This week, the developer of the popular npm package 'node-ipc' released sabotaged versions of the library in protest of the ongoing Russo-Ukrainian War. The 'node-ipc' package, which gets downloaded over a million times weekly, began deleting files on developer's machines, in addition to creating new text files with "peace" messages.
Only because they were told to do so, I'm sure there's probably some law if you're an American company (aside from other, non-legal coercion). McDonalds, ikea and all the other companies that are solidified in Russia will gladly return, it's a huge market for them.
McDonalds actually said they'll keep paying wages in Russia (while the stores are closed). They have 62k employees in Russia...
Critical support for McDonald's increasing the paid time off they offer their employees.