registry / Protestware / @esvndev/es-react-dynamic-column

@esvndev/es-react-dynamic-column

This product is designed by ESVN and is only for use in products distributed by ESVN. Any product, whether for non-commercial research or commercial purposes, must have written legal approval and a digital signature from ESVN.

This report shows the evidence for @esvndev/es-react-dynamic-column@1.0.29, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The payload is concrete, targeted, import-time disruptive behavior unrelated to a dynamic-column React component. Absence of install hooks does not remove the browser-runtime attack surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A browser loads/imports the package on a matching Russian-language, Russian/Belarusian host; the local timer exceeds three days.

Impact

Users of matching sites lose pointer interaction and receive repeated unwanted audio.

Mechanism

Targeted browser UI disruption with remote looping audio.

Attack narrative

The entry bundles immediately evaluated code that checks browser language and host suffix. After a three-day localStorage threshold, it disables document-body pointer events, injects an audio element sourced from an external host, and loops playback. This is targeted protestware reachable through normal runtime import.

AI rationale

The payload is concrete, targeted, import-time disruptive behavior unrelated to a dynamic-column React component. Absence of install hooks does not remove the browser-runtime attack surface.

Evidence

package.jsondist/index.jsdist/index.mjslocalStoragedocument.body

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/index.js:22395 targets Russian-language users on .ru/.su/.by/.xn--p1ai hosts.
dist/index.js:22402 disables all body pointer events after a three-day localStorage timer.
dist/index.js:22403-22411 appends looping audio from flag-gimn.ru and attempts playback.
dist/index.mjs:22367-22381 contains the same import-time protestware payload.

Evidence against

package.json has no preinstall, install, or postinstall hook.
No credential harvesting, Node child-process use, or filesystem mutation was found in inspected entrypoints.

Behavioral surface

Source

EnvironmentVars

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 512 KB of source, external domains: cdn.becoxy.com, fb.me, getbootstrap.com, www.w3.org

Oversized source lightweight scan

dist/index.js4.32 MB file, sampled 256 KB

EnvironmentVars

Source & flagged code

4 flagged

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_source_file sizeBytes = 4526746 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

Findings

2 Critical1 High3 Medium2 Low

CriticalTargeted Browser Disruption Protestwaredist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighSemantic Analysis Limiteddist/index.js

MediumEnvironment Vars

MediumOversized Source Filedist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to @esvndev/es-react-dynamic-column@1.0.29.

The versions list below shows the verdict for each recorded version.

Avoid installing @esvndev/es-react-dynamic-column@1.0.29. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-10 02:25:19.658Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.29latestshownMaliciousProtestwareBlockPublishedAug 5, 2026, 4:54 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @esvndev

Other protestware packages

Behavioral surface

Source & flagged code

Related packages

More from @esvndev

Other protestware packages