npm Libraries ‘colors’ and ‘faker’ Sabotaged in Protest by their Maintainer

The author of these npm libraries intentionally committed corrupt versions containing infinite loops, effectively causing a denial of service.

Impact

This incident affected a large but unknown number of users and impacting large downstream projects such as aws-cdk, Jest and Node.js Open CLI Framework.

It triggered another wave of conversations around pinning (locking) dependencies for future-proofing.

A few weeks after this incident, it was announced that the Top-100 npm package maintainers now require 2FA.

Type of Compromise

This incident fits the malicious maintainer definition.

References