The issue concerns malicious code embedded in the node-ipc package, targeting users with IP addresses located in Russia or Belarus. This code overwrites files with a heart emoji. The package has around a million downloads per week and is used as a dependency by 354 packages, including vue-cli. All projects with node-ipc in their dependencies are also affected. The malicious code is activated with a 25% probability and affects systems with IP addresses from Russia or Belarus.