polyfill-node not working when building with remote

[joepio]

When trying to run snowpack build --polyfill-node in my project with packageOptions.source: remote, I get this error:

[snowpack] node_modules/noble-ed25519/index.js
   Module "crypto" (Node.js built-in) is not available in the browser. Run Snowpack with --polyfill-node to fix.

This seems wrong for multiple reasons:

• The crypto library is in fact available in the browser. The library which I use (noble-ed25519) uses the browser crypto API and explicitly targets browsers.
• I have added the --polyfill-node flag, and have even set packageOptions.polyfillNode: true.

[sanmai-NL]

What are your thoughts about the security impact of using streaming/remote dependencies over standard package manager dependencies?

[joepio]

Having a streamed and polyfilled crypto library hosted by some trusted party could work, but it's less secure than relying on a bundled or a browser-built-in library .

[sanmai-NL]

I see, but I mean, in your case. What’s your reason for attempting to use streaming imports, seeing you‘re working on e-democracy and with crypto. E.g. npm audit wouldn’t work anymore, would it?

[joepio]

For this particular project I don't think I want to / need to use streaming imports at all. I ended up disabling the remote part for this project, I think. I tried to start a simple React / Typescript / Snowpack project with the Solid-client-authn library, which used the crypto polyfill. For more details about this particular usecase, and the issue that I've encountered there's an issue here.

To be honest, it's been a couple of months, and I don't know when I exactly encountered this issue, and how (and if) I solved it. Since I was just toying around a bit, this issue isn't particularly relevant or blocking to me, though.