registry / brainsmatics / 1.1.88

brainsmatics@1.1.88

brainsmatics

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Importing the package loads a browser bundle containing targeted disruption. On qualifying browser language and host conditions, it disables page interaction and plays external looping audio.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Import the package in a browser with a Russian language setting on a matching host; revisit after the stored three-day delay.

Impact

Disrupts users of targeted sites and makes the page unusable.

Mechanism

Targeted browser protestware that blocks pointer input and injects autoplaying audio.

Attack narrative

The package entrypoint imports dist/index-599009d2.mjs. Its top-level browser code targets Russian-language browsers on Russian-related domains, uses local storage to delay activation, then removes pointer interaction from the entire page. It appends a looping audio element sourced from an unrelated external host and attempts playback. This is deliberate targeted browser disruption, not a feature required by a component library.

Rationale

The source confirms a reachable, targeted browser-disruption payload in the import graph. No install hook is required for the malicious runtime impact.

Evidence

package.jsondist/index.mjsdist/index-599009d2.mjs

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The importable browser bundle contains targeted protestware.
It triggers for Russian-language browsers on Russian-related host suffixes.
After three days it disables all page pointer interaction.
It injects looping audio from an external host and attempts playback.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The behavior is browser-only and does not harvest credentials or execute shell commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 729 KB of source, external domains: fb.me, u.ant.design, www.w3.org

Oversized source lightweight scan

dist/index-17150fab.js5.92 MB file, sampled 256 KB

Source & flagged code

6 flagged

dist/index-17150fab.jsView file

•ent`]:{display:"inline-block",padding:v,background:y,borderRadius:m,boxShadow:r,pointerEvents:"all"},[`${e}-success > ${n}`]:{color:a},[`${e}-error > ${n}`]:{co

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index-17150fab.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/index-17150fab.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-17150fab.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-17150fab.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 349a67e3d916b66e signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = brainsmatics@1.1.87 matchedPath = dist/index-50515355.js matchedIdentity = npm:YnJhaW5zbWF0aWNz:1.1.87 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index-17150fab.jsView on unpkg

•path = dist/index-17150fab.js kind = oversized_source_file sizeBytes = 6211163 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index-17150fab.jsView on unpkg

dist/index.mjsView file

Lines 1-21javascript

1import { f as t, r as o, p as i, o as n, A as d, B as l, k as h, v as m, q as f, d as c, C as p, D as B, F as C, s as

Source & flagged code

6 flagged · loading source

dist/index-17150fab.jsView file

•ent`]:{display:"inline-block",padding:v,background:y,borderRadius:m,boxShadow:r,pointerEvents:"all"},[`${e}-success > ${n}`]:{color:a},[`${e}-error > ${n}`]:{co

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/index-17150fab.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/index-17150fab.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-17150fab.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-17150fab.jsView on unpkg

Findings

2 Critical3 High4 Medium3 Low

CriticalTargeted Browser Disruption Protestwaredist/index-17150fab.js

CriticalTrigger Reachable Dangerous Capabilitydist/index-17150fab.js

HighSemantic Analysis Limiteddist/index-17150fab.js

HighKnown Malware Source Fingerprint Signaturedist/index-17150fab.js

HighAi Review Evidencedist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index-17150fab.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings