Version 1.4.44-liberty-2 of colors was sabotaged (protestware). Other versions are not flagged as malicious.
Do not install colors 1.4.44-liberty-2
HIGHanalyst verified
Protestware / sabotage. Added to CyberXYZ 2022-01-08, verified by a CyberXYZ analyst.
// what we observed
Maintainer marak deliberately introduced an infinite loop printing LIBERTY LIBERTY LIBERTY. Sabotage caused downstream breakage in thousands of projects.
motive
protest
maintainer
marak
attack vector
intentional_sabotage
// versions and what to do
Malicious
1.4.44-liberty-2
Move to
Upgrade to the latest release that is not listed above.
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Checked 2026-11-06 at 21:39 UTC. The most recent advisory here was published 2022-01-21. Updated continuously from NVD, GHSA, OSV and CNA feeds.