Protestware

Protestware is software — almost always an open source package — whose legitimate maintainer deliberately adds code that protests something: deleting or corrupting files, breaking functionality, or displaying political messages. Unlike a hijacked package, nothing is stolen and no account is compromised. The person every downstream user trusted simply changed what the code does, and the ecosystem's automatic-update machinery delivered the change.

How it works

The defining incidents came in 2022. The maintainer of colors and faker — npm libraries with tens of millions of weekly downloads between them — intentionally published versions containing an infinite loop, breaking countless applications overnight in protest over unpaid open source work. Weeks later, a maintainer of node-ipc shipped a version that attempted to overwrite files on machines with Russian or Belarusian IP addresses in protest of the invasion of Ukraine. Both spread exactly the way any dependency update spreads: version ranges resolved, CI pipelines pulled the latest release, and the change was running in production before anyone had read a diff.

Protestware matters less for its frequency than for what it proves about trust. A dependency is not just code; it is an ongoing relationship with a human being who can change their mind — the open source equivalent of an insider threat. The same single-maintainer trust that protestware abuses openly is what covert attackers cultivate patiently, as the XZ Utils campaign showed; our guide to security awareness for developers covers that spectrum end to end.

How to defend against it

• Pin versions and review updates. Lockfiles and deliberate upgrade windows mean a rogue release cannot reach production the hour it ships. The teams unaffected by colors were the ones not auto-resolving to latest.
• Know your critical maintainers. For dependencies you cannot afford to lose, track bus factor and maintainer health — a software bill of materials tells you what you run; someone still has to ask who maintains it.
• Stage updates through CI. Automated tests and canary environments catch destructive releases before they touch production data.
• Support the supply chain you rely on. Funding or contributing to critical projects is a security control: burned-out, unpaid maintainers are the common thread behind protestware and behind the social engineering campaigns that target them.