The maintainer deliberately sabotaged colors.js and faker.js with an infinite loop that printed garbage, breaking any app that depended on them.
colors had ~20M weekly downloads; broke countless CI pipelines and applications overnight.
A maintainer intentionally added disruptive or destructive behaviour, often politically motivated.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.