HN Explorer

Careful: Faker-JS NPM package apparently taken over by spam

13 points by Aeolos ↗ HN
It looks like the faker-js github account has been taken over and a new fake version has been published: https://www.npmjs.com/package/faker

This is a popular project with >1.7M weekly downloads.

Please be warned and make sure you have pinned to an older version of the package.

6 comments

[ 0.24 ms ] story [ 23.6 ms ] thread
11235813213455
I just reported it to Github, there's a shady 6.6.6 version indeed
gitgud
Seems political, the current package has a single sentence in the README:

    "What really happened with Aaron Swartz?"
Previous versions are immutable on npm, however a minor or patch version on an older release would break a lot of things...

[1] https://www.npmjs.com/package/faker

[deleted]
(comment deleted)