@pluno/product-agent-web: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > ol ? `${e.slice(0, ol - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: gu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

11851ync function Gl(t, e) { const n = Object.getPrototypeOf(async function() { }).constructor, i = t.timeoutMs ?? dy, s = Date.now(), o = []; let a; const r = { log: console.log, info: console.info, warn: console.warn, error: console.error }, c = (l) => (...u) => { o.push({

Low

Ai Review Evidence

The widget includes a JavaScript execution helper and sends the result through its tool-result flow.

dist/product-agent-widget.jsView on unpkg · L11851

6977turn new URL(e, this.options.backendUrl); } async request(e, n = {}, i, s, o, a = {}) { if (a.sk[redacted]) return this.requestOnce(e, n, i, s, o, a.signal, a.diagnostic); const r = this.options.authority?.(), c = (d = !0) => { if (r !=

Low

Ai Review Evidence

Authenticated requests are built relative to the configured backend URL; the inspected code shows no unrelated credential recipient.

dist/product-agent-widget.jsView on unpkg · L6977

21962} const i = t.dataset.plunoPreviewChannel, s = t.dataset.plunoTokenEndpoint; let o; const a = Aw({ token: t.dataset.plunoToken, tokenEndpoint: s, backendUrl: t.dataset.plunoBackend

Low

Ai Review Evidence

Authenticated requests are built relative to the configured backend URL; the inspected code shows no unrelated credential recipient.

dist/product-agent-widget.jsView on unpkg · L21962

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

4"description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.", "license": "Apache-2.0", "type": "module", "main": "dis

Low

Ai Review Evidence

The package identifies itself as a browser SDK and widget for embedding Pluno Product Agent in customer web apps.

package.jsonView on unpkg · L4

dist/product-agent-runtime.cjsView file

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function te(i,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade","earn_credits"]}:e==="subscription_re

Low

Ai Review Evidence

The runtime bundle begins with ordinary module definitions and showed no separate network or environment access in the inspected excerpt.

dist/product-agent-runtime.cjsView on unpkg · L1

Source & flagged code

7 flagged

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > ol ? `${e.slice(0, ol - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: gu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

11851ync function Gl(t, e) { const n = Object.getPrototypeOf(async function() { }).constructor, i = t.timeoutMs ?? dy, s = Date.now(), o = []; let a; const r = { log: console.log, info: console.info, warn: console.warn, error: console.error }, c = (l) => (...u) => { o.push({

Low

Ai Review Evidence

The widget includes a JavaScript execution helper and sends the result through its tool-result flow.

dist/product-agent-widget.jsView on unpkg · L11851

6977turn new URL(e, this.options.backendUrl); } async request(e, n = {}, i, s, o, a = {}) { if (a.sk[redacted]) return this.requestOnce(e, n, i, s, o, a.signal, a.diagnostic); const r = this.options.authority?.(), c = (d = !0) => { if (r !=

Low

Ai Review Evidence

Authenticated requests are built relative to the configured backend URL; the inspected code shows no unrelated credential recipient.

dist/product-agent-widget.jsView on unpkg · L6977

21962} const i = t.dataset.plunoPreviewChannel, s = t.dataset.plunoTokenEndpoint; let o; const a = Aw({ token: t.dataset.plunoToken, tokenEndpoint: s, backendUrl: t.dataset.plunoBackend

Low

Ai Review Evidence

Authenticated requests are built relative to the configured backend URL; the inspected code shows no unrelated credential recipient.

dist/product-agent-widget.jsView on unpkg · L21962

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 1-24json

1{

2 "name": "@pluno/product-agent-web",

3 "version": "0.1.313",

4 "description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.",

5 "license": "Apache-2.0",

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function te(i,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"