registry / @tomaso909/jsguitools / 1.8.0

@tomaso909/jsguitools@1.8.0

Resuable front end components

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package evaluates an obfuscated bundle that contains a hidden calendar gate. Once the local year is after 2026, module initialization throws an empty error and the library fails to load.

Static reason

One or more suspicious static signals were detected.

Trigger

Import or require of the package entrypoint when the system year is greater than 2026.

Impact

Consumers lose the GUI library at startup with no explanatory error, starting in 2027. No file writes or network exfiltration were found in that path.

Mechanism

The UMD factory compares new Date().getFullYear() with 0x7ea and throws new Error('') before returning exports.

Attack narrative

The published entry is an obfuscated script. On load it builds the GUI exports, then checks the current year. If that year is after 2026 it throws a blank error and aborts, so any app that imports the package stops initializing. There is no install hook, secret theft, or extra payload; the harm is a concealed time gate that breaks dependents.

AI rationale

The runtime bundle hides a year check that throws an empty error after 2026 and aborts module initialization, which is a concrete protestware time bomb. No install hook or data theft was found, but the gate is active on ordinary import and is enough to block publication.

Evidence

dist/index.obf.jspackage.json

Decision evidence

public snapshot

AI called this Malicious at 90.0% confidence as Malware with false-positive risk.

@tomaso909/jsguitools@1.8.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code