Developer Sabotages Open-Source Software Package

[noloader]

I found this kind of interesting in a morbid sort of way: Developer Sabotages Open-Source Software Package.

A developer has been caught adding malicious code to a popular open-source package that wiped files on computers located in Russia and Belarus as part of a protest that has enraged many users and raised concerns about the safety of free and open source software.
The application, node-ipc, adds remote interprocess communication and neural networking capabilities to other open source code libraries. As a dependency, node-ipc is automatically downloaded and incorporated into other libraries, including ones like Vue.js CLI, which has more than 1 million weekly downloads.
[…]
The node-ipc update is just one example of what some researchers are calling protestware. Experts have begun tracking other open source projects that are also releasing updates calling out the brutality of Russia’s war. This spreadsheet lists 21 separate packages that are affected.
One such package is es5-ext, which provides code for the ECMAScript 6 scripting language specification. A new dependency named postinstall.js, which the developer added on March 7, checks to see if the user’s computer has a Russian IP address, in which case the code broadcasts a “call for peace.”

 

[adit]

You get what you pay for....

 

[whistlersmother]

Yea. Just because its open source doesn't mean its free.

 

[Melnic]

Tit for tat shall follow

Would have been better if they just informed the user of the war and not to believe Putin who is a lier


Sent from my iPhone using Tapatalk

 

[Vodnik4]

As anti-Putin as I am, this is a bit too far.
Now everyone will start adding their personal agenda to the code.
Just imagine getting bombarded by trans propaganda if your IP is from a “red” state, etc.

 

[Bullfrog]

As anti-Putin as I am, this is a bit too far.
Now everyone will start adding their personal agenda to the code.
Just imagine getting bombarded by trans propaganda if your IP is from a “red” state, etc.

Or to give the libs something to be concerned about, your IP stack kicking you off the net if it detects a query about finding an abortion provider.

 

[gamer_jim]

Then the maintainer wasn't doing their job.