I just don't understand what the node-ipc dev was expecting when he did that. "Hm, maybe if I put malware into a community-trusted module that destroys files of people in a certain geopolitical region, the countless innocent citizens that are affected will realize what they did wrong! Wait, who am I actually targeting again?"
Probably hoped the effects would negatively effect people there so they could put pressure to stop the murder of other innocent civilians. Arguments like this are similar to the BLM protest that try to equate property with human lives.
A) IP geolocation is far from perfect, quite a few completely unrelated people could have been affected.
B) There was a chance of massive collateral damage to stuff like hospitals, water company, etc. and therefore affecting civilians, including children. If you think Putin wouldn't use that to rally Russia and launch a massive war, you haven't observed Putin for long.
We got very lucky this software equivalent of a warcrime was stopped early. Yet the punishment was absurdly light. I will staying away from NPM after that.