> repositories that aren't work related during work hours

I still don’t see the problem. Either they’re sitting around with nothing to do, and therefor the contributions are a clear positive, or they’re neglecting the work they’re supposed to be doing and the contributions are beside the point.

I think this can cause legal issues: ianal, but generally work done during company time with company equipment belongs to the company, and I’d guess a litigious company could cause problems for open source projects contributed to in this fashion.

As long as the projects being contributed to are using well understood licenses, the projects themselves are fine. If the employer wants ownership of any of the work, the ownership they’ll get is rights to claim they were contributors. Still mostly good!

What about the other way - if the commit is "damaging" in nature specially on a competitors repo. For example the recent NPM commit that wiped user data. If its done on company time using company laptop, will the company be liable ?

the code is provided as is, without warranty.

Licenses do not supersede laws.

If you build a software and because of a bug it breaks something, that is fine. If you deliberately change a library to make any software running it crash and you know it is used among other things by software that control nuclear plants or elevators, my guess is it will probably considered a crime in most juridictions. This regardless of the fact said software makers should test their changes.

You're very likely right and I made a mistake. In strict legal terms anything you do can be sued if the law deems it damaging it some way or another, and the answer to this->parent's question is highly dependent on legal contexts.

I was taking a naive view from a theoretical point.