Protestware.

Open-source software whose maintainer adds politically motivated code that displays a message or sabotages users perceived to be in a targeted country. It belongs to the Attacks & Threats category of cybersecurity.

Open-source software whose maintainer adds politically motivated code that displays a message or sabotages users perceived to be in a targeted country.

Protestware is a controversial category: maintainers of popular open-source libraries deliberately ship updates that print political slogans, refuse to run, or, in extreme cases, destroy data on machines whose geolocation matches a targeted region. The best-known case is node-ipc in March 2022, where the maintainer published a version that wiped files on systems geolocated to Russia or Belarus, hitting many uninvolved downstream organisations including aid groups. Other examples include faker.js and colors.js, where the maintainer self-sabotaged to protest unpaid labour. Whatever the cause, protestware is treated as a supply-chain attack by most enterprise security policies. Defences include lockfiles, vetting upstream changes, OpenSSF Scorecard checks, and SBOM-driven incident response.

Defences for Protestware typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Politically motivated package, Sabotage update.