--- canonical: "https://firewall.lpm.dev/npm/@esvndev/es-react-dynamic-column/v/1.0.29" markdown: "https://firewall.lpm.dev/npm/@esvndev/es-react-dynamic-column/v/1.0.29.md" package: "@esvndev/es-react-dynamic-column" report_status: "published" title: "@esvndev/es-react-dynamic-column@1.0.29 npm security report" verdict: "malicious" version: "1.0.29" --- # @esvndev/es-react-dynamic-column@1.0.29 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Blocked & quarantined** — Users of matching sites lose pointer interaction and receive repeated unwanted audio. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Matched malicious - **Public report status:** Published - **Threat category:** Protestware - **Selected version:** 1.0.29 - **Selected version is latest:** Yes - **Analysis source:** AI Security Review (lpm-firewall-ai) Importing the bundled browser module activates a targeted protestware timer. On matching sites after three days, it disables page interaction and loops remote audio. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Verdict:** Malicious - **Confidence:** 99.0% - **Started:** 2026-08-10T02:24:19.142Z - **Finished:** 2026-08-10T02:25:19.658Z - **Download time:** 1779 ms - **Static scan time:** 7864 ms - **AI review time:** 50872 ms - **Total time:** 60516 ms ## Security analysis ### Published attack-surface review - **Summary:** Importing the bundled browser module activates a targeted protestware timer. On matching sites after three days, it disables page interaction and loops remote audio. - **Trigger:** A browser loads/imports the package on a matching Russian-language, Russian/Belarusian host; the local timer exceeds three days. - **Impact:** Users of matching sites lose pointer interaction and receive repeated unwanted audio. - **Evidence paths:** package.json, dist/index.js, dist/index.mjs - **Review source:** ai\_review - **Reviewed:** 2026-08-10T02:25:19.658Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** Targeted browser UI disruption with remote looping audio. - **Attack narrative:** The entry bundles immediately evaluated code that checks browser language and host suffix. After a three-day localStorage threshold, it disables document-body pointer events, injects an audio element sourced from an external host, and loops playback. This is targeted protestware reachable through normal runtime import. - **Rationale:** The payload is concrete, targeted, import-time disruptive behavior unrelated to a dynamic-column React component. Absence of install hooks does not remove the browser-runtime attack surface. - **Files touched:** dist/index.js, dist/index.mjs, localStorage, document.body - **Network endpoints:** https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3 ### Review decision - **Verdict:** Malicious - **Confidence:** 99.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for:** dist/index.js:22395 targets Russian-language users on .ru/.su/.by/.xn--p1ai hosts., dist/index.js:22402 disables all body pointer events after a three-day localStorage timer., dist/index.js:22403-22411 appends looping audio from flag-gimn.ru and attempts playback., dist/index.mjs:22367-22381 contains the same import-time protestware payload. - **Evidence against:** package.json has no preinstall, install, or postinstall hook., No credential harvesting, Node child-process use, or filesystem mutation was found in inspected entrypoints. ## Public findings ### 1. Low: Scripts Present - **Category:** Manifest - **Confidence:** 100.0% Package declares npm scripts. ### 2. Medium: Environment Vars - **Category:** Source - **Confidence:** 75.0% Package source references environment variables. ### 3. Critical: Targeted Browser Disruption Protestware - **Category:** Source - **Confidence:** 99.0% - **Path:** dist/index.js - **Public source:** [View source]() Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host. Public source snippet (untrusted): ```javascript if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { ``` ### 4. Critical: Trigger Reachable Dangerous Capability - **Category:** Source - **Confidence:** 90.0% - **Path:** dist/index.js - **Public source:** [View source]() A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior. Public source snippet (untrusted): ```javascript Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern. ``` ### 5. Low: Url Strings - **Category:** Supply Chain - **Confidence:** 65.0% Package source contains URL literals. ### 6. Medium: Oversized Source File - **Category:** Artifact Inventory - **Confidence:** 70.0% - **Path:** dist/index.js - **Public source:** [View source]() Package contains source files above the normal full-analysis size ceiling. Public source snippet (untrusted): ```javascript path = dist/index.js kind = oversized_source_file sizeBytes = 4526746 magicHex = [redacted] ``` ### 7. Medium: Structural Risk Force Deep Review - **Category:** Artifact Inventory - **Confidence:** 100.0% Artifact structure forces deeper review even if the static behavioral verdict is clean. ### 8. High: Semantic Analysis Limited - **Category:** Scanner Coverage - **Confidence:** 100.0% - **Path:** dist/index.js - **Public source:** [View source]() A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review. Public source snippet (untrusted): ```javascript stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1 ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** No - **Dependencies:** 2 - **Optional dependencies:** 0 - **Peer dependencies:** 3 - **Development dependencies:** 71 - **Published dependency-graph edges:** 5 ### Published dependency entries - postcss ^8.4.35 (Dependency) - react-custom-scrollbars-2 ^4.5.0 (Dependency) - react \>=16.8.6 (PeerDependency) - react-dom \>=16.8.6 (PeerDependency) - react-hook-form \>=7.0.0 (PeerDependency) ## Package metadata - **Package:** @esvndev/es-react-dynamic-column - **Ecosystem:** npm - **Version:** 1.0.29 - **License:** ESVN Limited Use License - **Version published:** 2026-08-05T04:54:19.560Z - **Package first seen:** 2026-08-10T02:25:19.658Z - **Package last seen:** 2026-08-10T02:25:19.658Z - **Known versions:** 1 - **Latest version:** 1.0.29 - **Appeal under review:** No - **Description:** This product is designed by ESVN and is only for use in products distributed by ESVN. Any product, whether for non-commercial research or commercial purposes, must have written legal approval and a digital signature from ESVN. - **Author:** dev@esvn.com.vn - **Keywords:** ESVN - **Artifact files:** 38 - **Artifact unpacked size:** 29,612,302 bytes - **Artifact signatures:** 1 - **Attestations:** No ## References - [HTML security report]()