Executive brief
The maintainer of faker.js, a popular npm library used by developers to generate test data, deliberately removed all functional code from the package, rendering it completely unusable. This appears to be a deliberate act similar to a concurrent incident in the colors.js library, where maintainers intentionally sabotaged their own widely-depended-upon packages. Any application relying on faker.js for data generation will fail immediately.
Technical details
faker.js is a Node.js/npm library providing data generation utilities for testing and development. The maintainer deliberately stripped out all functional code from version 6.6.6 and later versions in the 6.x release line, resulting in a broken package that cannot perform its intended purpose. This is not a traditional security vulnerability with an exploitable flaw, but rather a supply-chain integrity issue where the maintainer abused their control over the package to sabotage it—similar to the concurrent colors.js incident where an infinite loop was intentionally added. The attack vector is simple: any downstream application that updates to the affected versions will immediately fail. A forked and maintained version of the package (now under @faker-js/faker namespace on npm) is available as an alternative.
Affected products
- Marak faker.js 6.6.6 and later in 6.x series
Timeline
- 2022-03-22: disclosed: Vulnerability published in GitHub Advisory Database
- 2022-01-08: other: Related colors.js sabotage became public