You're thinking about it from the wrong perspective. Yes, publishing software can be thought of as expression, and that's protected by the constitution. But publishing malware as benign software, without disclosing it is fraud/deception, and that shouldn't be allowed. The legal system protects freedom of expression, but still allows you to get punished for deceptive speech that's harmful (ie. fraud/libel).

This is when the "no warranty, expressed or implied" kicks in, no?

Those words are not some sort of magic spell. Licenses can't override law unless the law explicitly allows them to, and the law generally distinguishes or tries to distinguish between honest mistakes and malicious behaviour. IANAL and laws differ between countries so YMMV.

> no warranty, expressed or implied

This isn't enforceable in quite a few jurisdictions anyways. The best you can do is "No warranty to the extend permitted by law" at which point this specific use case is pretty much no longer relevant.

That protects against bugs, segfaults, incompatibilities, etc. Not intentional malware.

There's a big difference between publishing the source code of malware while clearly stating that it's malware, vs publishing trojan malware on NPM while knowing that it will be automatically installed by a bunch of package managers and cause damage. The former is fine; the latter is clearly malicious and is or should be a crime.

/s the real crime here is the way so few people seem to think it is important to pay attention to their dependency tree....

But in all seriousness, that was one of the most jarring things I found when switching from a Java/Maven stack to JS/NPM. Both Maven and NPM offer similar features for managing dependencies, but anecdotally I found the folks managing Java projects to be a lot more obsessive about carefully managing their dependencies while in the NPM world, it seems almost to be a "best practice" to just use open ranges for your dependencies and automatically update them...

So... Sony's rootkit was a-okay in your opinion? Or have you just not given any thought to your position at all? Because that seems to be pretty common among utilitarians who are somehow perpetually surprised by blowback and "unintended consequences". It really strains credulity, the whole "unintended" defense, when you've got people pointing to the predictable outcome. Analogies are rarely helpful in technical discussions, but who knows - maybe this time will be different: boobytraps. Boobytraps are a major no-no, and have been for a very long time, regardless of whatever mitigating circumstances you can dream up (deep in your property, posted warnings, etc). This node dependency was a boobytrap. You can try and justify it by pointing to licenses, concepts of developer IP ownership, etc - it is still a boobytrap. There is no talking your way out of it, in the same way that you wouldn't be able to talk your way out of injuring a trespasser who scaled your fence and triggered a mousetrap rigged 12ga-shell while breaking into your storage shed. This case is even worse - its more like allowing the public to wander onto your property for years to access your free petting zoo, before one day deciding to bury landmines all over the place and post a sign informing people that you take no responsibility for the resulting carnage.

I agree, but I also believe communication should be consensual. That is, the recipient must give consent to install the malware. Otherwise the transmission is a commission of fraud against the recipient.

That said, such a law is difficult to enforce, in a justice system as moribund as ours, so instead we rely on (probably wrong) heuristics about what specific behavior makes us safe, and indeed, whether or not our resources have already been breached. Such behavior is what drives the overwhelming dominance of GMail, which is itself a remarkable tool with which to learn about any person group corporation government on the planet. So in terms of utility its hard to argue that malware is a good to society. Write a malware that installs a patch to prevent a 0-day in known use by a state actor, then I will be a malware fanboy. Not until then.

"Publishing malware is, and should remain, protected expression."

If it is advertised as malware, yes. But if it is advertised as a working open source project - but in reality is malware, then this just destroys trust into open source in general.

I guess it is good, that these things come up, to think about why we trust the dependencies and repositories and their maintainers.

Because it seems, no we cannot just trust them. And now I am more conscious about it.

OSS should be about technology and not politics.

It was not advertised as a "working open source project". In fact, quite the opposite. From the license:

> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

Its fitness for any particular purpose was expressly disclaimed, in all caps.

I'm not sure what people think they did wrong here. You're allowed (and should be allowed) to publish malware, it is up to consumers to not install software they don't want to run.

What more warning could they have possibly posted beyond this one?