registry / @sasindi/patient-registration / 1.0.10

@sasindi/patient-registration@1.0.10

An OpenMRS seed application for building microfrontends

AI Security Review

scanned 10h ago · by lpm-firewall-ai

The shipped browser bundle contains targeted disruption for Russian-language users on selected host suffixes. After a stored initiation time is more than three days old, it disables page interaction and plays looping audio from an external host.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The browser bundle runs in a window with a Russian language setting and a host ending in .ru, .su, .by, or .xn--p1ai; the disruptive action activates after the stored timestamp exceeds three days.

Impact

Affected users can no longer interact with the page, while unwanted audio plays.

Mechanism

The code sets the page body's pointer events to none, adds looping audio, and attempts playback from flag-gimn.ru.

Attack narrative

The browser bundle contains a targeted disruption branch unrelated to patient registration: for Russian-language users on selected host suffixes, it waits over three days, blocks page interaction, and loops externally hosted audio.

AI rationale

The shipped browser bundle has a concrete, targeted browser disruption behavior with an unrelated external audio endpoint. This supports a malicious verdict and install-hook abuse is not the basis for the decision.

Evidence

dist/301.js

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

@sasindi/patient-registration@1.0.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code