Supply Chain Incident
colors and faker npm protestware releases
The maintainer of colors and faker published intentionally disruptive releases that broke downstream consumers and demonstrated maintainer-driven supply-chain risk.
ConfidenceHigh
Evidence LevelPrimary
Attack StagePackage Publish
Source Artifact DivergenceNo
Affected Packages
Affected Releases
No structured records.
Repositories
Organizations
No structured records.
Maintainers
Threat Actors
No structured records.
Campaigns
No structured records.
Build Systems
No structured records.
Distribution Channels
- npm registry
Compromised Accounts
No structured records.
Connected Entities
- colorsPackage
- fakerPackage
- Marak SquiresMaintainer
- Marak/colors.jsRepository
- npm registryDistribution Channel
References
- colors.js issue discussion after disruptive releaseGitHub · 2022-01-09