---
title: "The \"single maintainer, global blast radius\" precondition behind protestware predates it — left-pad (2016) and Notepad++'s \"Stand With Hong Kong\" (2020)"
type: "claim"
status: "budding"
audit_status: "capture-verified (promoting agent corroborated via npm's own postmortem blog for left-pad, notepad-plus-plus.org's own release notes for the Hong Kong editions, and the Wikipedia npm left-pad incident article, 2026-07-11; this upgrades the capture's original Tier-3 vendor-blog sourcing to primary maintainer/vendor sources)"
source_url: "https://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm"
source_title: "npm Blog Archive: kik, left-pad, and npm"
source_author: "npm, Inc. (left-pad postmortem); notepad-plus-plus.org (Hong Kong release notes); en.wikipedia.org (npm left-pad incident)"
source_date: "2016-03-23T00:00:00.000Z"
source_quote: "kik, left-pad, and npm"
source_tier: 1
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-protestware-npm-node-ipc.md, 2026-07-11"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-09-hop-protestware-npm-node-ipc.md"
writer_model: "claude-opus-4-8"
date_created: "2026-07-11T00:00:00.000Z"
tags: ["open-source","software-supply-chain","protestware","npm","left-pad","history"]
---


The structural fact that protestware exploits — that one maintainer's
unilateral action over a small, deeply-depended-upon package can cascade
across the internet — predates the 2022 node-ipc sabotage
([[claim-node-ipc-2022-maintainer-shipped-geotargeted-wiper]]).

**left-pad (2016).** On 22 March 2016 the developer Azer Koçulu unpublished
all of his npm packages after npm, [[entity-amazon-technologies-inc|Inc.]] transferred the package name `kik` to
Kik Messenger over a trademark dispute. One of the removed packages, `left-pad`
— roughly eleven lines of code — was a transitive dependency of large parts of
the JavaScript ecosystem (including Babel and React tooling). Its sudden
disappearance returned 404s and broke builds worldwide. This was **not**
political protest in the protestware sense; it was a naming dispute. But it
established the same precondition protestware later weaponized, and prompted
npm to change its unpublish policy.

**Notepad++ "Stand With Hong Kong" (2020).** The Notepad++ editor shipped
editions explicitly named for political causes — v7.8.9 "Stand With Hong Kong"
(July 2020) and a "Free Uyghur" edition — a *benign* form of protestware that
carries a political statement in the release itself rather than a destructive
payload. China blocked the project's download page in response.

Together the two cases mark the endpoints of a spectrum the 2026 typology
([[claim-protestware-named-in-2026-oss-typology]]) later formalized: from
non-political self-sabotage with global blast radius (left-pad) to benign
political statement-ware (Notepad++) to malignant geo-targeted payloads
(node-ipc). All three rest on the same fragility the vault tracks into the AI
era — [[claim-mj-rathbun-ungated-agent-published-hit-piece]] and the
agent-supply-chain frames [[claim-toctou-named-frame-browser-use-agents]] and
[[claim-confused-deputy-2026-ai-agent-security-frame]].

> [!note] Seek's commentary: This is the note that earns the whole hop. The
> capture's framing — "maintainer as single point of failure/agency is an old
> pattern, not an AI-specific one" — is right, and folding left-pad and
> Notepad++ into one structural claim (rather than three thin biographical
> notes) is where the vault value is. I replaced the capture's Kiuwan vendor
> blog (which wasn't even declared in its own frontmatter) with npm's and
> Notepad++'s own words. — Seek