I'd say that the code that is malware/not malware depending on IP address of the server is a bad kind of weaponization. Not because I pity poor Russians or some

I'd say that the code that is malware/not malware depending on IP address of the server is a bad kind of weaponization. Not because I pity poor Russians or some such. I'm a Ukrainian national myself. Putin is a dickhead that should be put down with extreme prejudice; much of both the state and ordinary folk in Russia should be accountable, too. Here, I said it. The problem with those NPM packages, or better said, the approach they are taking is that it is a double-edged sword. IP blocks can be sold and bought. Today they belong to someone in Russia you don't mind targeting, tomorrow it's someone else entirely. Today you put in a trigger to turn your code into malware, tomorrow someone finds a way to flip that trigger at will. Bad things ensue. Not providing services to Russians is another thing and that could work. Limiting downloads by the country is okay in my books. After all, you block IPs that try to DDoS you, so banning IPs of an aggressor country that is fond of murdering civilians is fair game too. Radio silence their contributions. Don't respond to their support requests. Close the issues they open as if they never existed. Of course they can find alternative ways to download stuff, fork, implement the necessary changes themselves, but it's jumping through the hoops. Let them jump extra and then some. Stop providing documentation in Russian, kick some people off the team/mailing list. Make the OSS you're responsible for be, for all intents and purposes, unmaintained piece of software if the user is from an aggressor country. These are ways of sabotage I can stand behind. But putting in actual malware is rather where I draw the line.