Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01dzljLXJ2OTYtZnI3Z801FQ

Removal of functional code in faker.js

Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to the colors.js CVE-2021-23567.

The functional code for this package was forked and can be found here.

Permalink: https://github.com/advisories/GHSA-5w9c-rv96-fr7g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01dzljLXJ2OTYtZnI3Z801FQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-5w9c-rv96-fr7g
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-23567
• https://github.com/Marak/colors.js/issues/285
• https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640
• https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6#diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18
• https://github.com/advisories/GHSA-gh88-3pxp-6fm8
• https://snyk.io/vuln/SNYK-JS-COLORS-2331906
• https://www.npmjs.com/package/@faker-js/faker
• https://www.npmjs.com/package/faker
• https://github.com/advisories/GHSA-5w9c-rv96-fr7g

Repository: https://github.com/Marak/colors.js
Blast Radius: 0.0

Affected Packages