Open Source Maintainer Sabotages Code to Wipe Russian, Belarusian Computers

A technologist and maintainer of a popular piece of open source software has deliberately sabotaged their own code to wipe data on computers that used the program in Russia and Belarus, and has faced a massive backlash for doing so, according to messages posted on coding repository Github.

The news signals the potential downsides of digital hacktivism, with the move likely impacting ordinary people that were using the code.

RIAEvangelist is the maintainer of the software called “node-ipc,” a networking tool that’s sometimes downloaded over a million times a week. RIAEvangelist released two modules called “peacenotwar” and “oneday-test” recently, Bleeping Computer reported on Thursday. Peacenotwar, which RIAEvangelist has described as “protestware,” was then included as a dependency in node-ipc’s code, meaning some versions of node-ipc may come bundled with peacenotwar.

“This code serves as a non-destructive example of why controlling your node modules is important. It also serves as a non-violent protest against Russia's aggression that threatens the world right now. This module will add a message of peace on your users' desktops, and it will only do it if it does not already exist just to be polite,” RIAEvangelist wrote in the description for the peacenotwar code. RIAEvangelist’s description also explained how other people could add the module to their code in order to take part in the digital protest.

On the GitHub page for peacenotwar, RIAEvangelist included a link to a YouTube video and lyrics from the peace song “One Day” by Mattisyahu, the Jewish American reggae musical artist.

But then some versions of “node-ipc,” the much more popular piece of software that RIAEvangelist maintains, started overwriting files on computers based in Russia and Belarus with a heart emoji, according to a post on GitHub. 

RIAEvangelist told Motherboard in an email that “There was no actual code to wipe computers. It only puts a file on the desktop.” He then pointed to a Twitter account he said belonged to him and which had now been targeted by hackers.

His LinkedIn profile is no longer available. Six hours ago, RIAEvangelist updated the node-ipc page to read “Thanks for all the free pizza, and thanks to all the police that showed up to SWAT me. They were really nice fellas.”

The GitHub page for node-pic is now full of reactions to RIAEvangelist’s apparent sabotage.

“You’re a stain on the FOSS [free and open source software] community,” reads one. “You just destroyed your work, career and probably your online life,” another adds. Others include links to RIAEvangelist’s social media accounts.

Update: This piece has been updated to include a response from RIAEvangelist.

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.