Hmmmm… ok, what if somebody is handing out free food, but it’s poisoned. Is he still liable for harming you?

Did they inform you that the food was poisoned? Does it come with a bright red wrapper saying "warning poison?

If they just hand you food without a word then (at least in quite a few jurisdictions, but maybe not all) they are liable.

Did the packages in question have a bright red warning that said “your files will be deleted if you’re in Russia?”

It did have this:

> as of v11 this module uses the peacenotwar module.

Over on its NPM site: https://www.npmjs.com/package/node-ipc

And as far as i can tell they bumped up the major version by a digit. Whether or not that counts as a "Bright red warning" i don't know but personally i believe that a warning notice + a major version bump should be enough. Those who don't care about that would most likely not care about a bright red warning on the repo page either.

It's clearly a questionable thing to do, but is it illegal?

Deleting random people's files sounds more like the warnotpeace module.

No normal person would see "peacenotwar" for the first time and assume it does something bad.

This counts as "no warning whatsoever", and no competent lawyer would say it's a warning message.

Definitely, with prison for life in many places.