event-stream VS faker.js

Another possible outcome of "I gave commit rights to someone I didn't know": https://github.com/dominictarr/event-stream/issues/116

Whole npm ecosystem is so fragile.

Remember event-stream[1]? Did we learned something from that? Yes, we might. So was it improved? Never. People are still installing 'new' colors package and wondering why its texts are broken.

What if he uploaded malicious code rather than just just gibberish?

[1]: https://github.com/dominictarr/event-stream/issues/116

foo-bar version 1.0 depends on bada-boom 1.0 which depends on bada-bing 1.0. Now you update to foo-bar 1.1 because of some critical update, which in itself now depends on bada-boom 2.0 and bada-bing 2.0. But unbeknownst to you and the author of foo-bar, the bada-boom and bada-bing project was taken over by another maintainer who made an update, but also added some trojan horse code to specifically attack certain users, which was obfuscated and remained undetected. Which has happened before - not just browser extensions are affected by malicious attackers taking over useful projects.

I think Faker is your friend here: https://www.npmjs.com/package/faker

✅ Use API / libraries to quickly generate test data - Instead of creating test data via the UI, it is significantly faster via API or libraries. Plug-ins such as faker or running API's can be included in the test scripts before any UI functionality is performed.

We also use the faker package (locked to version 5.5.3, since the latest version no longer works as expected). This library is often used for generating fake test data, but its API includes a set of calls for generating company buzz phrases. That’s what Buzz will use to generate the phrases we’re looking for.

They supposedly took over the npm packages[0,1], not the github.com repos. npm is a system where you push archives as package versions, it doesn't do its own pull from a github repo or otherwise.

0: https://www.npmjs.com/package/colors

1: https://www.npmjs.com/package/faker

This week, if you tried to install Faker.js (a very popular library for creating mocks) you've noticed version was set on "6.6.6" and all code was gone with the text "What really happened with Aaron Swartz?".

About Four (4) Days Ago, the Author of Fakerjs a popular JavaScript library with more than 2 million weekly Download from NPM Deleted the repository and replaced it with one that only has the modified ReadMe "What really happened with Aaron Swartz?" and no content, and pushed an empty package to npm as the latest version (6.6.6).

https://www.npmjs.com/package/faker