@wwahammy purposeful sabotage never looks good.
An npm package dev tried to do it because of the Russian invasion to Ukraine. It's now called CVE-2022-23812, which should tell you everything you need to know about how purposeful sabotage is viewed by the community.