Careful: Faker-JS NPM package apparently taken over by spam | Hacker News Reader

Careful: Faker-JS NPM package apparently taken over by spam

13 pointsAeolos3 comments

It looks like the faker-js github account has been taken over and a new fake version has been published: https://www.npmjs.com/package/faker

This is a popular project with >1.7M weekly downloads.

Please be warned and make sure you have pinned to an older version of the package.

Seems political, the current package has a single sentence in the README:

    "What really happened with Aaron Swartz?"

Previous versions are immutable on npm, however a minor or patch version on an older release would break a lot of things...

The author had already said over a year ago he wouldn't work on it anymore, could equally be him just wiping it now.

I just reported it to Github, there's a shady 6.6.6 version indeed