'Protestware' npm package dependency labelled supply-chain attack

Russia's invasion of Ukraine has spilt over into developer-space, with a well-known npm maintainer adding "protestware" as a dependency to a very popular package.

Security vendor Snyk is tracking what it says is a vulnerability and a supply-chain security incident, involving the peacenotwar npm package.

The peacenotwar package was written and published by npm maintainer Brandon Nozaki Miller, who is also known as RIAEvangelist, Sparky and Electric Cowboy, and who is the world's first licensed electric professional motorcycle racer.

Miller intended the module to be "protestware", to reflect people's opposition to war.

"This code serves as a non-destructive example of why controlling your node modules is important.

"It also serves as a non-violent protest against Russia's aggression that threatens the world right now.

This module will add a message of peace on your users' desktops, and it will only do it if it does not already exist just to be polite," Miller wrote in the module description.

Snyk said hardly anyone downloaded the npm package until it was added as a dependency by Miller to the node-ipc module as of versions 9.2.2 and 11.0.0.

Node-ipc provides fast inter-process communications services through UNIX sockets, and popular internet data transport protocols. 

Miller's node-ipc is a popular inter-process communication module, and is used by a number of Javascript developers in frameworks such as Vue.js and Node.js.

Snyk labelled the peacenotwar dependency for node-ipc as a dangerous act by Miller, noting that he maintains over 40 other npm packages with hundreds of millions of downloads.

"How does that reflect on the maintainer’s future reputation and stake in the developer community?

"Would this maintainer ever be trusted again to not follow up on future acts in such or even more aggressive actions for any projects they participate in?" Snyk wrote.

Snyk added that the incident illustrates the impact of nested dependencies, which can reach key ecosystem projects.