Version 6.6.6 of faker was sabotaged (protestware). Other versions are not flagged as malicious. npm's latest tag points to 6.6.6, one of these versions, so an unpinned install gets it.
Protestware / sabotage. Added to CyberXYZ 2022-01-08, verified by a CyberXYZ analyst.
The maintainer (marak) published version 6.6.6 on 2022-01-05 with the library code removed: the package ships no index.js, so require('faker') fails, and its README reads "What really happened with Aaron Swartz?". Earlier releases were not deleted: npm still serves 28 of them, 1.0.0 to 5.5.3 (checked 2026-10-23). Three days later the same maintainer published the colors sabotage release (colors 1.4.44-liberty-2, 2022-01-08).
Use faker@5.5.3 or switch to @faker-js/faker which is community-maintained.
0 direct dependencies
none carry a known advisory
18 packages depend on it
an advisory here reaches each of them
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
severity band, no base score published
chance of exploitation in 30 days
CyberXYZ composite out of 10
fig. 01 — GHSA-5w9c-rv96-fr7g, the advisory selected below
Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to the colors.js CVE-2021-23567.
The functional code for this package was forked and can be found here.
Checked 2026-11-06 at 17:25 UTC. The most recent advisory here was published 2022-03-22. Updated continuously from NVD, GHSA, OSV and CNA feeds.