Re:What NPM should do to stop a new colors attack
by chii on Monday January 10, 2022 @11:22PM
(#29887506)
> a maintainer decides to break backwards compatibility with their next release and breaks your code?
a maintainer breaking backwards compatibility is not malicious.
The faker.js code is intended to be malicious, and thus should be treated differently to another project which might break your code in other ways. Because it's not about breaking code, it's about the maliciousness - the same would still apply if the faker.js trojan is more hidden, and thus was not discovered (e.g., they embed a crypto-miner into the library and extract compute resources secretly from those who use it).
a maintainer breaking backwards compatibility is not malicious.
The faker.js code is intended to be malicious, and thus should be treated differently to another project which might break your code in other ways. Because it's not about breaking code, it's about the maliciousness - the same would still apply if the faker.js trojan is more hidden, and thus was not discovered (e.g., they embed a crypto-miner into the library and extract compute resources secretly from those who use it).