colors.js

Marak Squires wrote colors.js in 2013. It became a transitive dependency of basically every Node project (5.1k stars, included in Express, npm, and a thousand other libraries). On January 7, 2022, Marak pushed versions 1.4.1 and 1.4.2 that intentionally outputted infinite ASCII art (the "Zalgo" incident), breaking thousands of apps worldwide. He later pushed a corrupted commit that wiped the README and published an unmaintained version with a security advisory (CVE-2022-24713). The npm package was unpublished and re-published. The community largely moved to alternatives like chalk, kleur, and picocolors. The Marak/colors.js repo is still on GitHub (5.1k stars, last commit 2023-06) but the original maintainer has stepped away. The story is now a case study in supply chain risk. Worth a rescue only by someone committed to rebuilding the community trust from zero.