When Activism goes too far - popular npm package adds malicious code that affects Russian/Belarussian IPs

[williamcll]

 

While the developer has claimed that the edit only sends a message to those with a Belarussian or Russian IP to stop the war, other users have noticed that code that would begin deleting files on the target computer and was pushed into merger.

Quotes

Quote

Select versions (10.1.1 and 10.1.2) of the massively popular 'node-ipc' package were caught containing malicious code that would overwrite or delete arbitrary files on a system for users based in Russia and Belarus. These versions are tracked under CVE-2022-23812. On March 8th, developer Brandon Nozaki Miller, aka RIAEvangelist released open source software packages called peacenotwar and oneday-test on both npm and GitHub. The packages appear to have been originally created by the developer as a means of peaceful protest, as they mainly add a "message of peace" on the Desktop of any user installing the packages.

 

But, chaos unfolded when select npm versions of the famous 'node-ipc' library—also maintained by RIAEvangelist, were seen launching a destructive payload to all data and overwrite all files of users installing the package. Interestingly, the malicious code, committed as early as March 7th by the dev, would read the system's external IP address and only delete data by overwriting files for users based in Russia and Belarus. The code present within 'node-ipc', specifically in file "ssl-geospec.js" contains base64-encoded strings and obfuscation tactics to mask its true purpose:

A simplified copy of the code provided by researchers shows that for users based in Russia or Belarus, the code will rewrite the contents of all files present on a system with a heart emoji—effectively deleting all data on a system.

 

As such, Vue.js CLI users made an urgent appeal to the project's maintainers to pin the 'node-ipc' dependency to a safe version, after some were left startled. And, as observed by BleepingComputer, Vue.js isn't the only open source project to be impacted by this sabotage. Developers Lukas Mertens and Fedor are warning other project maintainers to make sure they are not on a malicious 'node-ipc' version

 

Snyk researchers suspect that 'node-ipc' versions 10.1.1 and 10.1.2 that cause blatant damage to the system were taken down by npm within 24 hours of publication. Note, however, 'node-ipc' versions 11.0.0 and above remain available on npm. And, these versions still contain the peacenotwar module that will create the aforementioned 'WITH-LOVE-FROM-AMERICA.txt' files on Desktop. As such, if your application is built using the 'node-ipc' library, make sure to pin the dependency to a safe version such as 9.2.1 (turns out 9.2.2 isn't innocent either).

The git page since then has been in full damage control now:

My thoughts

As I said in another thread, nobody's innocent in this conflict. But trying to appeal to specific crowds and putting people and business (even ones that don't even live anywhere in the eastern bloc, think VPNs!) in danger is a no-go.

 

Sources

https://github.com/vuejs/vue-cli/issues/7054

https://www.bleepingcomputer.com/news/security/big-sabotage-famous-npm-package-deletes-files-to-protest-ukraine-war/

[gamagama69]

I mean this is bad practice but also kinda based

[rcmaehl]

 

 

Personally, politics needs to be keep to Businesses, not Software.

[starsmine]

Damn. That's some heavy friendly fire on a front that shouldn't exist.

[poochyena]

2 hours ago, Caroline said:

Companies firing devs for using terms like blacklist or master server:  ...heh, y-yeah

90% sure this never happened

[ravenshrike]

Pretty sure that when they removed the russian mustards from the Wisconsin mustard museum activism had already gone too far.

[Master Disaster]

1 hour ago, ravenshrike said:

Pretty sure that when they removed the russian mustards from the Wisconsin mustard museum activism had already gone too far.

Is this really a thing?

 

People need to calm down, take a deep breath and realise that the fault is not the Russian people, the vast majority of them don't want this either.

 

Annexing an entire country over the actions of their semi authoritarian leaders is likely to do more harm than good.

[suicidalfranco]

Ingsoc would be proud

[Sauron]

6 hours ago, williamcll said:

nobody's innocent in this conflict

hard disagree on that one, and especially random developers based in Russia or Belarus are extremely unlikely to have any fault whatsoever for the conflict.

 

It's one thing to stop trade to hit their economy and hopefully slow down their war machine, which also unfortunately damages innocent civilians, it's another to target them directly with a malicious attack and in an open source project no less.

6 hours ago, gamagama69 said:

I mean this is bad practice but also kinda based

Well... not really because it's targeting the wrong people. If it were just the peace message it would be a little hamfisted but fine. This is a bit too much.

[ravenshrike]

3 hours ago, Master Disaster said:

Is this really a thing?

Yup, they replaced them after the internet and Fox News got ahold of the story and they were mercilessly ridiculed over it, but for a period of time they were removed and replaced with a sign saying that until Russia and Belarus left Ukraine the Russian mustards would no longer be on display.

[suicidalfranco]

51 minutes ago, ravenshrike said:

Yup, they replaced them after the internet and Fox News got ahold of the story and they were mercilessly ridiculed over it, but for a period of time they were removed and replaced with a sign saying that until Russia and Belarus left Ukraine the Russian mustards would no longer be on display.

And then there's Facebook, changing their terms of use allowing you to send death threats only towards Russians. Great world we live in.

[Master Disaster]

1 hour ago, ravenshrike said:

Yup, they replaced them after the internet and Fox News got ahold of the story and they were mercilessly ridiculed over it, but for a period of time they were removed and replaced with a sign saying that until Russia and Belarus left Ukraine the Russian mustards would no longer be on display.

I know its an oldie and it has been used to death but I genuinely cannot resist

[Ydfhlx]

6 hours ago, Master Disaster said:

People need to calm down, take a deep breath and realise that the fault is not the Russian people, the vast majority of them don't want this either.

This is not true. About 60% of Russian support Putin. And that percentage has gone up when Russia annexed Crimea in 2014.

[duncannah]

Dependency version pinning should be standard for every person developing on Node: https://docs.renovatebot.com/dependency-pinning/

[Lurick]

2 hours ago, Ydfhlx said:

This is not true. About 60% of Russian support Putin. And that percentage has gone up when Russia annexed Crimea in 2014.

You do realize people lie right to not be hauled away? Like when you can say you support Putin and police still haul you away because you talked to the media you definitely aren't going to answer anything against the government.

[Ydfhlx]

15 minutes ago, Lurick said:

You do realize people lie right to not be hauled away? Like when you can say you support Putin and police still haul you away because you talked to the media you definitely aren't going to answer anything against the government.

You have zero idea about what you're talking about. It's not how they got this 60% - if what you are saying were true, they'd measure 100%. "definitely aren't going to answer against government" yet 40% of russians apparently did

 

Just because Americans like democracy doesn't mean it is natural for other nations. Russians like being an empire for instance, and this is what Putin is trying to do.

[WhitetailAni]

3 hours ago, Ydfhlx said:

This is not true. About 60% of Russian support Putin. And that percentage has gone up when Russia annexed Crimea in 2014.

There's a difference in supporting Putin, the person, and the annexation of Ukraine. You can't apply support of an action of his, to him. Nor can you apply support of him, the person, to an action of his. They're related, but I can support a person but not everything they do.

12 minutes ago, Ydfhlx said:

Russians like being an empire for instance, and this is what Putin is trying to do.

Yep, this looks right.

https://www.pewresearch.org/fact-tank/2014/03/04/many-russians-agree-that-it-is-natural-for-them-to-have-an-empire/

But...

Quote

For instance, a recent February poll by the Russian Public Opinion Research Center (VCIOM), a prominent public opinion organization based in Moscow, found that 73% of Russians preferred to stay out of the Ukrainian conflict, with only 15% saying Russia should step in to prevent the ouster of then-President Yanukovych.

 

This is very very close to "no politics" though.

[BuckGup]

The hypocrisy oozes. Nothing more than a PR stunt as this only has negative consequences 

[Master Disaster]

1 hour ago, Ydfhlx said:

You have zero idea about what you're talking about. It's not how they got this 60% - if what you are saying were true, they'd measure 100%. "definitely aren't going to answer against government" yet 40% of russians apparently did

Unless you can provide a citation then we can say the same thing back to you.

 

1000s of russians have been arrested for protesting, anybody calling it a war is arrested, Russian state TV staff resigned en masse because they were sick of lying to their viewers about what was happening. Heck even today at the Russian celebration held in Moscow some TV operator cut Putin off mid speech.

 

Its kinda crazy that you'd believe anything coming directly out of the Russian state since they are famous for lying and misinformation.

[poochyena]

2 hours ago, Ydfhlx said:

Russians like being an empire for instance

Yes, the ones that benefit from it do. The ones that don't benefit from it, do not. Everyone should be given human rights, not just the majority.

[Blademaster91]

17 minutes ago, Master Disaster said:

1000s of russians have been arrested for protesting, anybody calling it a war is arrested, Russian state TV staff resigned en masse because they were sick of lying to their viewers about what was happening. Heck even today at the Russian celebration held in Moscow some TV operator cut Putin off mid speech.

 

Its kinda crazy that you'd believe anything coming directly out of the Russian state since they are famous for lying and misinformation.

Well Russians have elected Putin 4 times, and if people were against the government there would be massive protests.

Anyway, OT unfortunate malware is going to attack innocent people that have nothing to do with the war, but Russia attacked Ukraine with the wiper malware attack so of course people are going to fight back.

12 hours ago, ravenshrike said:

Pretty sure that when they removed the russian mustards from the Wisconsin mustard museum activism had already gone too far.

I think complaining about mustard seems like a first world problem, just IMHO.

[starsmine]

This is not coming from the Russian state
https://www.levada.ru/en/ratings/
This poll firm doesnt get much pressure from the state to fudge their numbers either.

 

And there have mathematical mitigations on how to correct people lying about being dishonest to protect themselves.
Like one of the methods is they have the respondent do a coin flip, if heads tell the truth, if tails say they disapprove. This way the pollster has no way to determine if any individual person is saying it because they feel disapproval, or because of the coin flip, thus protecting the respondent from back lash. With a high enough response they can mathematically separate the two groups and get a more true approval rating
https://www.tandfonline.com/doi/full/10.1080/1060586X.2016.1144334?scroll=top&needAccess=true
Is the paper going about the above, and they found very little evidence that russians are lying to pollsters 

And while the margin of error is more then a pollster in the US gets, its not going to be +-20% needed to get the majority of Russians to even have a 50/50 split on putin

[poochyena]

1 minute ago, Blademaster91 said:

if people were against the government there would be massive protests.

...there are. 1000s have been arrested in just the past few weeks for protesting.

[Blademaster91]

2 minutes ago, poochyena said:

...there are. 1000s have been arrested in just the past few weeks for protesting.

I said massive protests, if its only 1000s then most people are believing the state media, their police can't haul away everyone.

[Master Disaster]

4 minutes ago, starsmine said:

This is not coming from the Russian state
https://www.levada.ru/en/ratings/
This poll firm doesnt get much pressure from the state to fudge their numbers either.

 

And there have mathematical mitigations on how to correct people lying about being dishonest to protect themselves.
Like one of the methods is they have the respondent do a coin flip, if heads tell the truth, if tails say they disapprove. This way the pollster has no way to determine if any individual person is saying it because they feel disapproval, or because of the coin flip, thus protecting the respondent from back lash. With a high enough response they can mathematically separate the two groups and get a more true approval rating
https://www.tandfonline.com/doi/full/10.1080/1060586X.2016.1144334?scroll=top&needAccess=true
Is the paper going about the above, and they found very little evidence that russians are lying to pollsters 

Fair enough, I asked for a citation and was given one. I was wrong it would seem.

 

Anywho, since we've probably already crossed a line I'll just say this. Even if Russians are happy with the state of their country, its still not fair to blame them for the conflict.