tibox-maestros@1.1.4
This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
AI Security Review
scanned 9h ago · by lpm-firewall-aiBoth published entrypoints contain the same targeted browser disruption, and the manifest exposes them for import and require. This is concrete protestware behavior, so the package should be blocked.
Decision evidence
public snapshot- The manifest exposes the ESM and CommonJS bundles as package entrypoints.
- The ESM bundle checks for a Russian browser language and specified host suffixes, then after the stored date is more than three days old disables page interaction and starts looping audio from a fixed URL.
- The CommonJS bundle contains the same locale, host, delay, interaction-blocking, and audio behavior.
Source & flagged code
4 flagged · loading sourceBrowser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.
dist/index.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/index.jsView on unpkg · L2585A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
Affected versions and remediation
This report applies to tibox-maestros@1.1.4.
See all versions of tibox-maestros for other recorded verdicts.
- Avoid installing tibox-maestros@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.