The maintainer deliberately sabotaged colors.js and faker.js with an infinite loop that printed garbage, breaking any app that depended on them.
colors had ~20M weekly downloads; broke countless CI pipelines and applications overnight.
A maintainer intentionally added disruptive or destructive behaviour, often politically motivated.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.