During the past year, since the Russia-Ukraine war began, we’ve seen multiple examples of open-source packages with hidden protest messages and even examples of protest packages executing malicious code, all targeted at Russian developers.

The term “Protestware” has been used to describe software that includes features that are meant to raise awareness or protest an issue.

Last year we witnessed the node-ipc incident and learned protesters could take it one step further by also including malicious code aside from their protest messages.

Python Package “asolytics”

Asolytics is an open-source tool that helps with App Store Optimization (ASO) and provides features like calculating the popularity of keywords, tracking the position of an app in search results, monitoring keywords, and analyzing competitors.

This tool features a simple command-line interface and uses Selenium for automated browser functionality that runs in the background.

Initially, this project appeared to be a legitimate and well-made open-source tool. However, we discovered it through our package analysis system, which scans for potential risks and suspicious activity, indicating the potential presence of Protestware within the asolytics PyPi package.

Upon examination, we discovered that the tool’s business logic contain code that replaces “Russia” with “Russian Terrorist State” before presenting its results to the user.

Given the connection of the project’s owner to Ukraine, it is easy to understand the reason for this message. It is important to note that there is no evidence of any malicious code present in this tool.

My Humble Opinion

While the creators of open-source code have the right to express themselves in their own work, it is important to separate politics from open-source development.

Open-source code is a collaborative effort that should remain neutral and apolitical in order to maintain trust and cohesion within the community.

The incorporation of political messages in open-source code can have detrimental effects, including a loss of trust among users and contributors.

I submitted a pull request to the author’s project suggesting the removal of that message, but the likelihood of the author merging it is low.

Mixing Politics and Open Source: Bad Idea was originally published in Checkmarx Zero on Medium, where people are continuing the conversation by highlighting and responding to this story.