)
plugin: @mitre/saf
root: /usr/local/lib/node_modules/@mitre/saf
code: MODULE_NOT_FOUND
message: [MODULE_NOT_FOUND] require failed to load /usr/local/lib/node_modules/@mitre/saf/lib/commands/emasser/delete/artifacts.js: Cannot find module '@mitre/emass_client/node_modules/axios'

This warning repeats for all emasser commands (~1200+ lines of warnings).

Impact

• Functional: Commands still work - this is a warning, not an error
• User Experience: Very noisy output obscures actual results
• CI/CD: Pollutes logs, makes debugging harder

Root Cause Analysis

1. @mitre/emass_client (v3.22.0) declares axios: ^1.6.1 as a direct dependency
2. SAF CLI also has axios: ^1.5.0 as a dependency
3. npm hoists axios to SAF's top-level node_modules/axios
4. The emass_client code does normal require("axios") which should resolve via Node's module resolution
5. However, something is causing Node to look specifically in @mitre/emass_client/node_modules/axios instead of walking up the tree

The generated emass_client code is standard:

// dist/api.js:93
var axios_1 = require("axios");

This happens during oclif's findCommand discovery phase at startup.

Possible Fixes

1. In emass_client: Change axios from dependencies to peerDependencies
2. In SAF CLI: Add axios version resolution/override
3. Investigation needed: Check if this is an npm/node version issue or oclif module resolution behavior

Environment

• Observed in GitHub Actions CI (ubuntu-latest)
• SAF CLI installed globally via npm
• Node.js version from CI runner

Workaround

For now, stderr can be suppressed:

export NODE_NO_WARNINGS=1
saf summary --input results.json 2>/dev/null

Related

• @mitre/emass_client: https://github.com/mitre/emass_client
• axios dependency declared at: src/typescript_client/package.json