console-self-xss-warning 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 hksm-app
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,171 @@
+# console-self-xss-warning
+
+Show a self-XSS warning in the browser console to protect users from social
+engineering.
+
+## Install
+
+```
+npm install console-self-xss-warning
+```
+
+## Quick start
+
+```ts
+import { showConsoleWarning } from "console-self-xss-warning";
+
+showConsoleWarning();
+```
+
+## Next.js (App Router)
+
+Call it in a client component so it runs only in the browser.
+
+```tsx
+"use client";
+
+import { useEffect } from "react";
+import { showConsoleWarning } from "console-self-xss-warning";
+
+export function ConsoleWarning() {
+  useEffect(() => {
+    showConsoleWarning({ productionOnly: true });
+  }, []);
+
+  return null;
+}
+```
+
+Re-log on route changes:
+
+```tsx
+"use client";
+
+import { useEffect } from "react";
+import { usePathname } from "next/navigation";
+import { showConsoleWarning } from "console-self-xss-warning";
+
+export function ConsoleWarning() {
+  const pathname = usePathname();
+
+  useEffect(() => {
+    showConsoleWarning({ once: false, clearConsole: false, productionOnly: true });
+  }, [pathname]);
+
+  return null;
+}
+```
+
+## Configuration
+
+| parameter | default | required | description |
+| --- | --- | --- | --- |
+| `translations` | built-in translations | no | override texts and styles per language |
+| `forceLang` | auto-detect (`navigator.language`) | no | force a specific language |
+| `once` | `true` | no | show only once per page load |
+| `productionOnly` | `false` | no | show only in production mode |
+| `clearConsole` | `false` | no | clear the console before logging |
+| `productionOnlyEnvKey` | default key list | no | read `productionOnly` from an env variable |
+
+### Common options
+
+```ts
+showConsoleWarning({
+  once: true,            // show only once per page load
+  clearConsole: false,   // optionally clear console before warning
+  productionOnly: false  // gate by production environment
+});
+```
+
+### Custom translation
+
+```ts
+showConsoleWarning({
+  translations: {
+    en: {
+      title: "STOP!",
+      message:
+        "This is for developers only.\nIf someone asks you to paste code here, it is a scam.",
+      titleStyle: "color:#d00;font-size:52px;font-weight:900;",
+      messageStyle: "font-size:16px;"
+    }
+  }
+});
+```
+
+### Full custom JSON
+
+```ts
+const translations = {
+  en: {
+    title: "STOP!",
+    message: "Private area.\nDo not paste anything here."
+  },
+  fr: {
+    title: "STOP !",
+    message: "Zone privée.\nNe collez rien ici."
+  }
+};
+
+showConsoleWarning({
+  translations,
+  forceLang: "en",
+  clearConsole: true
+});
+```
+
+## Environment config for productionOnly
+
+If you want `productionOnly` to be driven by an environment variable, pass
+your own key name using `productionOnlyEnvKey`.
+
+```ts
+showConsoleWarning({
+  productionOnlyEnvKey: "MY_APP_CONSOLE_WARNING_PROD_ONLY"
+});
+```
+
+You can also pass multiple keys (first match wins):
+
+```ts
+showConsoleWarning({
+  productionOnlyEnvKey: ["MY_KEY_1", "MY_KEY_2"]
+});
+```
+
+Boolean values accepted: `1/0`, `true/false`, `yes/no`, `on/off`
+
+Default keys (if you do not pass anything):
+
+- `CONSOLE_SELF_XSS_WARNING_PRODUCTION_ONLY`
+- `VITE_CONSOLE_SELF_XSS_WARNING_PRODUCTION_ONLY`
+- `NEXT_PUBLIC_CONSOLE_SELF_XSS_WARNING_PRODUCTION_ONLY`
+
+## API
+
+```ts
+type Options = {
+  translations?: {
+    [lang: string]: {
+      title: string
+      message: string
+      titleStyle?: string
+      messageStyle?: string
+    }
+  }
+  forceLang?: string
+  once?: boolean
+  productionOnly?: boolean
+  clearConsole?: boolean
+  productionOnlyEnvKey?: string | string[]
+}
+
+showConsoleWarning(options?)
+```
+
+## Notes
+
+- Runs only in the browser and is safe for SSR.
+- Default language is auto-detected via `navigator.language` with `en` fallback.
+- `\\n` in translations is converted to a real line break in console output.
+- No external dependencies.

package/dist/detectLanguage.d.ts

@@ -0,0 +1 @@
+export declare function detectLanguage(fallback?: string): string;

package/dist/detectLanguage.js

@@ -0,0 +1,13 @@
+export function detectLanguage(fallback = "en") {
+    if (typeof navigator === "undefined") {
+        return fallback;
+    }
+    const raw = (Array.isArray(navigator.languages) && navigator.languages[0]) ||
+        navigator.language ||
+        fallback;
+    if (!raw) {
+        return fallback;
+    }
+    const normalized = raw.toLowerCase().replace("_", "-");
+    return normalized.split("-")[0] || fallback;
+}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export type Translation = {
+    title: string;
+    message: string;
+    titleStyle?: string;
+    messageStyle?: string;
+};
+export type Options = {
+    translations?: Record<string, Translation>;
+    forceLang?: string;
+    once?: boolean;
+    productionOnly?: boolean;
+    clearConsole?: boolean;
+    productionOnlyEnvKey?: string | string[];
+};
+export declare function showConsoleWarning(options?: Options): void;

package/dist/index.js

@@ -0,0 +1,192 @@
+import defaultTranslations from "./translations.default.json";
+import { detectLanguage } from "./detectLanguage";
+const DEFAULT_TITLE_STYLE = "color:red;font-size:48px;font-weight:bold;";
+const DEFAULT_MESSAGE_STYLE = "font-size:16px;";
+const DEFAULT_SPAM_INTERVAL_MS = 2000;
+const DEVTOOLS_SIZE_THRESHOLD_PX = 160;
+const GLOBAL_ONCE_FLAG = "__consoleSelfXssWarningShown__";
+let hasShown = false;
+let spamIntervalId;
+let spamPayload;
+function getHasShown() {
+    if (hasShown) {
+        return true;
+    }
+    if (typeof globalThis !== "undefined") {
+        return Boolean(globalThis[GLOBAL_ONCE_FLAG]);
+    }
+    return false;
+}
+function setHasShown() {
+    hasShown = true;
+    if (typeof globalThis !== "undefined") {
+        globalThis[GLOBAL_ONCE_FLAG] = true;
+    }
+}
+function isDevtoolsLikelyOpen() {
+    if (typeof window === "undefined") {
+        return false;
+    }
+    return (window.outerWidth - window.innerWidth > DEVTOOLS_SIZE_THRESHOLD_PX ||
+        window.outerHeight - window.innerHeight > DEVTOOLS_SIZE_THRESHOLD_PX);
+}
+function isBrowser() {
+    return typeof window !== "undefined" && typeof console !== "undefined";
+}
+function isProduction() {
+    const proc = typeof globalThis !== "undefined"
+        ? globalThis.process
+        : undefined;
+    const nodeEnv = proc && proc.env && typeof proc.env.NODE_ENV === "string"
+        ? proc.env.NODE_ENV
+        : undefined;
+    if (nodeEnv) {
+        return nodeEnv === "production";
+    }
+    const metaEnv = typeof import.meta !== "undefined"
+        ? import.meta.env
+        : undefined;
+    if (metaEnv) {
+        if (typeof metaEnv.PROD === "boolean") {
+            return metaEnv.PROD;
+        }
+        if (typeof metaEnv.MODE === "string") {
+            return metaEnv.MODE === "production";
+        }
+    }
+    return false;
+}
+function parseEnvBoolean(value) {
+    if (typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const normalized = value.trim().toLowerCase();
+    if (["1", "true", "yes", "y", "on"].includes(normalized)) {
+        return true;
+    }
+    if (["0", "false", "no", "n", "off"].includes(normalized)) {
+        return false;
+    }
+    return undefined;
+}
+const DEFAULT_PRODUCTION_ONLY_ENV_KEYS = [
+    "CONSOLE_SELF_XSS_WARNING_PRODUCTION_ONLY",
+    "VITE_CONSOLE_SELF_XSS_WARNING_PRODUCTION_ONLY",
+    "NEXT_PUBLIC_CONSOLE_SELF_XSS_WARNING_PRODUCTION_ONLY"
+];
+function resolveEnvValue(env, keys) {
+    if (!env) {
+        return undefined;
+    }
+    for (const key of keys) {
+        if (key in env) {
+            return env[key];
+        }
+    }
+    return undefined;
+}
+function getConfigProductionOnly(keys) {
+    const keyList = typeof keys === "string"
+        ? [keys]
+        : Array.isArray(keys) && keys.length > 0
+            ? keys
+            : DEFAULT_PRODUCTION_ONLY_ENV_KEYS;
+    const proc = typeof globalThis !== "undefined"
+        ? globalThis.process
+        : undefined;
+    const nodeEnvValue = resolveEnvValue(proc && proc.env ? proc.env : undefined, keyList);
+    const metaEnv = typeof import.meta !== "undefined"
+        ? import.meta.env
+        : undefined;
+    const metaValue = resolveEnvValue(metaEnv, keyList);
+    return parseEnvBoolean(nodeEnvValue !== null && nodeEnvValue !== void 0 ? nodeEnvValue : metaValue);
+}
+function mergeTranslations(overrides) {
+    if (!overrides) {
+        return defaultTranslations;
+    }
+    const merged = {
+        ...defaultTranslations,
+        ...overrides
+    };
+    return merged;
+}
+function resolveTranslation(translations, lang) {
+    const fallback = translations.en ||
+        defaultTranslations.en || {
+        title: "STOP!",
+        message: "This is a browser feature for developers.\nIf someone asks you to paste something here — it is a scam."
+    };
+    const selected = translations[lang] || translations[lang.toLowerCase()];
+    if (!selected) {
+        return fallback;
+    }
+    const rawTitle = selected.title || fallback.title;
+    const rawMessage = selected.message || fallback.message;
+    return {
+        title: rawTitle.replace(/\\n/g, "\n"),
+        message: rawMessage.replace(/\\n/g, "\n"),
+        titleStyle: selected.titleStyle,
+        messageStyle: selected.messageStyle
+    };
+}
+function logWarning(payload) {
+    if (payload.clearConsole && typeof console.clear === "function") {
+        console.clear();
+    }
+    console.log(`%c${payload.title}`, payload.titleStyle || DEFAULT_TITLE_STYLE);
+    console.log(`%c${payload.message}`, payload.messageStyle || DEFAULT_MESSAGE_STYLE);
+}
+function startSpam(payload) {
+    spamPayload = payload;
+    if (typeof window === "undefined") {
+        return;
+    }
+    if (spamIntervalId !== undefined) {
+        return;
+    }
+    if (isDevtoolsLikelyOpen()) {
+        logWarning(payload);
+        setHasShown();
+    }
+    spamIntervalId = window.setInterval(() => {
+        if (!spamPayload || !isDevtoolsLikelyOpen()) {
+            return;
+        }
+        logWarning(spamPayload);
+        setHasShown();
+    }, DEFAULT_SPAM_INTERVAL_MS);
+}
+export function showConsoleWarning(options = {}) {
+    var _a;
+    if (!isBrowser()) {
+        return;
+    }
+    const { translations: translationOverrides, forceLang, once = true, productionOnly, clearConsole = false, productionOnlyEnvKey } = options;
+    const resolvedProductionOnly = (_a = productionOnly !== null && productionOnly !== void 0 ? productionOnly : getConfigProductionOnly(productionOnlyEnvKey)) !== null && _a !== void 0 ? _a : false;
+    if (resolvedProductionOnly && !isProduction()) {
+        return;
+    }
+    if (once && getHasShown()) {
+        return;
+    }
+    const translations = mergeTranslations(translationOverrides);
+    const lang = (forceLang || detectLanguage("en")).toLowerCase();
+    const { title, message, titleStyle, messageStyle } = resolveTranslation(translations, lang);
+    const payload = {
+        title,
+        message,
+        titleStyle,
+        messageStyle,
+        clearConsole
+    };
+    if (!once) {
+        startSpam(payload);
+        return;
+    }
+    logWarning(payload);
+    setHasShown();
+}

package/dist/translations.default.json

@@ -0,0 +1,126 @@
+{
+    "en": {
+        "title": "STOP!",
+        "message": "This is a browser feature for developers.\\nIf someone asks you to paste something here — it is a scam."
+    },
+    "es": {
+        "title": "¡ALTO!",
+        "message": "Esta es una función del navegador para desarrolladores.\\nSi alguien te pide que pegues algo aquí, es una estafa."
+    },
+    "fr": {
+        "title": "STOP !",
+        "message": "Ceci est une fonctionnalité du navigateur pour les développeurs.\\nSi quelqu'un vous demande de coller quelque chose ici, c'est une arnaque."
+    },
+    "de": {
+        "title": "STOPP!",
+        "message": "Dies ist eine Browserfunktion für Entwickler.\\nWenn dich jemand bittet, hier etwas einzufügen, ist das Betrug."
+    },
+    "it": {
+        "title": "STOP!",
+        "message": "Questa è una funzione del browser per sviluppatori.\\nSe qualcuno ti chiede di incollare qualcosa qui, è una truffa."
+    },
+    "pt": {
+        "title": "PARE!",
+        "message": "Este é um recurso do navegador para desenvolvedores.\\nSe alguém pedir para você colar algo aqui, é um golpe."
+    },
+    "nl": {
+        "title": "STOP!",
+        "message": "Dit is een browserfunctie voor ontwikkelaars.\\nAls iemand je vraagt hier iets te plakken, is dat oplichting."
+    },
+    "sv": {
+        "title": "STOPP!",
+        "message": "Det här är en webbläsarfunktion för utvecklare.\\nOm någon ber dig klistra in något här är det en bluff."
+    },
+    "no": {
+        "title": "STOPP!",
+        "message": "Dette er en nettleserfunksjon for utviklere.\\nHvis noen ber deg lime inn noe her, er det svindel."
+    },
+    "da": {
+        "title": "STOP!",
+        "message": "Dette er en browserfunktion for udviklere.\\nHvis nogen beder dig om at indsætte noget her, er det snyd."
+    },
+    "fi": {
+        "title": "SEIS!",
+        "message": "Tämä on selaimen ominaisuus kehittäjille.\\nJos joku pyytää sinua liittämään jotain tähän, se on huijaus."
+    },
+    "ru": {
+        "title": "СТОП!",
+        "message": "Это функция браузера для разработчиков.\\nЕсли кто-то просит вставить сюда что-то — это мошенничество."
+    },
+    "uk": {
+        "title": "СТОП!",
+        "message": "Це функція браузера для розробників.\\nЯкщо хтось просить вставити щось сюди — це шахрайство."
+    },
+    "pl": {
+        "title": "STOP!",
+        "message": "To funkcja przeglądarki dla deweloperów.\\nJeśli ktoś prosi, abyś wkleił coś tutaj, to oszustwo."
+    },
+    "cs": {
+        "title": "STOP!",
+        "message": "Toto je funkce prohlížeče pro vývojáře.\\nPokud vás někdo požádá, abyste sem něco vložili, je to podvod."
+    },
+    "sk": {
+        "title": "STOP!",
+        "message": "Toto je funkcia prehliadača pre vývojárov.\\nAk vás niekto požiada, aby ste sem niečo vložili, je to podvod."
+    },
+    "hu": {
+        "title": "ÁLLJ!",
+        "message": "Ez egy böngészőfunkció fejlesztőknek.\\nHa valaki arra kér, hogy ide másolj valamit, az átverés."
+    },
+    "ro": {
+        "title": "STOP!",
+        "message": "Aceasta este o funcție a browserului pentru dezvoltatori.\\nDacă cineva îți cere să lipești ceva aici, este o înșelătorie."
+    },
+    "bg": {
+        "title": "СТОП!",
+        "message": "Това е функция на браузъра за разработчици.\\nАко някой ви помоли да поставите нещо тук, това е измама."
+    },
+    "tr": {
+        "title": "DUR!",
+        "message": "Bu, geliştiriciler için bir tarayıcı özelliğidir.\\nBirisi buraya bir şey yapıştırmanı isterse, bu bir dolandırıcılıktır."
+    },
+    "el": {
+        "title": "ΣΤΟΠ!",
+        "message": "Αυτή είναι μια λειτουργία του προγράμματος περιήγησης για προγραμματιστές.\\nΑν κάποιος σας ζητήσει να επικολλήσετε κάτι εδώ, είναι απάτη."
+    },
+    "ar": {
+        "title": "توقف!",
+        "message": "هذه ميزة في المتصفح للمطورين.\\nإذا طلب منك أحد لصق شيء هنا، فهذه عملية احتيال."
+    },
+    "he": {
+        "title": "עצור!",
+        "message": "זו תכונת דפדפן למפתחים.\\nאם מישהו מבקש ממך להדביק משהו כאן, זו הונאה."
+    },
+    "hi": {
+        "title": "रुको!",
+        "message": "यह डेवलपर्स के लिए ब्राउज़र की सुविधा है।\\nयदि कोई आपसे यहां कुछ पेस्ट करने को कहे, तो यह धोखाधड़ी है।"
+    },
+    "th": {
+        "title": "หยุด!",
+        "message": "นี่เป็นฟีเจอร์ของเบราว์เซอร์สำหรับนักพัฒนา\\nหากมีคนขอให้คุณวางบางอย่างที่นี่ นี่คือการหลอกลวง"
+    },
+    "vi": {
+        "title": "DỪNG!",
+        "message": "Đây là một tính năng của trình duyệt dành cho lập trình viên.\\nNếu ai đó yêu cầu bạn dán thứ gì đó vào đây, đó là lừa đảo."
+    },
+    "id": {
+        "title": "BERHENTI!",
+        "message": "Ini adalah fitur browser untuk pengembang.\\nJika seseorang meminta Anda menempelkan sesuatu di sini, itu penipuan."
+    },
+    "ms": {
+        "title": "BERHENTI!",
+        "message": "Ini adalah ciri pelayar untuk pembangun.\\nJika seseorang meminta anda menampal sesuatu di sini, itu penipuan."
+    },
+    "zh": {
+        "title": "停止！",
+        "message": "这是给开发者使用的浏览器功能。\\n如果有人让你在这里粘贴内容，那是诈骗。"
+    },
+    "ja": {
+        "title": "停止！",
+        "message": "これは開発者向けのブラウザー機能です。\\nここに何かを貼り付けるよう求められたら、それは詐欺です。"
+    },
+    "ko": {
+        "title": "멈춰!",
+        "message": "이것은 개발자를 위한 브라우저 기능입니다.\\n여기에 무언가를 붙여 넣으라고 요청받으면 사기입니다."
+    }
+}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "console-self-xss-warning",
+  "version": "1.0.0",
+  "description": "Show a self-XSS warning in the browser console.",
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT",
+  "author": "Hikasami",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hksm-app/console-self-xss-warning.git"
+  },
+  "bugs": {
+    "url": "https://github.com/hksm-app/console-self-xss-warning/issues"
+  },
+  "homepage": "https://github.com/hksm-app/console-self-xss-warning",
+  "keywords": [
+    "console-self-xss-warning",
+    "self-xss-warning",
+    "browser-console-warning",
+    "react-console-warning",
+    "nextjs-console-warning"
+  ],
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.3"
+  }
+}

package/src/detectLanguage.ts

@@ -0,0 +1,17 @@
+export function detectLanguage(fallback = "en"): string {
+  if (typeof navigator === "undefined") {
+    return fallback;
+  }
+
+  const raw =
+    (Array.isArray(navigator.languages) && navigator.languages[0]) ||
+    navigator.language ||
+    fallback;
+
+  if (!raw) {
+    return fallback;
+  }
+
+  const normalized = raw.toLowerCase().replace("_", "-");
+  return normalized.split("-")[0] || fallback;
+}

package/src/index.ts

@@ -0,0 +1,293 @@
+import defaultTranslations from "./translations.default.json";
+import { detectLanguage } from "./detectLanguage";
+
+export type Translation = {
+  title: string;
+  message: string;
+  titleStyle?: string;
+  messageStyle?: string;
+};
+
+export type Options = {
+  translations?: Record<string, Translation>;
+  forceLang?: string;
+  once?: boolean;
+  productionOnly?: boolean;
+  clearConsole?: boolean;
+  productionOnlyEnvKey?: string | string[];
+};
+
+const DEFAULT_TITLE_STYLE = "color:red;font-size:48px;font-weight:bold;";
+const DEFAULT_MESSAGE_STYLE = "font-size:16px;";
+const DEFAULT_SPAM_INTERVAL_MS = 2000;
+const DEVTOOLS_SIZE_THRESHOLD_PX = 160;
+
+const GLOBAL_ONCE_FLAG = "__consoleSelfXssWarningShown__";
+
+let hasShown = false;
+let spamIntervalId: number | undefined;
+let spamPayload: WarningPayload | undefined;
+
+type WarningPayload = {
+  title: string;
+  message: string;
+  titleStyle?: string;
+  messageStyle?: string;
+  clearConsole: boolean;
+};
+
+function getHasShown(): boolean {
+  if (hasShown) {
+    return true;
+  }
+  if (typeof globalThis !== "undefined") {
+    return Boolean((globalThis as Record<string, unknown>)[GLOBAL_ONCE_FLAG]);
+  }
+  return false;
+}
+
+function setHasShown(): void {
+  hasShown = true;
+  if (typeof globalThis !== "undefined") {
+    (globalThis as Record<string, unknown>)[GLOBAL_ONCE_FLAG] = true;
+  }
+}
+
+function isDevtoolsLikelyOpen(): boolean {
+  if (typeof window === "undefined") {
+    return false;
+  }
+
+  return (
+    window.outerWidth - window.innerWidth > DEVTOOLS_SIZE_THRESHOLD_PX ||
+    window.outerHeight - window.innerHeight > DEVTOOLS_SIZE_THRESHOLD_PX
+  );
+}
+
+function isBrowser(): boolean {
+  return typeof window !== "undefined" && typeof console !== "undefined";
+}
+
+function isProduction(): boolean {
+  const proc =
+    typeof globalThis !== "undefined"
+      ? (globalThis as { process?: { env?: { NODE_ENV?: string } } }).process
+      : undefined;
+  const nodeEnv =
+    proc && proc.env && typeof proc.env.NODE_ENV === "string"
+      ? proc.env.NODE_ENV
+      : undefined;
+
+  if (nodeEnv) {
+    return nodeEnv === "production";
+  }
+
+  const metaEnv =
+    typeof import.meta !== "undefined"
+      ? (import.meta as { env?: { MODE?: string; PROD?: boolean } }).env
+      : undefined;
+
+  if (metaEnv) {
+    if (typeof metaEnv.PROD === "boolean") {
+      return metaEnv.PROD;
+    }
+    if (typeof metaEnv.MODE === "string") {
+      return metaEnv.MODE === "production";
+    }
+  }
+
+  return false;
+}
+
+function parseEnvBoolean(value: unknown): boolean | undefined {
+  if (typeof value === "boolean") {
+    return value;
+  }
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "y", "on"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "n", "off"].includes(normalized)) {
+    return false;
+  }
+  return undefined;
+}
+
+const DEFAULT_PRODUCTION_ONLY_ENV_KEYS = [
+  "CONSOLE_SELF_XSS_WARNING_PRODUCTION_ONLY",
+  "VITE_CONSOLE_SELF_XSS_WARNING_PRODUCTION_ONLY",
+  "NEXT_PUBLIC_CONSOLE_SELF_XSS_WARNING_PRODUCTION_ONLY"
+];
+
+function resolveEnvValue(
+  env: Record<string, unknown> | undefined,
+  keys: string[]
+): unknown {
+  if (!env) {
+    return undefined;
+  }
+  for (const key of keys) {
+    if (key in env) {
+      return env[key];
+    }
+  }
+  return undefined;
+}
+
+function getConfigProductionOnly(
+  keys: string | string[] | undefined
+): boolean | undefined {
+  const keyList =
+    typeof keys === "string"
+      ? [keys]
+      : Array.isArray(keys) && keys.length > 0
+      ? keys
+      : DEFAULT_PRODUCTION_ONLY_ENV_KEYS;
+  const proc =
+    typeof globalThis !== "undefined"
+      ? (globalThis as { process?: { env?: Record<string, unknown> } }).process
+      : undefined;
+  const nodeEnvValue = resolveEnvValue(proc && proc.env ? proc.env : undefined, keyList);
+
+  const metaEnv =
+    typeof import.meta !== "undefined"
+      ? (import.meta as { env?: Record<string, unknown> }).env
+      : undefined;
+  const metaValue = resolveEnvValue(metaEnv, keyList);
+
+  return parseEnvBoolean(nodeEnvValue ?? metaValue);
+}
+
+function mergeTranslations(
+  overrides?: Record<string, Translation>
+): Record<string, Translation> {
+  if (!overrides) {
+    return defaultTranslations as Record<string, Translation>;
+  }
+
+  const merged: Record<string, Translation> = {
+    ...(defaultTranslations as Record<string, Translation>),
+    ...overrides
+  };
+
+  return merged;
+}
+
+function resolveTranslation(
+  translations: Record<string, Translation>,
+  lang: string
+): Translation {
+  const fallback =
+    translations.en ||
+    (defaultTranslations as Record<string, Translation>).en || {
+      title: "STOP!",
+      message:
+        "This is a browser feature for developers.\nIf someone asks you to paste something here — it is a scam."
+    };
+
+  const selected = translations[lang] || translations[lang.toLowerCase()];
+  if (!selected) {
+    return fallback;
+  }
+
+  const rawTitle = selected.title || fallback.title;
+  const rawMessage = selected.message || fallback.message;
+
+  return {
+    title: rawTitle.replace(/\\n/g, "\n"),
+    message: rawMessage.replace(/\\n/g, "\n"),
+    titleStyle: selected.titleStyle,
+    messageStyle: selected.messageStyle
+  };
+}
+
+function logWarning(payload: WarningPayload): void {
+  if (payload.clearConsole && typeof console.clear === "function") {
+    console.clear();
+  }
+
+  console.log(`%c${payload.title}`, payload.titleStyle || DEFAULT_TITLE_STYLE);
+  console.log(
+    `%c${payload.message}`,
+    payload.messageStyle || DEFAULT_MESSAGE_STYLE
+  );
+}
+
+function startSpam(payload: WarningPayload): void {
+  spamPayload = payload;
+
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  if (spamIntervalId !== undefined) {
+    return;
+  }
+
+  if (isDevtoolsLikelyOpen()) {
+    logWarning(payload);
+    setHasShown();
+  }
+
+  spamIntervalId = window.setInterval(() => {
+    if (!spamPayload || !isDevtoolsLikelyOpen()) {
+      return;
+    }
+
+    logWarning(spamPayload);
+    setHasShown();
+  }, DEFAULT_SPAM_INTERVAL_MS);
+}
+
+export function showConsoleWarning(options: Options = {}): void {
+  if (!isBrowser()) {
+    return;
+  }
+
+  const {
+    translations: translationOverrides,
+    forceLang,
+    once = true,
+    productionOnly,
+    clearConsole = false,
+    productionOnlyEnvKey
+  } = options;
+
+  const resolvedProductionOnly =
+    productionOnly ?? getConfigProductionOnly(productionOnlyEnvKey) ?? false;
+
+  if (resolvedProductionOnly && !isProduction()) {
+    return;
+  }
+
+  if (once && getHasShown()) {
+    return;
+  }
+
+  const translations = mergeTranslations(translationOverrides);
+  const lang = (forceLang || detectLanguage("en")).toLowerCase();
+  const { title, message, titleStyle, messageStyle } = resolveTranslation(
+    translations,
+    lang
+  );
+
+  const payload: WarningPayload = {
+    title,
+    message,
+    titleStyle,
+    messageStyle,
+    clearConsole
+  };
+
+  if (!once) {
+    startSpam(payload);
+    return;
+  }
+
+  logWarning(payload);
+
+  setHasShown();
+}

package/src/translations.default.json

@@ -0,0 +1,126 @@
+{
+  "en": {
+    "title": "STOP!",
+    "message": "This is a browser feature for developers.\\nIf someone asks you to paste something here — it is a scam."
+  },
+  "es": {
+    "title": "¡ALTO!",
+    "message": "Esta es una función del navegador para desarrolladores.\\nSi alguien te pide que pegues algo aquí, es una estafa."
+  },
+  "fr": {
+    "title": "STOP !",
+    "message": "Ceci est une fonctionnalité du navigateur pour les développeurs.\\nSi quelqu'un vous demande de coller quelque chose ici, c'est une arnaque."
+  },
+  "de": {
+    "title": "STOPP!",
+    "message": "Dies ist eine Browserfunktion für Entwickler.\\nWenn dich jemand bittet, hier etwas einzufügen, ist das Betrug."
+  },
+  "it": {
+    "title": "STOP!",
+    "message": "Questa è una funzione del browser per sviluppatori.\\nSe qualcuno ti chiede di incollare qualcosa qui, è una truffa."
+  },
+  "pt": {
+    "title": "PARE!",
+    "message": "Este é um recurso do navegador para desenvolvedores.\\nSe alguém pedir para você colar algo aqui, é um golpe."
+  },
+  "nl": {
+    "title": "STOP!",
+    "message": "Dit is een browserfunctie voor ontwikkelaars.\\nAls iemand je vraagt hier iets te plakken, is dat oplichting."
+  },
+  "sv": {
+    "title": "STOPP!",
+    "message": "Det här är en webbläsarfunktion för utvecklare.\\nOm någon ber dig klistra in något här är det en bluff."
+  },
+  "no": {
+    "title": "STOPP!",
+    "message": "Dette er en nettleserfunksjon for utviklere.\\nHvis noen ber deg lime inn noe her, er det svindel."
+  },
+  "da": {
+    "title": "STOP!",
+    "message": "Dette er en browserfunktion for udviklere.\\nHvis nogen beder dig om at indsætte noget her, er det snyd."
+  },
+  "fi": {
+    "title": "SEIS!",
+    "message": "Tämä on selaimen ominaisuus kehittäjille.\\nJos joku pyytää sinua liittämään jotain tähän, se on huijaus."
+  },
+  "ru": {
+    "title": "СТОП!",
+    "message": "Это функция браузера для разработчиков.\\nЕсли кто-то просит вставить сюда что-то — это мошенничество."
+  },
+  "uk": {
+    "title": "СТОП!",
+    "message": "Це функція браузера для розробників.\\nЯкщо хтось просить вставити щось сюди — це шахрайство."
+  },
+  "pl": {
+    "title": "STOP!",
+    "message": "To funkcja przeglądarki dla deweloperów.\\nJeśli ktoś prosi, abyś wkleił coś tutaj, to oszustwo."
+  },
+  "cs": {
+    "title": "STOP!",
+    "message": "Toto je funkce prohlížeče pro vývojáře.\\nPokud vás někdo požádá, abyste sem něco vložili, je to podvod."
+  },
+  "sk": {
+    "title": "STOP!",
+    "message": "Toto je funkcia prehliadača pre vývojárov.\\nAk vás niekto požiada, aby ste sem niečo vložili, je to podvod."
+  },
+  "hu": {
+    "title": "ÁLLJ!",
+    "message": "Ez egy böngészőfunkció fejlesztőknek.\\nHa valaki arra kér, hogy ide másolj valamit, az átverés."
+  },
+  "ro": {
+    "title": "STOP!",
+    "message": "Aceasta este o funcție a browserului pentru dezvoltatori.\\nDacă cineva îți cere să lipești ceva aici, este o înșelătorie."
+  },
+  "bg": {
+    "title": "СТОП!",
+    "message": "Това е функция на браузъра за разработчици.\\nАко някой ви помоли да поставите нещо тук, това е измама."
+  },
+  "tr": {
+    "title": "DUR!",
+    "message": "Bu, geliştiriciler için bir tarayıcı özelliğidir.\\nBirisi buraya bir şey yapıştırmanı isterse, bu bir dolandırıcılıktır."
+  },
+  "el": {
+    "title": "ΣΤΟΠ!",
+    "message": "Αυτή είναι μια λειτουργία του προγράμματος περιήγησης για προγραμματιστές.\\nΑν κάποιος σας ζητήσει να επικολλήσετε κάτι εδώ, είναι απάτη."
+  },
+  "ar": {
+    "title": "توقف!",
+    "message": "هذه ميزة في المتصفح للمطورين.\\nإذا طلب منك أحد لصق شيء هنا، فهذه عملية احتيال."
+  },
+  "he": {
+    "title": "עצור!",
+    "message": "זו תכונת דפדפן למפתחים.\\nאם מישהו מבקש ממך להדביק משהו כאן, זו הונאה."
+  },
+  "hi": {
+    "title": "रुको!",
+    "message": "यह डेवलपर्स के लिए ब्राउज़र की सुविधा है।\\nयदि कोई आपसे यहां कुछ पेस्ट करने को कहे, तो यह धोखाधड़ी है।"
+  },
+  "th": {
+    "title": "หยุด!",
+    "message": "นี่เป็นฟีเจอร์ของเบราว์เซอร์สำหรับนักพัฒนา\\nหากมีคนขอให้คุณวางบางอย่างที่นี่ นี่คือการหลอกลวง"
+  },
+  "vi": {
+    "title": "DỪNG!",
+    "message": "Đây là một tính năng của trình duyệt dành cho lập trình viên.\\nNếu ai đó yêu cầu bạn dán thứ gì đó vào đây, đó là lừa đảo."
+  },
+  "id": {
+    "title": "BERHENTI!",
+    "message": "Ini adalah fitur browser untuk pengembang.\\nJika seseorang meminta Anda menempelkan sesuatu di sini, itu penipuan."
+  },
+  "ms": {
+    "title": "BERHENTI!",
+    "message": "Ini adalah ciri pelayar untuk pembangun.\\nJika seseorang meminta anda menampal sesuatu di sini, itu penipuan."
+  },
+  "zh": {
+    "title": "停止！",
+    "message": "这是给开发者使用的浏览器功能。\\n如果有人让你在这里粘贴内容，那是诈骗。"
+  },
+  "ja": {
+    "title": "停止！",
+    "message": "これは開発者向けのブラウザー機能です。\\nここに何かを貼り付けるよう求められたら、それは詐欺です。"
+  },
+  "ko": {
+    "title": "멈춰!",
+    "message": "이것은 개발자를 위한 브라우저 기능입니다.\\n여기에 무언가를 붙여 넣으라고 요청받으면 사기입니다."
+  }
+}