What NPM should do to stop a new colors attack
Over the weekend, a developer named Marak Squires intentionally sabotaged his popular NPM package colors and his less popular package faker . As I write this, NPM claims 18,971 direct dependents for colors and 2,751 for faker . Open Source Insights counts at least 42,000 more indirect dependents for colors . Many…