The 'color' npm package has been compromised: fasterthanli.me/articles/color…
color npm package compromised
On September 8 2025, around 13:00 UTC, someone compromised Josh Junon’s npm account (qix) and started publishing backdoored versions of his package. Someone noticed and let Josh know: Josh confirme...fasterthanli.me
![["STOP DOING MATH" meme format - plain text on light blue background]
STOP DOING ALPHA CHANNELS
• Pixels were not meant to be transparent
• YEARS OF DISPLAY TECHNOLOGY yet NO REAL-WORLD USE FOUND for anything beyond OPAQUE RGB PIXELS
• Wanted to make part of your texture invisible anyway for a laugh? We had a tool for that: It was called "[bright magenta pixel]"
• "Yes please give me this specific color in INVISIBLE. Please give me 150 % intensity on the red channel" - Statements dreamed up by the utterly Premultiplied
LOOK at what Graphics Programmers have been demanding your Respect for all this time, with all the CRTs & LCDs we built for them
(This REAL Transparency, done by REAL Graphics Programmers)
[Three images demonstrating transparency, but with their transparent parts rendered as opaque in different ways:]
[Wikipedia's sample PNG image "PNG_transparency_demonstration", with the transparent background shown as the usual light gray checkerboard pattern]
[the OpenEXR sample image "PrismLenses", with the transparent background shown as solid black]
[a texture of a bouquet of flowers, with the transparent background replaced with opaque colors "bleeding out" from the opaque pixels]
[all images are subtitled with progressively longer strings of red question marks]
""Emission with no occlusion cannot be represented in straight alpha""
They have played us for relative fools](https://fedi.ml/photo/preview/640/702277 "[\"STOP DOING MATH\" meme format - plain text on light blue background]
STOP DOING ALPHA CHANNELS
• Pixels were not meant to be transparent
• YEARS OF DISPLAY TECHNOLOGY yet NO REAL-WORLD USE FOUND for anything beyond OPAQUE RGB PIXELS
• Wanted to make part of your texture invisible anyway for a laugh? We had a tool for that: It was called \"[bright magenta pixel]\"
• \"Yes please give me this specific color in INVISIBLE. Please give me 150 % intensity on the red channel\" - Statements dreamed up by the utterly Premultiplied
LOOK at what Graphics Programmers have been demanding your Respect for all this time, with all the CRTs & LCDs we built for them
(This REAL Transparency, done by REAL Graphics Programmers)
[Three images demonstrating transparency, but with their transparent parts rendered as opaque in different ways:]
[Wikipedia's sample PNG image \"PNG_transparency_demonstration\", with the transparent background shown as the usual light gray checkerboard pattern]
[the OpenEXR sample image \"PrismLenses\", with the transparent background shown as solid black]
[a texture of a bouquet of flowers, with the transparent background replaced with opaque colors \"bleeding out\" from the opaque pixels]
[all images are subtitled with progressively longer strings of red question marks]
\"\"Emission with no occlusion cannot be represented in straight alpha\"\"
They have played us for relative fools")
amos
in reply to amos • • •amos
in reply to amos • • •try {
args = JSON.parse(JSON.stringify(argsIn));
} catch (e) {
args = [...argsIn];
}
Ah see? I'm not the only one who didn't know about structuredClone
amos
in reply to amos • • •Here's the NPM supply chain attack payload deobfuscated & cleaned up by hand as best I could: github.com/fasterthanlime/0x11…
...I'm not sure it would ever work in its current form, tbh
GitHub - fasterthanlime/0x112: De-obfuscated payload from the September 8 2025 npm supply chain attack
GitHub