Pro-Ukraine ‘Protestware’ Pushes Antiwar Ads, Geo-Targeted Malware
Summary: Researchers are tracking open-source GitHub "protestware" projects that display pro-Ukraine messages or war statistics for users, and several packages modified to erase files on machines with Russian or Belarusian IP addresses. On March 7 the es5-ext library added a postinstall.js that shows a "Call for peace" message to Russian users, and on March 15 users found code in the vue-cli package designed to wipe all files from Russian or Belarusian addresses, which was later removed.
Bottom line: The malicious code arrived through a routine dependency update in a popular JavaScript package, so any team pulling that library automatically ran it - and the same mechanism that delivered a peace message can deliver file deletion or worse to your build pipeline.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026