Did the packages in question have a bright red warning that said “your files will be deleted if you’re in Russia?”
> as of v11 this module uses the peacenotwar module.
Over on its NPM site: https://www.npmjs.com/package/node-ipc
And as far as i can tell they bumped up the major version by a digit. Whether or not that counts as a "Bright red warning" i don't know but personally i believe that a warning notice + a major version bump should be enough. Those who don't care about that would most likely not care about a bright red warning on the repo page either.
It's clearly a questionable thing to do, but is it illegal?
No normal person would see "peacenotwar" for the first time and assume it does something bad.
This counts as "no warning whatsoever", and no competent lawyer would say it's a warning message.