registry / brainsmatics / 1.1.87

brainsmatics@1.1.87

brainsmatics

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the package executes a host- and language-targeted protestware branch. It disables page interaction and plays looping remote audio after a delayed, persisted trigger.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Import the package in a browser with a Russian language setting on a matching host after the localStorage delay.

Impact

Targeted users lose page interactivity and receive forced audio playback.

Mechanism

Targeted DOM denial of interaction plus looping remote audio injection.

Attack narrative

The declared ESM entry imports the affected bundle. At module evaluation, it checks for Russian browser language and specified host suffixes. For targeted visitors, it records a localStorage timestamp; after more than three days, it disables pointer events on the entire document, appends an audio element sourced from a fixed external URL, and loops playback. This is concrete targeted browser-disruption protestware, not a package feature.

Rationale

The package contains reachable import-time targeted browser disruption and forced remote audio playback. No install hook is needed for the malicious runtime behavior.

Evidence

package.jsondist/index.mjsdist/index-da4988c7.mjs

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Package main imports the bundled runtime.
Import-time code targets Russian-language users on selected host suffixes.
After three days it disables all page pointer interaction.
It injects looping remote audio from a fixed external host.

Evidence against

No npm preinstall/install/postinstall lifecycle hook is declared.
The harmful branch does not harvest credentials or local files.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 729 KB of source, external domains: fb.me, u.ant.design, www.w3.org

Oversized source lightweight scan

dist/index-50515355.js5.89 MB file, sampled 256 KB

ChildProcessEnvironmentVars

Source & flagged code

6 flagged

dist/index-50515355.jsView file

•ent`]:{display:"inline-block",padding:g,background:y,borderRadius:m,boxShadow:r,pointerEvents:"all"},[`${e}-success > ${n}`]:{color:a},[`${e}-error > ${n}`]:{co

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index-50515355.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/index-50515355.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-50515355.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-50515355.jsView on unpkg

dist/index-da4988c7.mjsView file

•path = dist/index-da4988c7.mjs kind = oversized_source_file sizeBytes = 8714450 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index-da4988c7.mjsView on unpkg

package.jsonView file

Lines 1-27json

2 "name": "brainsmatics",

3 "version": "1.1.87",

4 "description": "brainsmatics",

5 "author": "ygwang",

dist/index.mjsView file

Lines 1-21javascript

1import { f as t, r as o, p as i, o as n, A as d, B as l, k as h, v as m, q as f, d as c, C as p, D as B, F as C, s as

Source & flagged code

6 flagged · loading source

dist/index-50515355.jsView file

•ent`]:{display:"inline-block",padding:g,background:y,borderRadius:m,boxShadow:r,pointerEvents:"all"},[`${e}-success > ${n}`]:{color:a},[`${e}-error > ${n}`]:{co

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index-50515355.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/index-50515355.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-50515355.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-50515355.jsView on unpkg

Findings

2 Critical3 High4 Medium3 Low

CriticalTargeted Browser Disruption Protestwaredist/index-50515355.js

CriticalTrigger Reachable Dangerous Capabilitydist/index-50515355.js

HighSemantic Analysis Limiteddist/index-50515355.js

HighAi Review Evidencepackage.json

HighAi Review Evidencedist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index-da4988c7.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings