Dev corrupts NPM libs 'colors' and 'faker' breaking thousands of apps

• colors.js

  52 5,174 0.0 JavaScript

  get colors in your node.js console

  Github did not revert code (go check the repo https://github.com/Marak/colors.js/commit/6bc50e79eeaa1d87369bb3e7e608ebed18c5cf26). Npmjs did with both faker and colors. This is in their policy and has been the procedure in many instances of malicious updates (e.g. left-pad, uaparser, and many more).

• CodeRabbit

  coderabbit.ai featured

  CodeRabbit: AI Code Reviews for Developers. Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.

  

• faker.js

  3 1,711 8.6 JavaScript

  Discontinued Generate massive amounts of fake data in the browser and node.js [Moved to: https://github.com/faker-js/faker] (by faker-js)

  

  For anyone needing it, here's the community maintained version of faker.js

• aws-cli

  49 15,631 9.8 Python

  Universal Command Line Interface for Amazon Web Services

  

  What makes GitHub's actions shitty? Marak's colors had 22 million downloads, including aws-cli. Blanking out a large repository like that, without so much as a warning, is irresponsible and choosing to partake in conspiracy theories is even more so.

• uvloop

  15 10,500 6.6 Cython

  Ultra fast asyncio event loop.

  

  Take a look at these guys: https://github.com/MagicStack They are a consultancy that obviously can make good stuff, their libraries are widely used by the Python community. This is how I would monetize your library honestly. It is a source of trust that can unlock other opportunities that would be much harder to obtain without it.

Suggest a related project