Loading npm security reports…

@pluno/product-agent-web@0.1.257: Malicious npm security report | LPM Firewall

registry / @pluno/product-agent-web / 0.1.257

@pluno/product-agent-web@0.1.257

Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

At runtime, a Pluno backend can cause arbitrary JavaScript to execute in the embedding page's origin. The widget also observes host-page text and non-excluded HTTP traffic and reports it through its backend connection.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Initializing the SDK or widget connects it; a backend execute_code tool call or host network activity activates the behavior.

Impact

A controlling backend can act with the page's authenticated browser session and receive page or network data.

Mechanism

Server-directed browser code execution and host-page traffic capture.

Attack narrative

After the embedded widget connects, a server tool call named execute_code can supply JavaScript that is compiled with AsyncFunction and executed in the host page. That code has the page's normal browser privileges, including its authenticated session. Independently, the widget instruments fetch and XMLHttpRequest, captures permitted request and response metadata, and sends batches over the existing backend connection. It also reads visible page text. These capabilities form a remotely controlled browser execution and data-collection surface.

AI rationale

The package contains a concrete server-directed arbitrary JavaScript execution path in customer web pages, alongside automatic host traffic and DOM collection. The absence of install hooks does not mitigate this runtime remote-code-execution behavior.

Evidence

dist/product-agent-widget.js

Network endpoints1

app.pluno.ai

Decision evidence

Source & flagged code

8 flagged · loading source

dist/product-agent-widget.jsView file

38for (let i = 0; i < t.length; i++) L39: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L40: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L194: function Nn(t) { L195: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L196: return e.length > Ec ? `${e.slice(0, Ec - 1)}…` : e; ... L1701: if ("uploadUrl" in h) { L1702: const f = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: u }); L1703: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L2616: createUri(e, n = {}) { L2617: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L38

9354const c = s === "execute_code", l = s === "execute_code_in_browser_tab" && a !== null && typeof a == "object" && a.tabId === "local:current";

High

Ai Review Evidence

The widget accepts execute_code tool calls and passes their raw input to its execution helper.

dist/product-agent-widget.jsView on unpkg · L9354

9402u = await this.executeRuntimeHelper(), p = await ll( a, sm(e.runtimeContext, this.options.backendUrl) ).catch((h) => ({

High

Ai Review Evidence

The widget accepts execute_code tool calls and passes their raw input to its execution helper.

dist/product-agent-widget.jsView on unpkg · L9402

9941const l = /* @__PURE__ */ Symbol("execute_code_timeout"), u = await Promise.race([ new n("sandboxFiles", t.javascript)(e?.value), new Promise((p) => { a = window.setTimeout(() => p(l), i);

High

Ai Review Evidence

The execution helper constructs an AsyncFunction from supplied JavaScript and runs it in the host page.

dist/product-agent-widget.jsView on unpkg · L9941

9453n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({ type: "network.batch", sessionId: this.state.sessionId ?? void 0, page: St(), events: n }); }, Mf))); }

High

Ai Review Evidence

The widget replaces fetch and XMLHttpRequest methods, collects request and response metadata, and sends network batches over its connected transport.

dist/product-agent-widget.jsView on unpkg · L9453

10093n("Selected text", window.getSelection()?.toString() ?? ""); const i = "[role='dialog'], [role='alertdialog'], dialog[open], [aria-modal='true']", s = Array.from(document.querySelectorAll(i)).filter( (f) => jd(f) && !f.parentElement?.closest(i) ); for (const f of s.slice(0, 3)) n("Active overlay", or(Mi(f), e)); const o = gm(), a = o ? or(Mi(o), e) : ""; n("Main page content", a), n("Additional visible page text", or(Mi(document.body), e)); const r = t.map(([f, b]) => `${f}: ${b}`).join(`

High

Ai Review Evidence

The same widget collects visible page text, including selected text and active overlays.

dist/product-agent-widget.jsView on unpkg · L10093

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

dist/product-agent-sdk.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pluno/product-agent-web@0.1.255 matchedIdentity = npm:[redacted]:0.1.255 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/product-agent-sdk.jsView on unpkg

Source & flagged code

8 flagged

dist/product-agent-widget.jsView file

38for (let i = 0; i < t.length; i++) L39: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L40: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L194: function Nn(t) { L195: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L196: return e.length > Ec ? `${e.slice(0, Ec - 1)}…` : e; ... L1701: if ("uploadUrl" in h) { L1702: const f = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: u }); L1703: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L2616: createUri(e, n = {}) { L2617: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L38

9354const c = s === "execute_code", l = s === "execute_code_in_browser_tab" && a !== null && typeof a == "object" && a.tabId === "local:current";

High

Ai Review Evidence

The widget accepts execute_code tool calls and passes their raw input to its execution helper.

dist/product-agent-widget.jsView on unpkg · L9354

9402u = await this.executeRuntimeHelper(), p = await ll( a, sm(e.runtimeContext, this.options.backendUrl) ).catch((h) => ({

High

Ai Review Evidence

The widget accepts execute_code tool calls and passes their raw input to its execution helper.

dist/product-agent-widget.jsView on unpkg · L9402

9941const l = /* @__PURE__ */ Symbol("execute_code_timeout"), u = await Promise.race([ new n("sandboxFiles", t.javascript)(e?.value), new Promise((p) => { a = window.setTimeout(() => p(l), i);

High

Ai Review Evidence

The execution helper constructs an AsyncFunction from supplied JavaScript and runs it in the host page.

dist/product-agent-widget.jsView on unpkg · L9941

9453n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({ type: "network.batch", sessionId: this.state.sessionId ?? void 0, page: St(), events: n }); }, Mf))); }

High

Ai Review Evidence

The widget replaces fetch and XMLHttpRequest methods, collects request and response metadata, and sends network batches over its connected transport.

dist/product-agent-widget.jsView on unpkg · L9453

10093n("Selected text", window.getSelection()?.toString() ?? ""); const i = "[role='dialog'], [role='alertdialog'], dialog[open], [aria-modal='true']", s = Array.from(document.querySelectorAll(i)).filter( (f) => jd(f) && !f.parentElement?.closest(i) ); for (const f of s.slice(0, 3)) n("Active overlay", or(Mi(f), e)); const o = gm(), a = o ? or(Mi(o), e) : ""; n("Main page content", a), n("Additional visible page text", or(Mi(document.body), e)); const r = t.map(([f, b]) => `${f}: ${b}`).join(`

High

Ai Review Evidence

The same widget collects visible page text, including selected text and active overlays.

dist/product-agent-widget.jsView on unpkg · L10093

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

dist/product-agent-sdk.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pluno/product-agent-web@0.1.255 matchedIdentity = npm:[redacted]:0.1.255 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/product-agent-sdk.jsView on unpkg