The Maintainer's 'Protest' Update That Bricked Production

We had node-ipc pinned in a dozen services. It was a quiet, boring dependency — exactly the kind you stop watching. Then one Tuesday a new minor version shipped that, on machines with Russian or Belarusian IPs, wiped the filesystem. We weren't the target, but our build agents ran in a cloud region whose egress IP happened to resolve there. Half our staging fleet went dark before anyone realized a dependency update was responsible.

The maintainer called it protestware. We called it a five-hour incident.

The real horror wasn't the payload — it was how long a supply chain can hide a landmine in a package nobody thinks about. We learned to pin exact versions, subscribe to release notes for every non-trivial dependency, and treat 'boring' dependencies as the most dangerous ones, because nobody's watching them.