konnektive-one@1.0.1

One or more suspicious static signals were detected.

Loading dist/engine.js in a browser matching ru language and targeted host TLD after the localStorage delay

Affected storefront pages can become unusable and play unsolicited remote audio.

protestware page disruption in bundled dependency code

When the package's main browser bundle loads, embedded SweetAlert2 code checks navigator.language and the page host. On matching Russian-language users and targeted TLDs, it records a localStorage timestamp; after the delay threshold, it disables body pointer events and appends a looping audio element sourced from flag-gimn.ru. This is non-consensual runtime disruption unrelated to checkout behavior.

Static inspection confirms concrete protestware in the shipped main bundle, despite otherwise package-aligned checkout API behavior and no install hook. Because the code can intentionally degrade consumer sites for a targeted user/host class, this is malicious rather than a noisy scanner hit.