Loading npm security reports…

agenda-desacoplada@0.0.24: Malicious npm security report (Block) | LPM Firewall

registry / agenda-desacoplada / 0.0.24

agenda-desacoplada@0.0.24

Este projeto visa a integração por terceiros á agenda eletrônica da onlineclinic. Se você já possui uma conta na nossa plataforma, você pode utiliza-la em seu site. Atualmente, por instância só é posível realizar agendamentos para um médico em uma clínica

AI Security Review

scanned 10h ago · by lpm-firewall-ai

The published ESM bundle contains targeted browser disruption for Russian-language users on selected host suffixes. It disables page interaction and loops remote audio.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The bundle runs in a browser with a Russian language setting and a host ending in .ru, .su, .by, or .xn--p1ai; disruption follows when the stored date is more than three days old.

Impact

Users on matching sites can be prevented from interacting with the page and subjected to unwanted audio.

Mechanism

The code disables body pointer events, adds looped audio from flag-gimn.ru, and attempts playback after a delay.

Attack narrative

The published ESM bundle checks browser language and host suffix, then uses a stored date to delay disruption. On a matching browser it disables page interaction and plays looped audio from flag-gimn.ru. The package import entry routes consumers to this bundle.

AI rationale

The package’s published import entry contains targeted browser disruption that disables interaction and plays remote audio. This is active behavior in the shipped bundle, so the evidence supports blocking publication.

Evidence

dist/esm/decoupled-agenda.es.js

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

Source & flagged code

5 flagged · loading source

.env.productionView file

19patternName = blocked_file severity = critical blockedFile = .env.production redactedSecretContext = secretLikeLines = 1 L19: VITE_API_KEY=<redacted:36 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.productionView on unpkg · L19

dist/esm/decoupled-agenda.cjs.jsView file

•panose1|paintOrder|pathLength|patternContentUnits|patternTransform|patternUnits|pointerEvents|points|pointsAtX|pointsAtY|pointsAtZ|preserveAlpha|preserveAspectR

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/esm/decoupled-agenda.cjs.jsView on unpkg

•Trigger-reachable chain: manifest.main -> dist/esm/decoupled-agenda.cjs.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/esm/decoupled-agenda.cjs.jsView on unpkg

245In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}()}function R(T,v){(v==null||v>T.length)&&(v=T.length);for(var E=0,f=new Array(v);E<v;E++)f[E]=... L246: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}()}function p(u,k){(k==null||k>u.length)&&(k=u.length);for(var T=0,v=new Array(k);T<k;T++)v[T]=... L247: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}()}(F.split("["),2),V=q[0],b=q[1];b=b.replace("]",""),h=h.replace(new RegExp("".concat((0,p.esc...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/decoupled-agenda.cjs.jsView on unpkg · L245

src/App.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/App.cssView on unpkg

Source & flagged code

5 flagged

.env.productionView file

Lines 1-24text

1# Valores que o Vite embute no bundle PUBLICADO (`vite build` roda em mode=production e

2# da' prioridade a este arquivo sobre o `.env` pessoal, que fica so' no `npm run dev`).

3#

4# Sao os valores recuperados do bundle da 0.0.23 que esta' no ar hoje: ate' 18/09/2026 eles so'

5# existiam dentro do artefato publicado, porque nenhum `.env` jamais foi versionado -- o bundle

6# saiu carimbado com o `.env` da maquina de quem publicou em jul/2025. Versionados aqui para que

7# qualquer build reproduza o MESMO bundle, em vez do `.env` de quem estiver publicando.

8#

9# NAO sao usados na pratica: `App.tsx` sobrescreve o CONFIG com os atributos do web component, e

10# todo HTML de cliente passa todos eles. Valem so' como fallback se um atributo faltar -- e ai' o

11# `localhost:8080` abaixo morre no navegador do paciente. Corrigir isso e' outra discussao

12# (exigir os atributos em vez de cair num default); mexer aqui MUDA o artefato dos ~15 clientes.

13

14VITE_ENVIRONMENT=DEVELOPMENT

15

16VITE_AUTHORIZATION_ENDPOINT=http://localhost:8080/api/v1/auth/one-time-token/

17VITE_DEVELOPMENT_ENDPOINT=http://localhost:8080/api/v1/appointment/create/

18

19VITE_API_KEY=b3a22879-d21e-49f4-9fcc-61f1188ffda3

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.productionView on unpkg · L19

20VITE_DOCTOR_ID=1431

21VITE_CLINIC_ID=24

22

23VITE_WHITELABEL_LOGO=https://www.onlineclinic.com.br/wp-content/uploads/2022/06/cropped-cropped-Logo.png

24

dist/esm/decoupled-agenda.cjs.jsView file

•panose1|paintOrder|pathLength|patternContentUnits|patternTransform|patternUnits|pointerEvents|points|pointsAtX|pointsAtY|pointsAtZ|preserveAlpha|preserveAspectR

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/esm/decoupled-agenda.cjs.jsView on unpkg

•Trigger-reachable chain: manifest.main -> dist/esm/decoupled-agenda.cjs.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/esm/decoupled-agenda.cjs.jsView on unpkg

245In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}()}function R(T,v){(v==null||v>T.length)&&(v=T.length);for(var E=0,f=new Array(v);E<v;E++)f[E]=... L246: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}()}function p(u,k){(k==null||k>u.length)&&(k=u.length);for(var T=0,v=new Array(k);T<k;T++)v[T]=... L247: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}()}(F.split("["),2),V=q[0],b=q[1];b=b.replace("]",""),h=h.replace(new RegExp("".concat((0,p.esc...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/App.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/App.cssView on unpkg