peacenotwar is a piece of malware created by Brandon Nozaki Miller. In March 2022, it was added as a dependency in an update for node-ipc, a common JavaScript dependency.
Between 7 March and 8 March 2022, Brandon Nozaki Miller, the maintainer of the node-ipc package on the npm package registry, released two updates containing malicious code targeting systems in Russia and Belarus (CVE-2022-23812).[1][2] A week later, Miller added the peacenotwar module as a dependency to node-ipc.[3] The first function of peacenotwar was to create a text file titled WITH-LOVE-FROM-AMERICA.txt on the desktop of affected machines, containing a message in protest of the Russo-Ukrainian War. The second function was geolocating infected systems by IP address. If the infected machine's IP was identified as belonging to Russian or Belarusian users, all files on the system were overwritten with heart emojis.[3][4][5]
Because node-ipc was a common software dependency, it compromised several other projects which relied upon it.[6]
Among the affected projects known was Vue.js, which required node-ipc as a dependency but didn't specify a version. Some users of Vue.js become affected if the dependency was fetched from specific packages. Unity Hub 3.1 was also affected, but a patch was issued the same day as the release.[7][5]
