Executive brief
The colors library is a popular Node.js package used to add colored text output to console applications. Between January 7–9, 2022, malicious code was injected into versions 1.4.1, 1.4.2, and 1.4.44-liberty-2, introducing an infinite loop that causes applications to hang and consume unbounded system resources, printing random characters to the console. Any application depending on these specific versions will experience service disruption until downgraded to version 1.4.0.
Technical details
This vulnerability is a malicious code injection (CWE-835: Loop with Unreachable Exit Condition) introduced in the colors npm library's lib/index.js file. The root cause is a for-loop with an invalid syntax (missing increment operation: `for (let i = 666; i < Infinity; i++; )` with a trailing semicolon that breaks the loop increment logic), creating an infinite loop that triggers on library import. The attack vector is supply-chain compromise—affected versions are automatically pulled when dependencies are installed. No authentication or user interaction is required; any application that installs or updates to the affected versions will be immediately impacted upon startup or when the library is required. An attacker can cause complete service unavailability, process hangs, and exhaustion of CPU and memory resources. The maintainer released fixes in subsequent commits removing the malicious loop, and users are advised to downgrade to version 1.4.0 or upgrade to a patched version.
Affected products
- npm colors 1.4.1, 1.4.2, 1.4.44-liberty-2
Timeline
- 2022-01-10: disclosed: GHSA-5rqg-jm4f-cqx7 published
- 2022-01-07: exploited: Malicious versions 1.4.1, 1.4.2, and 1.4.44-liberty-2 released between January 7-9, 2022
- 2022-01-10: patched: Commits 5d2d242 and 6bc50e7 fixed the infinite loop