Open Source · · 5 days

faker.js npm maintainer sabotage broke apps

The maintainer of faker.js intentionally sabotaged the project, force-pushing an endgame commit and publishing version 6.6.6 to npm in a broken, largely non-functional state.

Part of faker.js and colors.js sabotage broke apps campaign

faker.js was a common development dependency for generating test data. In January 2022, the maintainer used direct project control to push an "endgame" commit and publish version 6.6.6 to npm.

The package did not hide a credential stealer or loader. It broke the contract of the library. Consumers expecting names, addresses, and other generated data instead received a package that no longer served its normal API in a usable way.

The effect was amplified by dependency graphs. Projects that treated faker.js as a routine utility saw builds and applications fail after an ordinary dependency resolution step. The release channel did exactly what it was designed to do: distribute the maintainer's latest package.

The community moved the project under new stewardship at faker-js/faker and downstream users pinned, replaced, or upgraded dependencies. The incident remains useful because it separates provenance from safety: official code can still be hostile code.

Appendix · Affected releases

faker.js
6.6.6 sha256 719c492d…14f4ffae download unavailable
  • The removed 6.6.6 npm tarball is recovered from Wayback, but its measured hash differs from the hash previously recorded here; both values remain documented.
  • No same-coordinate fixed release followed the endgame publish; the project moved to the faker-js/faker stewardship and package line.

Indicators

  • file_sha256faker-6.6.6.tgz 719c492d6a4b3642dbef74fa10d17fc44194ace0ea4cf029d5a5041614f4ffae

References

  1. faker.js issue discussing the endgame releasegithub.com
  2. Dev corrupts npm libs colors and faker breaking thousands of appsbleepingcomputer.com
  3. Open source npm packages colors and faker sabotagedsnyk.io
  4. faker.js and colors.js maintainer intentionally sabotages popular npm librariesblog.sonatype.com
  5. Wayback capture of faker 6.6.6 npm tarballweb.archive.org

Source record: oss/attacks/faker.js/meta.yaml