PeaceNotWar
- First seen
- 2022-03-08 00:00:00
- Malware type
- wiper
- Profile updated
- 2026-07-07 14:33:55
Targeted regions: country_code:ru country_code:by
Context
PeaceNotWar was integrated into the nodejs module node-ipc as a piece of malware/protestware with wiper characteristics. It targets machines with a public IP address located in Russia and Belarus (using geolocation) and overwrites files recursively using a heart emoji.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Js.Peacenotwar (report)
- gist.github.com — F7Ae3457420Af78A54B38A31Cc0C809C (report)
- vice.com — Open Source Sabotage Node Ipc Wipe Russia Belraus Computers (report)
- bleepingcomputer.com — Big Sabotage Famous Npm Package Deletes Files To Protest Ukraine War (report)