First mention (it was changed later) was added 6 days ago (threat was created 2 days ago): https://www.npmjs.com/package/nanocolors/v/0.1.2
Webpack team ask Colorette’s author to rollback API 2.x changes here (discussion was cleaned by Colorette’s author, but he said that it is how it see the best API): https://github.com/jorgebucaran/colorette/issues/70
> why not drop your fork now that colorette has changed the API back?
Author continued to act impulsively. He rolled back API in patch release instead of major made breaking changes.