Russia-based dev Yaffle altered 'event-source-polyfill' #npm package in March to show anti-war messages to Russians, as a a peaceful protest.
This marks the THIRD major #opensource self-sabotage of 2022: npm package is downloaded 600K weekly and used by 135,000+ GitHub repos.
This marks the THIRD major #opensource self-sabotage of 2022: npm package is downloaded 600K weekly and used by 135,000+ GitHub repos.
After printing the Russian language, the package opens up the user's web browser and directs them to a Change[.]org petition, 'NetVoyne' — signed by over 1.2 million people already.
'event-source-polyfill' further advises Russian civilians to be wary of "one-sided" news channels controlled by the Russian government and to seek reliable news sources such as BBC's Tor website:
"While current protestware may be centered around the war, that doesn't mean it will always be limited to select trending issues.
Developers have discovered an avenue of creative self-expression that no longer restricts them to just delivering expected functionality...
Developers have discovered an avenue of creative self-expression that no longer restricts them to just delivering expected functionality...
—a developer can, on a whim, decide to change their mind and their code as they please. A neglected premise of open source is that they always could."
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
