{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "colors"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.1"
            },
            {
              "last_affected": "1.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "colors"
      },
      "versions": [
        "1.4.44-liberty-2"
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-10T17:29:22Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "colors is a library for including colored text in node.js consoles. Between 07 and 09 January 2022, colors versions 1.4.1, 1.4.2, and 1.4.44-liberty-2 were published including malicious code that caused a Denial of Service due to an infinite loop. Software dependent on these versions experienced the printing of randomized characters to console and an infinite loop resulting in unbound system resource consumption.\n\nUsers of colors relying on these specific versions should downgrade to version 1.4.0.\n",
  "id": "GHSA-5rqg-jm4f-cqx7",
  "modified": "2022-01-10T19:56:36Z",
  "published": "2022-01-10T17:29:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Marak/colors.js/commit/137c6dae3339e97f4bbc838c221803c363b0a9fd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Marak/colors.js/commit/5d2d242f656103ac38086d6b26433a09f1c38c75"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Marak/colors.js/commit/6bc50e79eeaa1d87369bb3e7e608ebed18c5cf26"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Marak/colors.js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Infinite loop causing Denial of Service in colors"
}