I think it's a bit much to call this sabotage. It's not as if this opensource node-library is fulfilling a crucial role in Russia's war efforts.
Using this reasoning you could argue that any negative comments about the war towards a russian could be construed as sabotage, because it goes against Russian war-propaganda.
Negative comments usually don’t have anything disrupted. This however disrupted the consumption of websites that use this library. So these websites were indeed sabotaged for the end user through this library.
In comparison this act is probably more disruptive then anti-war sticker bombing in grocery stores (https://t.me/nowarmetro/465) and most people would call that sabotage.
But like I said, sabotage is not loaded. It can cause anything from a minor or trivial disruption, to a major destruction. It can have a positive or negative message, or even no message at all.
I would think so, for two reasons: First the web pages using this library are still disrupted (hence sabotaged), and second—a bit far fetched—the propaganda campaign and information gatekeeping efforts by the Russian government have been sabotaged with leaked information.
Using this reasoning you could argue that any negative comments about the war towards a russian could be construed as sabotage, because it goes against Russian war-propaganda.