Marak Squires, the author of popular packages colors (node.js console coloring) and faker (a generator of fake data for input fields), which have 2.8 and 25 million weekly downloads respectively, has released new versions of his products in the NPM repository and on GitHub. These versions include destructive changes intentionally causing failures during the build and execution stages of dependent projects. As a result of Marak's actions, many projects have been disrupted, including AWS CDK, which utilize the mentioned libraries — the colors library is a dependency for 18,953 projects, while faker is used by 2,571.
The code for the 'colors' library has been modified to include console output of the text "LIBERTY LIBERTY LIBERTY" and an infinite loop that blocks the operation of dependent projects, producing a stream of garbled words "tesing". In the faker library, the repository content has been deleted, with the commit "endgame" adding .gitignore and .npmignore files to exclude project files, and instead of the README file content, there's a question: "What really happened to Aaron Schwartz?" Issues are present in versions colors 1.4.1+ and faker 6.6.6.
In response to these actions, GitHub blocked Marak's access to his repositories (90 public + several private), while NPM rolled back the malicious version of the package. However, the legality of GitHub's actions is questionable, as a developer's removal of code from one of their own repositories cannot be considered a violation of service rules. Furthermore, the text of the licenses for the colors and faker packages explicitly states that there are no guarantees or obligations concerning the functionality of the code.
Interestingly, the first warning about the cessation of development was published over a year ago. In September 2020, Marak lost all his possessions due to a fire, after which in early November he issued an ultimatum to commercial companies using his projects, urging them to fund the continued development; otherwise, he promised to stop support, stating he no longer intended to work for free. Prior to the incident, the last version of colors was released two years ago, and faker — nine months ago.
Regarding the motives for introducing destructive changes to the packages, it is likely that Marak is trying to teach a lesson to corporations that benefit from the work of the open-source developer community without giving anything in return, or to draw attention to the rethinking of the circumstances surrounding Aaron Schwartz's death. Aaron took his own life after being charged with a criminal case related to copying scientific articles from the paid database JSTOR, advocating for the idea of providing open access to scientific publications. Aaron faced charges of computer fraud and unauthorized access to a protected computer, with a maximum penalty of 50 years in prison and a million-dollar fine (if a plea deal was reached, Aaron would have to serve 6 months in jail).
It is believed that Aaron, in the midst of depression, could not withstand the pressure of the judicial system and the injustice of the charges against him (he was facing 50 years in prison merely for downloading content from a database of scientific articles that, in his opinion, should be freely accessible). Marak Squires, in a published question regarding Aaron's death, instead of the removed code, and in a Twitter post, hints at an unverified conspiracy theory, suggesting that Aaron Schwartz found certain documents in the MIT archive that compromised certain important individuals, and he was killed for it, disguised as suicide (tomorrow marks 9 years since Aaron left us).
Source: opennet.ru
