Do you have a link describing which NPO was that and what exactly happened?
Re:On the Weaponisation of Open Source
by emodendroket on Saturday March 19, 2022 @02:47AM
(#30731735)
https://github.com/RIAEvangelist/node-ipc/issues/308
Draw your own conclusions about authenticity but it doesn't sound implausible.
One incident related in the story is someone slipping malware into a node library which appears, among other collateral damage, to have deleted the archives one NPO had collected of the war hoping to document Russian war crimes. So really I'm not sold on it being that different.