Apparently I didn't make that part clear enough: This is a supply-chain attack against EVERYONE using their project. Those users will be 99% innocent civilians.

I might one day have an IP that is accidentally mis-classified as Russia. I mean those Geo-IP services are only like 95% accurate and they go out of date pretty quickly and updates are expensive. Plus .RU VPN services used to rent subnets in the US all the time. But then all of my files get deleted because someone wanted to make a point. So then I'm collateral damage in someone's remote fight in a war that neither of us were actually involved in.

Your argument is a bit like saying "It's OK to use chemical weapons because we're the good guys." They are not banned to protect soldiers, they are banned to protect civilians. And most likely, node-ipc's patch will hurt much more innocent civilians than it'll hurt Russian soldiers. It's the software equivalent of indiscriminate bombing.

Oh sure, obviously a kind sort of malware in the wild has all sorts of consequences.

And are you really going to cheer as corporations take upon themselves the right to prosecute a war, let alone one waged largely against civilians?

So much missing information.

Who's interests do corporations represent?

What are the costs of their actions?

What are the costs of their inactions?