@cyberhub/trust-colors 1.0.0 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +85 -22
- package/package.json +16 -4
package/README.md
CHANGED
|
@@ -1,38 +1,101 @@
|
|
|
1
1
|
# Security Trust Report: colors
|
|
2
2
|
|
|
3
|
-
**
|
|
3
|
+
**colors@1.4.0: 47/100 | Grade: C | Tier: CAUTION** (confidence: ±3)
|
|
4
4
|
|
|
5
|
-
>
|
|
5
|
+
> Data verified on 2026-04-02 from 8 security databases.
|
|
6
|
+
|
|
7
|
+
## TL;DR
|
|
8
|
+
|
|
9
|
+
- **1 vulnerability found** (1 critical, 0 high)
|
|
10
|
+
- Consider switching to **chalk** (Most popular terminal color library)
|
|
11
|
+
- **Action required:** Review flags below and upgrade or replace this package
|
|
12
|
+
|
|
13
|
+
## ⚠️ Security Incident Background
|
|
14
|
+
|
|
15
|
+
In January 2022, maintainer marak deliberately sabotaged the package by adding an infinite loop, causing applications to print garbage text. This was a protest against large corporations using open-source without compensation.
|
|
6
16
|
|
|
7
17
|
## Score Breakdown
|
|
8
18
|
|
|
9
|
-
|
|
19
|
+
```
|
|
20
|
+
Maintainer Trust: █████████░░░░░░░░░░░ 44/100
|
|
21
|
+
Package Health: ██████████████████░░ 88/100
|
|
22
|
+
Supply Chain: ██░░░░░░░░░░░░░░░░░░ 10/100
|
|
23
|
+
Community: █████████░░░░░░░░░░░ 47/100
|
|
24
|
+
```
|
|
25
|
+
|
|
26
|
+
### Why this score?
|
|
27
|
+
|
|
28
|
+
- Maintainer Trust is 44 because: single maintainer (bus factor risk)
|
|
29
|
+
- Supply Chain is 10 because: 1 known CVEs, in breach database
|
|
30
|
+
- Community is 47 because: no GitHub repo found
|
|
31
|
+
|
|
32
|
+
## Vulnerabilities (1 vulnerability)
|
|
33
|
+
|
|
34
|
+
| Severity | Count |
|
|
10
35
|
|----------|-------|
|
|
11
|
-
|
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
36
|
+
| 🔴 Critical | 1 |
|
|
37
|
+
|
|
38
|
+
## Key Risk Flags
|
|
39
|
+
|
|
40
|
+
- 🔴 **CRITICAL**: Package name "colors" is 2 edit(s) from popular "cors"
|
|
41
|
+
- 🔴 **CRITICAL**: HISTORICAL BREACH: Maintainer sabotaged with infinite loop (2022)
|
|
42
|
+
- 🔴 **CRITICAL**: 1 CRITICAL vulnerability(ies) from live CVE databases
|
|
43
|
+
- 🔴 **CRITICAL**: Maintainer "marak" has history of package sabotage
|
|
44
|
+
|
|
45
|
+
## 🛠️ What Should You Do?
|
|
15
46
|
|
|
16
|
-
|
|
47
|
+
**Immediate:**
|
|
48
|
+
- Upgrade to the latest version (`npm update colors`)
|
|
49
|
+
- Review the security incident details above
|
|
50
|
+
- Consider replacing with [chalk](https://nrupak.com/trust/chalk)
|
|
17
51
|
|
|
18
|
-
|
|
52
|
+
**Always:**
|
|
53
|
+
- Pin exact version: `"colors": "1.4.0"`
|
|
54
|
+
- Run `pkgtrust scan` in your CI pipeline
|
|
55
|
+
- Monitor: [nrupak.com/trust/colors](https://nrupak.com/trust/colors)
|
|
19
56
|
|
|
20
|
-
##
|
|
57
|
+
## 🔄 Safer Alternatives
|
|
21
58
|
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
- **MEDIUM**: Single maintainer — bus factor risk
|
|
28
|
-
- **MEDIUM**: Package dormant — last published 2383 days ago
|
|
29
|
-
- **MEDIUM**: No GitHub repo found — community signals unavailable
|
|
30
|
-
- **LOW**: Single maintainer using free email service
|
|
31
|
-
- **INFO**: Published with 2FA enabled (signed)
|
|
59
|
+
| Package | Why | Trust Report |
|
|
60
|
+
|---------|-----|-------------|
|
|
61
|
+
| **chalk** | Most popular terminal color library | [View score](https://nrupak.com/trust/chalk) |
|
|
62
|
+
| **picocolors** | Tiny, fast, zero dependencies | [View score](https://nrupak.com/trust/picocolors) |
|
|
63
|
+
| **kleur** | Lightweight alternative | [View score](https://nrupak.com/trust/kleur) |
|
|
32
64
|
|
|
33
65
|
## Maintainers
|
|
34
66
|
|
|
35
|
-
- marak (
|
|
67
|
+
- **marak** ✅ 2FA enabled (freemail)
|
|
68
|
+
|
|
69
|
+
## Methodology
|
|
70
|
+
|
|
71
|
+
This score is computed from **18+ signals** across **4 categories**:
|
|
72
|
+
- **Maintainer Trust (35%)**: Account age, 2FA, publish cadence, maintainer changes, email domain
|
|
73
|
+
- **Package Health (25%)**: Install scripts, dependency count, license, provenance, size changes, code quality
|
|
74
|
+
- **Supply Chain (25%)**: Live CVEs from 8 databases, known breaches, typosquatting, transitive risk
|
|
75
|
+
- **Community (15%)**: GitHub stars, contributors, CI, OpenSSF Scorecard, npms.io quality
|
|
76
|
+
|
|
77
|
+
[Full scoring methodology →](https://nrupak.com/trust)
|
|
78
|
+
|
|
79
|
+
## Check Your Project
|
|
80
|
+
|
|
81
|
+
```bash
|
|
82
|
+
# Install pkgtrust
|
|
83
|
+
npm install -g @cyberhub/pkgtrust
|
|
84
|
+
|
|
85
|
+
# Scan a specific package
|
|
86
|
+
pkgtrust scan colors
|
|
87
|
+
|
|
88
|
+
# Scan all your dependencies
|
|
89
|
+
pkgtrust scan
|
|
90
|
+
|
|
91
|
+
# Compare alternatives
|
|
92
|
+
pkgtrust compare colors chalk picocolors
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
**Data Sources:** GitHub Advisories · OSV.dev · npm audit · Snyk · Socket.dev · npms.io · Bundlephobia · deps.dev
|
|
36
96
|
|
|
37
97
|
---
|
|
38
|
-
|
|
98
|
+
|
|
99
|
+
*Report by [pkgtrust](https://nrupak.com/trust/colors) · [Dashboard](https://nrupak.com/trust) · [Compare](https://nrupak.com/trust/compare) · [CLI](https://npmjs.com/package/@cyberhub/pkgtrust)*
|
|
100
|
+
|
|
101
|
+
*This is an automated security report. Not affiliated with the colors team. Updated 2026-04-02.*
|
package/package.json
CHANGED
|
@@ -1,17 +1,29 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cyberhub/trust-colors",
|
|
3
|
-
"version": "1.0.
|
|
4
|
-
"description": "Security Trust Report
|
|
3
|
+
"version": "1.0.2",
|
|
4
|
+
"description": "Security Trust Report: colors@1.4.0 — 47/100 (C, caution). 1 vulnerability found. Maintainer risk, supply chain analysis from 8 security databases.",
|
|
5
5
|
"keywords": [
|
|
6
|
+
"colors",
|
|
6
7
|
"colors",
|
|
7
8
|
"security",
|
|
9
|
+
"security-report",
|
|
8
10
|
"trust-score",
|
|
9
11
|
"vulnerability",
|
|
12
|
+
"npm-audit",
|
|
13
|
+
"npm-security",
|
|
14
|
+
"supply-chain",
|
|
10
15
|
"pkgtrust",
|
|
11
|
-
"
|
|
16
|
+
"audit",
|
|
17
|
+
"scan",
|
|
18
|
+
"risk",
|
|
19
|
+
"risk-assessment",
|
|
20
|
+
"chalk",
|
|
21
|
+
"picocolors",
|
|
22
|
+
"kleur",
|
|
23
|
+
"caution"
|
|
12
24
|
],
|
|
13
25
|
"license": "MIT",
|
|
14
|
-
"author": "Nrupak Shah",
|
|
26
|
+
"author": "Nrupak Shah <nrupaks@gmail.com>",
|
|
15
27
|
"repository": {
|
|
16
28
|
"type": "git",
|
|
17
29
|
"url": "https://github.com/nrupaks/pkgtrust"
|