What happened with faker.js

It seems Marak, the primary maintainer for Faker, has deliberately pulled Faker’s source code and history from their GitHub repository and published a non-functional package in its place.

For context, Marak has become known in recent history for some rather controversial comments regarding the late Aaron Swartz (whom they reference in Faker’s updated README) & advocating for compensation for their open-source contributions. You can see the comments on both this Hacker News thread from Nov 2020 and this Reddit thread from today (January 5th, 2022) for additional context.

If you continue to need the functionality Faker provides, npm maintains old versions for install – just be deliberate with the version you’re installing, i.e., npm i [email protected]. The full source and history is also maintained in @withshepherd’s fork on GitHub (published on NPM as @withshepherd/faker).

Unfortunately this is a known risk of this type of dependency ecosystem.

Leave a Comment