"protestware" is just malware. The punchline is: do you understand your supply chain? Can you audit your software? Do you have security controls for potentially hostile packages?

This is nothing new: this is a problem which has always existed.