node-ipc maintainer shipped protestware
The node-ipc maintainer published protestware releases that targeted Russian and Belarusian IP ranges. The code wrote political messages and, in some paths, overwrote files with heart symbols.
Story
node-ipc was not taken over by an outsider. Its maintainer published the disputed releases during the first weeks of Russia's 2022 invasion of Ukraine, turning a trusted dependency into political code.
The dangerous behavior was geofenced. Snyk reported destructive file-overwrite behavior for systems resolving to Russia or Belarus, while other versions pulled in peacenotwar, which wrote a desktop message file. The package sat in dependency paths large enough for unrelated projects to inherit the blast radius.
The incident became a reference point for protestware because the code was intentional, public, and shipped through the official npm package. That makes it different from a credential theft compromise, but not harmless: consumers still received behavior they did not consent to.
The record keeps affected versions explicit and treats download counts as exposure, not confirmed file-destruction victims. The trust failure was the same one supply-chain records are meant to show: dependency updates execute with the user's authority.
Affected Artifacts
- Observed
- 2022-03-07 to 2022-03-16
- Fixed
- Not listed
- Hashes
-
- sha256:f54bb89fe21762ce2ab5fe7581bf7f347f79ec30abe3ab1175da4edc26b5f91a
- sha256:03190b659f9ad3c0e0bb337a958cbfa49c0bbfd8baff63d5a178c0eb6c8ea292
- Public reporting used large dependency/download figures as exposure context; no confirmed affected-user count is stored.
Incident Context
- Motive
- Disruption Protest
- Attribution
- Maintainer
- Cause
- Sabotage
- Transitive
- No
- Actor
- Author
External References
Source record: oss/attacks/node-ipc/meta.yaml