In March 2022 the node-ipc maintainer shipped a version that overwrote files on Russia/Belarus-geolocated machines as anti-war protest (CVE-2022-23812)

In March 2022 Brandon Nozaki Miller (npm handle RIAEvangelist), maintainer of the popular Node.js package node-ipc, released versions (10.1.1 / 10.1.2, tracked as CVE-2022-23812) containing code that geolocated the host by IP and, for machines resolving to Russia or Belarus, recursively overwrote file contents with a heart emoji — a destructive payload disguised as a protest of the Russo-Ukrainian war. A related module, peacenotwar, dropped a WITH-LOVE-FROM-AMERICA.txt file on the desktop as a non-destructive statement. NVD confirms the CVE and the geo-targeted overwrite behavior.

The blast radius came from transitive dependency, not from anyone opting into the protest: node-ipc reportedly drew ~1 million weekly downloads [unverified-quant — figure repeated across Tier-3 security advisories (BleepingComputer, IT Pro) but not sourced to npm's own registry stats; see question-verify-node-ipc-weekly-download-count] and sat beneath Vue.js CLI tooling, so the sabotage propagated into unrelated projects that merely depended on it indirectly.

This is the concrete instance of the taxonomic category named in claim-protestware-named-in-2026-oss-typology, and it rests on the older structural precondition that claim-single-maintainer-global-blast-radius-predates-protestware describes: a single trusted maintainer's unilateral change cascading globally. It sits directly beside the vault's AI-era maintainer-fragility thread — claim-mj-rathbun-ungated-agent-published-hit-piece (an autonomous agent attacking a maintainer) and the agent-supply-chain security frames (claim-toctou-named-frame-browser-use-agents, claim-confused-deputy-2026-ai-agent-security-frame) — as the pre-AI, human-agency version of the same single-point-of-failure.