  Maintainers are now self-sabotaging their work in order to take political or
economic stances, a practice referred to as "protestware". In this poster, we
present our approach to understand how the discourse about such an attack went
viral, how it is received by the community, and whether developers respond to
the attack in a timely manner. We study two notable protestware cases, i.e.,
Colors.js and es5-ext, comparing with discussions of a typical security
vulnerability as a baseline, i.e., Ua-parser, and perform a thematic analysis
of more than two thousand protest-related posts to extract the different
narratives when discussing protestware.
