registry / Protestware / es-workflow-template
es-workflow-template
React
This report shows the evidence for es-workflow-template@0.4.35, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe published runtime bundle contains a concrete, automatically triggered browser-disruption payload. The absence of an npm lifecycle hook does not mitigate runtime protestware affecting consumers.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A browser loads the package entry point while the visitor uses a Russian language setting and a matching host suffix, then revisits after three days.
Impact
Affected users cannot interact with the page and receive looping unsolicited audio.
Mechanism
Targeted browser protestware using DOM mutation and remote audio.
Attack narrative
The package exposes bundled browser entry points. Their embedded SweetAlert2 code automatically checks the browser language and host, records an initiation date in local storage, and after three days disables pointer events on the whole page. It then appends a looping audio element whose source is hosted at flag-gimn.ru. This is an automatic, targeted disruption of a consumer application's users rather than a user-invoked feature.
AI rationale
The published runtime bundle contains a concrete, automatically triggered browser-disruption payload. The absence of an npm lifecycle hook does not mitigate runtime protestware affecting consumers.
Evidence
dist/index.jsdist/index.mjs
Network endpoints1
flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The published browser entry points bundle code that targets Russian-language visitors on Russian, Belarusian, and related host suffixes.
- After a three-day local-storage delay, the payload disables page interaction and loops audio loaded from flag-gimn.ru.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- No credential harvesting or data exfiltration was found in the inspected trigger.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedProtestwareUrlStrings
Source & flagged code
4 flagged · loading sourcedist/index.jsView file
•panose1|paintOrder|pathLength|patternContentUnits|patternTransform|patternUnits|pointerEvents|points|pointsAtX|pointsAtY|pointsAtZ|preserveAlpha|preserveAspectR
Critical
Targeted Browser Disruption Protestware
Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.
dist/index.jsView on unpkg•Trigger-reachable chain: manifest.main -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg13@license MIT
L14: */;var te=Object.getOwnPropertySymbols,ne=Object.prototype.hasOwnProperty,re=Object.prototype.propertyIsEnumerable;var oe=function(){try{if(!Object.assign)return!1;var e=new String...
L15: /*!
...
L24: */
L25: function oc(e,t,n){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:n;throw new TypeError("Private element is not present on this object")}function ic(e,t){return...
L26: //! moment.js
High
Same File Env Network Execution
Findings
2 Critical2 High4 Medium4 Low
CriticalTargeted Browser Disruption Protestwaredist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Process
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to es-workflow-template@0.4.35.
The versions list below shows the verdict for each recorded version.
- Avoid installing es-workflow-template@0.4.35. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.