GitHub Advisoryadvisory · npm
GHSA-5w9c-rv96-fr7g Removal of functional code in faker.js
HIGH
Official page ↗
- Ecosystem
- npm
- Packages
- faker
- Severity
- High
- Reviewed
- 2022-03-22
Affected packages
• npm faker: 6.6.6 (no fix yet)
Description
Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to the colors.js CVE-2021-23567.
The functional code for this package was forked and can be found here.
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23567 advisory
- https://github.com/Marak/colors.js/issues/285 web
- https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640 web
- https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6#diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18 web
- https://github.com/Marak/Faker.js package
- https://github.com/advisories/GHSA-gh88-3pxp-6fm8 advisory
- https://snyk.io/vuln/SNYK-JS-COLORS-2331906 web
- https://www.npmjs.com/package/@faker-js/faker web
- https://www.npmjs.com/package/faker web