registry / @sasindi/user-registration / 1.0.20

@sasindi/user-registration@1.0.20

An OpenMRS seed application for building microfrontends

AI Security Review

scanned 10h ago · by lpm-firewall-ai

The browser bundle contains targeted protestware that disrupts page use and plays externally hosted audio.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The code runs in a browser with a Russian-language setting and a host ending in .ru, .su, .by, or .xn--p1ai; after the stored initiation date is more than three days old, a timer activates it.

Impact

Affected visitors may be unable to interact with the page and are subjected to unwanted audio.

Mechanism

It disables pointer interaction on the page and loops an audio file hosted at flag-gimn.ru.

Attack narrative

In dist/465.js, a browser-language and host check gates a delayed action. Once the stored date is over three days old, the code disables pointer interaction and loops an audio file from flag-gimn.ru. This is targeted browser disruption and unsolicited audio playback.

AI rationale

The browser bundle implements targeted, disruptive behavior unrelated to user registration. The conditional trigger does not make the page disruption or unsolicited audio benign.

Evidence

dist/465.js

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence with false-positive risk.

@sasindi/user-registration@1.0.20

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code