Maintainer Marak Squires deliberately sabotaged colors.js (23M weekly downloads) by publishing a version with an infinite loop printing "LIBERTY" zalgo text, and simultaneously published faker.js v6.6.6 as an empty package. His motivation was protest against corporations profiting from unpaid open source labor. AWS CDK, Jest, and thousands of projects broke immediately.
Sources: FOSSA analysis
SOURCE_SINGLE_CONTRIBUTOR pre-existing on both packages; PACKAGE_ACTIVE_MALWARE on infinite loop/deletion
| Tool | Verdict | Details |
|---|---|---|
| OSS Risk Guard | Caught | SOURCE_SINGLE_CONTRIBUTOR pre-existing on both packages; PACKAGE_ACTIVE_MALWARE on infinite loop/deletion |
| Socket | Partial | May flag anomalous code pattern but infinite loop is ambiguous |
| Sonatype (Nexus) | Partial | Firewall blocks after flagged; not proactive |
| Snyk | Missed | No protestware detection |
| Black Duck | Missed | No protestware detection |
| Endor Labs | Missed | No protestware detection |