Rescued and active
colors.js
Get colors in your Node.js console — the package that broke the internet in January 2022
- Abandoned:
- 4y ago
- License:
- MIT
The story
Marak Squires wrote colors.js in 2013. It became a transitive dependency of basically every Node project (5.1k stars, included in Express, npm, and a thousand other libraries). On January 7, 2022, Marak pushed versions 1.4.1 and 1.4.2 that intentionally outputted infinite ASCII art, breaking thousands of apps worldwide. He later pushed a corrupted commit that wiped the README. The repo was effectively abandoned by GitHub (it's still there, but the npm package was unpublished and re-published with a security advisory). The community forked it (qix-/color, ansi-colors). The story is now a case study in supply chain risk. Worth a rescue only by someone committed to rebuilding the community trust from zero.
For maintainers
Have a project of your own?
Two minutes to drop. You stay credited. Someone out there wants to take it on.
Drop a project →For developers
Not ready to adopt this one?
Browse 3 other waiting projects on the feed. Or use the free audit to see what your own org is depending on.
Browse the feed Free audit