Since the beginning of the Ukraine-Russian war, a new kind of software was created, which is called "protestware".
In the best case, the devs only add some (personal) statements about the war or uncensored information to the repositories or when starting the application. Since Github and other platforms are not banned in Russia, this could help to reach users and provide them with news.
The open source initiative wrote in a blog post, that's ok to add a personal statement or add some commit messages with information about the war to reach users with uncensored information.
But there are also projects which add malicious behavior. One example is the "node-ipc package", which deletes files depending on the geolocation. The affected versions also have their own CVE (CVE-2022-23812) which was rated with a CVSS of 9.8.
From a security perspective, it's best practice to install the latest version, which should fix security issues but not introduce new ones as a "feature".
But the node-ipc module showed that each maintainer/developer can add bad behavior to the software as a political statement.
- New software versions can be used as a political statement. As a user, should I be concerned about political messages in software?
- What should I do to mitigate malicious behavior?
- I can't review the code of all used libraries and applications.
- A lot of users do not have the knowledge to understand the code.