registry / remote-calibrator / 0.9.162

remote-calibrator@0.9.162

Useful calibration tools for remote psychophysics experiments

AI Security Review

scanned 11h ago · by lpm-firewall-ai

The browser entrypoint contains targeted disruption for visitors using Russian-language browser settings on selected host suffixes. After a persistent three-day delay, it blocks page interaction and plays looping audio.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The bundle runs in a browser, the browser language begins with ru, and the current host ends in .ru, .su, .by, or .xn--p1ai; the stored initiation date must be more than three days old.

Impact

Affected visitors lose normal page interaction and hear repeated audio.

Mechanism

It sets the document body’s pointer events to none, creates an audio element for an external file, loops it, and attempts playback.

Attack narrative

When its browser checks match and the stored initiation date is more than three days old, the entrypoint disables page interaction and plays a looping audio file from flag-gimn.ru. This is targeted browser disruption within the published entrypoint.

AI rationale

The published browser entrypoint contains active, delayed disruption based on browser language and host suffix, followed by blocking page interaction and looping external audio. This supports a malicious protestware verdict and a publish block.

Evidence

lib/RemoteCalibrator.min.js

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

remote-calibrator@0.9.162

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code