> In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war.

Well, yeah. War is bad. On the spectrum of war badness, obviously, these pranks are pretty mild. But they're bad. It's a bad situation. When at war, people are forced to do bad things to prevent worse things. That's why starting wars is very bad.

Now, sure, you can argue about the semantics about "who" is at war, or whether these npm authors are "really" at war, or why they "think" they're at war, or whether they "should" be at war. You could also get into a discussion about whether or not this tactic is effective (and I'd agree it's hurting more than helping, btw). Go nuts.

But that doesn't change the fact that this is an action in support of a war effort. In wars, principled stands don't win. If you want a particular outcome, you have to pick a side.