node-ipc: The npm Package That Deleted Your Files Based on Where You Lived

Not all supply chain attacks come from external bad actors. Sometimes the threat is the original author. In March 2022, weeks after Russia invaded Ukraine, the developer of node-ipc — a package downloaded over 11 million times a week — shipped an update that silently deleted files on computers based on their geographic location.

TL;DR

node-ipc is an npm package used by vue-cli and many other tools, with ~11 million weekly downloads
In March 2022, the author added code that looked up each user's IP address
If the IP resolved to Russia or Belarus, it overwrote all accessible files with a heart emoji
Developers, CI pipelines, and servers in those regions could have project files silently destroyed
This class of attack is called "protestware" — a maintainer weaponising their own package

What is node-ipc?

node-ipc is a Node.js module that handles inter-process communication — letting programs on the same machine talk to each other. It was a dependency of vue-cli, the official toolchain for Vue.js applications, which is why it had such high download numbers. Most of the 11 million weekly installers were not using node-ipc directly — it was just along for the ride.

What the code did

The malicious code, shipped in versions 10.1.1 and 10.1.2, contacted an external IP geolocation API. If the response indicated the machine was located in Russia or Belarus, it would recursively traverse the filesystem and overwrite every file it could access with a single character: ❤️.

Any developer running npm install or CI system running in those countries — or on hosting infrastructure located there — could have their project files silently destroyed by an automated dependency install.

The targeting was crude. Russian and Belarusian developers who opposed the invasion were affected. CI servers routed through European cloud zones that happened to resolve to those regions were affected. The actual intended targets — government or military systems — almost certainly had no npm pipelines to hit.

The fallout

npm yanked the malicious versions quickly after the community raised the alarm. The developer was widely criticised — not for the politics, but for violating a norm that had long been considered inviolable: maintainers do not use their packages as weapons against their users.

Vue-cli and other projects pinned to safe versions or removed the dependency. The broader debate about whether maintainers have the right to weaponise their own code continues.

The deeper lesson

node-ipc highlighted a risk that is easy to overlook: your dependencies are controlled by humans with motivations that have nothing to do with your software. A maintainer can become a threat — not because they were hacked, but because they chose to be.

This pattern — called protestware — has appeared in other packages too. The developer of colors.js and faker.js (both widely used JavaScript utilities) intentionally broke his own packages in January 2022 to protest large companies profiting from open-source work without contributing back. Thousands of applications broke on their next install.

Locking dependency versions and monitoring for unexpected package changes — including from established maintainers — is the first practical defence against this class of incident.