# Does the NPM faker/colors story relate to/affect the Julia package system?

**URL:** <https://discourse.julialang.org/t/does-the-npm-faker-colors-story-relate-to-affect-the-julia-package-system/74330>\
**Category:** Package Management\
**Created:** [January 10, 2022, 12:17pm UTC](https://discourse.julialang.org/t/does-the-npm-faker-colors-story-relate-to-affect-the-julia-package-system/74330 "2022-01-10T12:17:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sloede](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/sloede/32/44787_2.png) [@sloede](https://discourse.julialang.org/u/sloede)\
**Post date:** [January 10, 2022, 12:17pm UTC](https://discourse.julialang.org/t/does-the-npm-faker-colors-story-relate-to-affect-the-julia-package-system/74330/1 "2022-01-10T12:17:24Z")

</div>

I stumbled across [this article](https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/), where it was reported that the developer of popular NPM packages `colors` and `faker` decided to go rogue and deliberately destroy the usability of their packages. Since many packages depend on those packages (mostly indirectly), this broke many extremely popular tools. It is certainly not the first time this happened in the NPM ecosphere: there was another small NPM package a few years ago, `leftpad`, which similarly broke millions of packages, and likely there were a few in between that I missed.

I don’t know if this is the right venue to discuss this, or if anyone else is even concerned, but I see similarities to how the Julia package system is set up and I cannot stop asking myself,

1. Could something similar happen to Julia as well?
2. _Did_ this already happen?
3. Is this something the Julia/Pkg.jl “core developers” (whatever that means) think about and are there mitigation strategies in place?

I’d be interested in hearing your thoughts on this, especially when considering that reproducibility is one of the top six (or three, depending on how you see it) unique selling propositions.

---

<div class="post-metadata">

**Author:** ![lawless-m](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/lawless-m/32/30869_2.png) [@lawless-m](https://discourse.julialang.org/u/lawless-m)\
**Post date:** [January 10, 2022, 12:36pm UTC](https://discourse.julialang.org/t/does-the-npm-faker-colors-story-relate-to-affect-the-julia-package-system/74330/2 "2022-01-10T12:36:51Z")

</div>

Compat does help but it won’t solve everything

Various troubles people have had [Search results for 'downgrade' - JuliaLang](https://discourse.julialang.org/search?q=downgrade)

That random package you installed from GitHUb because of CoolFeature could turn round and rm -rf all your files, execute a RansomeWare attack etc. when you `]update` and run it.