{"id":102934,"date":"2022-01-10T15:36:46","date_gmt":"2022-01-10T13:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%80%d0%b0%d0%b7%d1%80%d0%b0%d0%b1%d0%be%d1%82%d1%87%d0%b8%d0%ba-%d0%b2%d0%bd%d1%91%d1%81-%d0%b4%d0%b5%d1%81%d1%82%d1%80%d1%83%d0%ba%d1%82%d0%b8%d0%b2%d0%bd%d1%8b%d0%b5-%d0%b8%d0%b7%d0%bc%d0%b5"},"modified":"2022-01-10T15:36:46","modified_gmt":"2022-01-10T13:36:47","slug":"%d1%80%d0%b0%d0%b7%d1%80%d0%b0%d0%b1%d0%be%d1%82%d1%87%d0%b8%d0%ba-%d0%b2%d0%bd%d1%91%d1%81-%d0%b4%d0%b5%d1%81%d1%82%d1%80%d1%83%d0%ba%d1%82%d0%b8%d0%b2%d0%bd%d1%8b%d0%b5-%d0%b8%d0%b7%d0%bc%d0%b5","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/%d1%80%d0%b0%d0%b7%d1%80%d0%b0%d0%b1%d0%be%d1%82%d1%87%d0%b8%d0%ba-%d0%b2%d0%bd%d1%91%d1%81-%d0%b4%d0%b5%d1%81%d1%82%d1%80%d1%83%d0%ba%d1%82%d0%b8%d0%b2%d0%bd%d1%8b%d0%b5-%d0%b8%d0%b7%d0%bc%d0%b5","title":{"rendered":"The developer has made destructive changes to the NPM packages colors and faker, used in 20,000 projects.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Marak Squires, the author of popular packages colors (node.js console coloring) and faker (a mock data generator for input fields), which have 2.8 and 25 million weekly downloads respectively, has released new versions of his products in the NPM repository and on GitHub, featuring destructive changes that deliberately lead to build and runtime failures in dependent projects. As a result of Marak's actions, the functionality of many projects has been disrupted, including AWS CDK, which uses the mentioned libraries \u2014 the colors library is a dependency for 18,953 projects, and faker for 2,571. <\/p>\n
The code of the 'colors' library was modified to output the text 'LIBERTY LIBERTY LIBERTY' to the console and included an infinite loop that blocks the operation of dependent projects, outputting a stream of garbled words 'tesing'. In the faker library, the repository content was removed; in the 'endgame' commit, .gitignore and .npmignore files were added to exclude project files, and instead of the contents of the README file, a question was posted: 'What really happened to Aaron Schwartz?'. Issues are present in versions colors 1.4.1+ and faker 6.6.6.
<\/center> <\/p>\n
In response to these actions, GitHub blocked Marak's access to his repositories (90 public + several private), while NPM rolled back the malicious version of the package. However, the legality of GitHub's actions is questionable, as a developer's removal of code from one of their own repositories cannot be considered a violation of service rules. Furthermore, the text of the licenses for the colors and faker packages explicitly states that there are no guarantees or obligations concerning the functionality of the code. <\/p>\n
Interestingly, the first warning about the cessation of development was published more than a year ago. In September 2020, Marak lost all his possessions due to a fire, after which in early November he made an ultimatum call for commercial companies using his projects to fund the continuation of development; otherwise, he promised to discontinue maintenance, as he no longer intended to work for free. Before the incident, the last version of colors was released two years ago, while faker was released nine months ago. <\/p>\n
Regarding the motives for introducing destructive changes to the packages, it is likely that Marak is trying to teach a lesson to corporations that benefit from the work of the open-source developer community without giving anything in return, or to draw attention to the rethinking of the circumstances surrounding Aaron Schwartz's death. Aaron took his own life after being charged with a criminal case related to copying scientific articles from the paid database JSTOR, advocating for the idea of providing open access to scientific publications. Aaron faced charges of computer fraud and unauthorized access to a protected computer, with a maximum penalty of 50 years in prison and a million-dollar fine (if a plea deal was reached, Aaron would have to serve 6 months in jail). <\/p>\n
It is believed that Aaron, in the midst of depression, could not withstand the pressure of the judicial system and the injustice of the charges against him (he was facing 50 years in prison merely for downloading content from a database of scientific articles that, in his opinion, should be freely accessible). Marak Squires, in a published question regarding Aaron's death, instead of the removed code, and in a Twitter post, hints at an unverified conspiracy theory, suggesting that Aaron Schwartz found certain documents in the MIT archive that compromised certain important individuals, and he was killed for it, disguised as suicide (tomorrow marks 9 years since Aaron left us). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"The](\"\/wp-content\/uploads\/2022\/01\/bc0419ba085022b07c360deb3b1a9de5.jpg\")
<\/center> <\/p>\n