The popular npm package, 'colors' made headlines earlier this year when its dev Marak Squires had sabotaged the component by adding an infinite loop to it, printing zalgo text incessantly for everyone using the dependency.
Article Link: Remember npm library 'colors'? There's no such thing as 'colors-2.0'