chunk-yr2m2mz9@1.0.1

One or more suspicious static signals were detected.

Loading the browser payload in a page.

A visitor can be prevented from interacting with the affected page and shown a deceptive subscription-expired message.

Obfuscated page-locking overlay with input suppression and self-removal.

The bundled browser code constructs a high-z-index full-screen overlay, disables scrolling and body input, captures and cancels keypresses, then removes the script tag that loaded it. Its displayed text is encoded rather than plainly represented. Although it does not run through an npm lifecycle hook and does not exfiltrate data, this is concrete hostile page-interference behavior when embedded or loaded.

The code implements a concealed, persistent page-locking payload with no evident legitimate package interface. Absence of installation hooks and network activity limits the impact but does not neutralize the hostile runtime behavior.