What happened to Faker.js and how to secure your projects

The golden rule when installing external javascript modules is that we should prefer popular packages that are frequently updated. The Faker.js library has met all this, and tens of thousands of developers have used it to generate random data such as people's names or company names as a useful tool, during development or tests.

JavaScript developer destroys own projects in supply chain “lesson” – Sophos News

Code-Sabotage Incident in Protest of Ukraine War Exposed Open Source Risks

Malicious modifications to open source projects affecting thousands - Sysdig Secure – Sysdig

npm Libraries 'colors' and 'faker' Sabotaged in Protest by their Maintainer— What to do Now?

Farewell Faker, time to give a Chance, by Marcos Henrique da Silva

Detect unwanted dependencies in your software like versions of faker.js or colors.js - Codenotary

When open-source developers go bad

Malicious modifications to open source projects affecting thousands - Sysdig Secure – Sysdig

Verify documentation website for mastodon · Issue #1588 · faker-js/faker · GitHub

An update from the Faker team

The npm faker package and the unexpected demise of open source libraries

The story behind colors.js and faker.js

Security update about npm libraries 'colors' and 'faker