Open Source Maintainer Sabotages Code to Wipe Russian, Belarusian Computers

The shortsighted protest has caused a massive uproar in the open source community.

Hacking. Disinformation. Surveillance. CYBER is Motherboard's podcast and reporting on the dark underbelly of the internet.

A technologist and maintainer of a popular piece of open source software has deliberately sabotaged their own code to wipe data on computers that used the program in Russia and Belarus, and has faced a massive backlash for doing so, according to messages posted on coding repository Github.

The news signals the potential downsides of digital hacktivism, with the move likely impacting ordinary people that were using the code.

Advertisement

RIAEvangelist is the maintainer of the software called “node-ipc,” a networking tool that’s sometimes downloaded over a million times a week. RIAEvangelist released two modules called “peacenotwar” and “oneday-test” recently, Bleeping Computer reported on Thursday. Peacenotwar, which RIAEvangelist has described as “protestware,” was then included as a dependency in node-ipc’s code, meaning some versions of node-ipc may come bundled with peacenotwar.

Do you know about any other instances of hacking taking place around the Ukraine invasion? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or email joseph.cox@vice.com.

“This code serves as a non-destructive example of why controlling your node modules is important. It also serves as a non-violent protest against Russia's aggression that threatens the world right now. This module will add a message of peace on your users' desktops, and it will only do it if it does not already exist just to be polite,” RIAEvangelist wrote in the description for the peacenotwar code. RIAEvangelist’s description also explained how other people could add the module to their code in order to take part in the digital protest.

On the GitHub page for peacenotwar, RIAEvangelist included a link to a YouTube video and lyrics from the peace song “One Day” by Mattisyahu, the Jewish American reggae musical artist.

Advertisement

But then some versions of “node-ipc,” the much more popular piece of software that RIAEvangelist maintains, started overwriting files on computers based in Russia and Belarus with a heart emoji, according to a post on GitHub

A screenshot of an analysis from GitHub user MidSpike. Image: MidSpike.

RIAEvangelist told Motherboard in an email that “There was no actual code to wipe computers. It only puts a file on the desktop.” He then pointed to a Twitter account he said belonged to him and which had now been targeted by hackers.

His LinkedIn profile is no longer available. Six hours ago, RIAEvangelist updated the node-ipc page to read “Thanks for all the free pizza, and thanks to all the police that showed up to SWAT me. They were really nice fellas.”

The GitHub page for node-pic is now full of reactions to RIAEvangelist’s apparent sabotage.

“You’re a stain on the FOSS [free and open source software] community,” reads one. “You just destroyed your work, career and probably your online life,” another adds. Others include links to RIAEvangelist’s social media accounts.

Update: This piece has been updated to include a response from RIAEvangelist.

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.

Tagged:

Hacking, supply chain, CYBER, Github, ukraine invasion, npm, worldnews, world conflict

More
like this
YouTube Runs Ad Offering American Men a Ukrainian Woman
Microsoft Employees Exposed Own Company’s Internal Logins
Sellers for Encrypted Phone Firm Ciphr Locked Out of Orders
Ukraine Accuses Russia of Using WhatsApp Bot Farm to Ask Military to Surrender
This Is the Code the FBI Used to Wiretap the World
BEEF ALERT: Ransomware Group Very Mad at Being Associated With Lavish Russian Hackers
30,000 New Users Signed Up for Mastodon After Elon Musk Bought Twitter
US Sanctions Crypto Mixing Service Used by North Korea for First Time