registry / Protestware / brainsmatics

brainsmatics

This report shows the evidence for brainsmatics@1.1.88. 2 of 14 known versions are blocked or flagged. The newest version, 1.2.6, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source confirms a reachable, targeted browser-disruption payload in the import graph. No install hook is required for the malicious runtime impact.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Import the package in a browser with a Russian language setting on a matching host; revisit after the stored three-day delay.

Impact

Disrupts users of targeted sites and makes the page unusable.

Mechanism

Targeted browser protestware that blocks pointer input and injects autoplaying audio.

Attack narrative

The package entrypoint imports dist/index-599009d2.mjs. Its top-level browser code targets Russian-language browsers on Russian-related domains, uses local storage to delay activation, then removes pointer interaction from the entire page. It appends a looping audio element sourced from an unrelated external host and attempts playback. This is deliberate targeted browser disruption, not a feature required by a component library.

AI rationale

The source confirms a reachable, targeted browser-disruption payload in the import graph. No install hook is required for the malicious runtime impact.

Evidence

package.jsondist/index.mjsdist/index-599009d2.mjs

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The importable browser bundle contains targeted protestware.
It triggers for Russian-language browsers on Russian-related host suffixes.
After three days it disables all page pointer interaction.
It injects looping audio from an external host and attempts playback.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The behavior is browser-only and does not harvest credentials or execute shell commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 729 KB of source, external domains: fb.me, u.ant.design, www.w3.org

Oversized source lightweight scan

dist/index-17150fab.js5.92 MB file, sampled 256 KB

Source & flagged code

6 flagged

dist/index-17150fab.jsView file

•ent`]:{display:"inline-block",padding:v,background:y,borderRadius:m,boxShadow:r,pointerEvents:"all"},[`${e}-success > ${n}`]:{color:a},[`${e}-error > ${n}`]:{co

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index-17150fab.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/index-17150fab.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-17150fab.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-17150fab.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 349a67e3d916b66e signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = brainsmatics@1.1.87 matchedPath = dist/index-50515355.js matchedIdentity = npm:YnJhaW5zbWF0aWNz:1.1.87 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index-17150fab.jsView on unpkg

•path = dist/index-17150fab.js kind = oversized_source_file sizeBytes = 6211163 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index-17150fab.jsView on unpkg

dist/index.mjsView file

Lines 1-21javascript

1import { f as t, r as o, p as i, o as n, A as d, B as l, k as h, v as m, q as f, d as c, C as p, D as B, F as C, s as

Source & flagged code

6 flagged · loading source

dist/index-17150fab.jsView file

•ent`]:{display:"inline-block",padding:v,background:y,borderRadius:m,boxShadow:r,pointerEvents:"all"},[`${e}-success > ${n}`]:{color:a},[`${e}-error > ${n}`]:{co

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index-17150fab.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/index-17150fab.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-17150fab.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-17150fab.jsView on unpkg

Findings

2 Critical3 High4 Medium3 Low

CriticalTargeted Browser Disruption Protestwaredist/index-17150fab.js

CriticalTrigger Reachable Dangerous Capabilitydist/index-17150fab.js

HighSemantic Analysis Limiteddist/index-17150fab.js

HighKnown Malware Source Fingerprint Signaturedist/index-17150fab.js

HighAi Review Evidencedist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index-17150fab.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to brainsmatics@1.1.88.

The versions list below shows the verdict for each recorded version.

Avoid installing brainsmatics@1.1.88. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-27 07:47:33.767Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

14 known versions

1.2.6latestUnknown—AllowUnder ReviewOct 16, 2026, 9:04 AM 1.2.5Unknown—AllowUnder ReviewOct 14, 2026, 8:46 AM 1.2.4Unknown—AllowUnder ReviewOct 13, 2026, 9:29 AM 1.2.3Unknown—AllowUnder ReviewOct 9, 2026, 6:01 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other protestware packages

Related packages

Other protestware packages

Source & flagged code