Sabotage: Code added to popular NPM package wiped files in Russia and Belarus

When code with millions of downloads nukes user files, bad things can happen.

A developer has been caught adding malicious code to a popular open-source package that wiped files on computers located in Russia and Belarus as part of a protest that has enraged many users and raised concerns about the safety of free and open source software.

The application, node-ipc, adds remote interprocess communication and neural networking capabilities to other open source code libraries. As a dependency, node-ipc is automatically downloaded and incorporated into other libraries, including ones like Vue.js CLI, which has more than 1 million weekly downloads.

A deliberate and dangerous act
Two weeks ago, the node-ipc author pushed a new version of the library that sabotaged computers in Russia and Belarus, the countries invading Ukraine and providing support for the invasion, respectively. The new release added a function that checked the IP address of developers who used the node-ipc in their own projects. When an IP address geolocated to either Russia or Belarus, the new version wiped files from the machine and replaced them with a heart emoji.

To conceal the malice, node-ipc author Brandon Nozaki Miller base-64-encoded the changes to make things harder for users who wanted to visually inspect them to check for problems.

This is what those developers saw:

These lines were then passed to the timer function, such as:

The values for the Base64 strings were:

When passed to the timer function, the lines were then used as inputs to wipe files and replace them with the heart emoji.

“At this point, a very clear abuse and a critical supply chain security incident will occur for any system on which this npm package will be called upon, if that matches a geolocation of either Russia or Belarus,” wrote Liran Tal, a researcher at Snyk, a security company that tracked the changes and published its findings on Wednesday.

Tal found that the node-ipc author maintains 40 other libraries, with some or all of them also being dependencies for other open source packages. Referring to the node-ipc author’s handle, Tal questioned the wisdom of the protest and its likely fallout for the open source ecosystem as a whole.

“Even if the deliberate and dangerous act of maintainer RIAEvangelist will be perceived by some as a legitimate act of protest, how does that reflect on the maintainer’s future reputation and stake in the developer community?” Tal wrote. “Would this maintainer ever be trusted again to not follow up on future acts in such or even more aggressive actions for any projects they participate in?”

RIAEvangelist also came under fire on Twitter and in open source forums.

“This is like Tesla intentionally putting in code to detect certain drivers and if they vaguely match the description then to auto drive them into the nearest phone pole and hoping it only punishes particular drivers,” one person wrote. A different person added: “What if the deleted files are actually mission critical that can kill others?

Protestware comes of age
The node-ipc update is just one example of what some researchers are calling protestware. Experts have begun tracking other open source projects that are also releasing updates calling out the brutality of Russia’s war. This spreadsheet lists 21 separate packages that are affected.

One such package is es5-ext, which provides code for the ECMAScript 6 scripting language specification. A new dependency named postinstall.js, which the developer added on March 7, checks to see if the user’s computer has a Russian IP address, in which case the code broadcasts a “call for peace.”

“The people of Ukraine are fully mobilized and ready to defend their country from the enemy invasion,” the message translated into English read in part. “91% of Ukrainians fully support their President Volodymyr Zelensky and his response to the Russian attack.” Here’s a snippet of the code:

The protestware event exposes some of the risks posed when armies of volunteer developers produce the code that’s crucial for hundreds or thousands of other applications to run. Some open source software automatically downloads and incorporates new dependency versions, and even for those that don’t, the vast amount of code often makes manual reviews infeasible. That means an update from a single individual has the potential to throw a wrench in an untold number of downstream applications.




このアプリケーション「node-ipc」は、他のオープンソースコードライブラリに、リモートプロセス間通信とニューラルネットワーキング機能を追加するものです。依存関係として、node-ipcは自動的にダウンロードされ、他のライブラリに組み込まれます。その中には、毎週100万件以上ダウンロードされているVue.js CLIのようなライブラリも含まれます。


node-ipcの作者であるBrandon Nozaki Miller氏は、悪意を隠すために、変更点をbase64エンコードし、問題を確認するために目視で確認しようとするユーザーにとってやりにくくなるようにしました。





「この時点で、この npm パッケージが呼び出されたシステムが、ロシアかベラルーシのいずれかの地理的位置に一致する場合、非常に明確な不正利用と重要なサプライチェーンのセキュリティ事故が発生します」と、この変更を追跡して水曜日にその結果を発表したセキュリティ企業 Snyk の研究者 Liran Tal は書いています。


“たとえメンテナRIAEvangelistの意図的で危険な行為が正当な抗議行動と受け止められるとしても、それはメンテナの今後の評判や開発者コミュニティでの利害にどう反映されるのでしょうか?” とTalは書いています。”このメンテナは、今後、参加するプロジェクトに対して、このような、あるいはさらに攻撃的な行為を追わないよう、二度と信頼されることはないでしょうか?”




その1つが、ECMAScript 6スクリプト言語仕様のコードを提供するes5-extパッケージです。開発者が3月7日に追加したpostinstall.jsという新しい依存関係は、ユーザーのコンピューターにロシアのIPアドレスがあるかどうかをチェックし、その場合、コードは “平和への呼びかけ “をブロードキャストしている。




This risk was on full display in January, when the developer of two JavaScript libraries with more than 22 million downloads pushed an update that caused more than 21,000 dependent apps to spew gibberish, prefaced by the words “Liberty Liberty Liberty.” An infinite loop produced by the update sent developers scrambling as they attempted to fix their malfunctioning apps.
The disk-wiping function was added to node-ipc versions 10.1.1 and 10.1.2. Following the outcry over the wiper, the developer released updates that removed the malicious function. Snyk recommends that developers stop using the package altogether. If that’s not possible, the company advises the use of an npm package manager to override the sabotaged versions and pin a known good version.

“Snyk stands with Ukraine, and we’ve proactively acted to support the Ukrainian people during the ongoing crisis with donations and free service to developers worldwide, as well as taking action to cease business in Russia and Belarus,” Tal wrote. “That said, intentional abuse such as this undermines the global open source community and requires us to flag impacted versions of node-ipc as security vulnerabilities.”

Post updated to remove comments making unverified claims and to correct a statement about default open source behavior towards dependency updates.

Promoted Comments
jg67379 Wise, Aged Ars Veteran et Subscriptor
Ripaille wrote:
I disagree with the article that the issue is about FOSS. The issue is with developers not testing / auditing the code they import – which they can do better if it’s FOSS.

We’ve seen backdoors and malware in closed-source software many times. Some countries prevent critical infrastructure from network equipment with Chinese-made operating systems for example.

Its not really feasible to manually audit all of the code you import. Your dependencies probably have 10s or 100s of time more code than your actual project you are writing. Especially when considering the dependencies of your dependencies…

You should obviously do some due diligence before adding/installing a new dependency though.

That said I feel like node and NPM are especially bad in the number of dependencies a typical project has compared to other languages like Python or Go.

このリスクは、1月に2200万ダウンロードを超える2つのJavaScriptライブラリの開発元がアップデートを行った際に、21,000以上の依存アプリが “Liberty Liberty “という言葉を前置きにして、ちんぷんかんぷんな言葉を吐き出すようになったことからも明らかである。このアップデートで発生した無限ループにより、開発者は誤動作するアプリを修正しようと奔走した。

「Snyk はウクライナと共に立ち上がり、現在進行中の危機の中でウクライナの人々を支援するために、寄付や世界中の開発者への無料サービス、またロシアやベラルーシでのビジネス停止措置を積極的に行っています」と Tal は書いています。”つまり、このような意図的な乱用は、グローバルなオープンソースコミュニティを弱体化させ、影響を受けるバージョンのnode-ipcにセキュリティ脆弱性としてフラグを立てる必要があります。”


jg67379 賢者、高齢のアルスベテランと添え字師
Ripaille さんが書き込みました。
FOSSが問題だという記事には反対です。問題は、開発者がインポートしたコードをテスト/監査しないことです – それがFOSSであれば、もっとうまくできます。






【科学が証明】第二言語習得論 このおすすめの学習ツールで英語をマスターする