An author broke His Own Libraries Deliberately

When a maintainer sabotaged colors.js and faker.js, a labour question became an operational emergency.

The protest that broke builds

On 8 January 2022, Marak Squires pushed updates to two npm packages he maintained — colors.js and faker.js — that did not fix bugs or add features. colors.js began printing an infinite loop of gibberish and ANSI art to any terminal that loaded it. faker.js, a library for generating realistic fake data used heavily in test suites, was replaced at its GitHub repository with a near-empty file and a README demanding that corporations pay open-source maintainers or hire them full-time. Both packages had cumulative weekly download counts in the tens of millions. Within hours, dependent projects were broken in production.

The proximate cause was documented: Squires had been vocal for some time about the economics of open-source maintenance. He had pointed to the pattern in which large companies build revenue-generating products on freely maintained libraries while contributing nothing back — a pattern familiar enough that it had already produced manifestos, burnt-out maintainers, and intermittent funding experiments across the ecosystem. npm's dependency model, which Isaac Z. Schlueter had built to make installation trivially easy, had also made it trivially easy for thousands of companies to take a hard dependency on software one person maintained for free.

What the breakage revealed

The operational fallout was swift and clarifying. Projects that had pinned to exact versions — specifying a precise release number rather than a floating range — were unaffected. Projects that had trusted semantic versioning's promise of safe minor and patch upgrades, and left their package.json open enough to pull new releases automatically, pulled the sabotaged versions and broke. The distinction between "I pinned this" and "I let npm resolve this" was suddenly not an abstract engineering preference but the difference between a working build and an incident.

GitHub responded by restoring older versions of the faker.js repository from its own records. npm retained the published versions of packages on its registry under its unpublish policy — packages downloaded at scale cannot simply vanish, as the 2016 left-pad removal had already demonstrated — but it could not un-push a new version. The sabotaged releases remained reachable. The mitigation for most teams was to lock to a known-good prior version and treat any automatic upgrade as suspended until trust could be re-established.

The event-stream incident of 2018 had introduced a different threat model: malicious code injected into a package by a bad actor who had gained control of a repository. This was structurally the same mechanism — a trusted package publishing harmful changes — but the author was the original maintainer, acting openly, with a stated grievance. Nothing in npm's design distinguished between the two cases. A package you depend on can publish whatever it likes; that is what publishing means.

The question it left open

Colors.js and faker.js did not collapse the ecosystem. Pinned builds survived, forks proliferated immediately, and teams migrated quickly enough that the disruption, while real, was bounded. What the episode made permanent was a sharper awareness of what a dependency graph actually rests on: not a contract, not a service level, but the continued goodwill of whoever holds the publish keys.

The funding question Squires raised — how the labour of open-source maintenance is compensated — has no settled answer. Platforms such as GitHub Sponsors and Open Collective existed before 2022 and remain voluntary. The breakage did not produce a structural change. It produced a lesson in version pinning, a set of forks, and a clearer recognition that the arrangement most of the web's build tooling rests on is sustained by an informal agreement that can end at any time.