Why Did the Colors and Faker NPM Packages Suddenly Break Thousands of Apps?

Background

In early 2021 developers noticed that programs using the open‑source npm packages colors and faker began outputting garbled, non‑ASCII "Zalgo" text, effectively crashing consoles.

Both libraries are extremely popular: colors receives over 20 million weekly downloads and is used by nearly 19 000 projects, while faker sees more than 2.8 million weekly downloads and is even included in Amazon's AWS CDK.

Malicious Update

The issue originated from a new release by developer Marak Squires . He published [email protected]‑liberty‑2 and [email protected], inserting a "new American flag module" that contains an infinite loop printing the string "LIBERTY LIBERTY LIBERTY" followed by a long sequence of Zalgo characters.

This code caused any project that depended on these libraries to flood the console with endless non‑ASCII characters, rendering the applications unusable.

Community Reaction

Developers quickly identified the culprit and many rolled back to previous stable versions (e.g., colors 1.4.0), which resolved the issue.

Some community members expressed understanding of Marak’s frustration over large companies profiting from free open‑source work without compensation, while others condemned the sabotage as irresponsible.

Security expert VessOnSecurity called the behavior "truly irresponsible," and GitHub temporarily suspended Marak’s access to public and private repositories.

NPM has restored the faker package to its previous version, and GitHub has paused my access to all projects. I have over 100 projects.

Broader Context

The incident echoes the recent Log4j vulnerability, underscoring how widely used open‑source components can become attack vectors and how corporate reliance on free code raises ethical questions about compensation for maintainers.

Discussions also referenced Aaron Swartz, highlighting historical activism for free information access.

Takeaways

Always pin dependencies to known safe versions.

Monitor upstream changes for unexpected behavior.

Consider the sustainability and compensation models for open‑source maintainers.

Reference: BleepingComputer article