@pluno/product-agent-web@0.1.263: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.263: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > Yc ? `${e.slice(0, Yc - 1)}…` : e; ... L3508: if ("uploadUrl" in h) { L3509: const g = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: u }); L3510: if (!g.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(g.status) }); ... L4321: createUri(e, n = {}) { L4322: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

9268}), n.disableNetworkCapture || s.enableNetworkCapture(), s.startPageLifecycleRecovery(), s.startStarterPromptUrlWatcher(), e.autoConnect !== !1 && await s.connect();

Medium

Ai Review Evidence

The widget enables network capture during initialization unless the caller explicitly disables it.

dist/product-agent-widget.jsView on unpkg · L9268

11251const w = f instanceof Request ? f : null, S = Fy(f, w), x = Au(y?.headers ?? w?.headers); if (!Yn(S, x, y?.body)) { const _ = { requestId: Sr("fetch"), url: Qt(S, br), method: (y?.method ?? w?.method ?? "GET").toUpperCase(), requestHeaders: x, requestBody: Wl(y?.body), resourceType: "fetch", startedAt: new Date(g).toISOString()

Medium

Ai Review Evidence

It wraps browser fetch calls and collects request URLs, methods, headers, and textual request bodies.

dist/product-agent-widget.jsView on unpkg · L11251

11020this.networkCaptureCleanup || (this.networkCaptureCleanup = jm((e) => { Vy(e.url, this.options.backendUrl) || this.enqueueNetworkEvent(e); })); } enqueueNetworkEvent(e) { this.queuedNetworkEvents.length >= qm || (this.queuedNetworkEvents.push(Wy(e)), this.networkBatchTimer === null && (this.networkBatchTimer = window.setTimeout(() => { this.networkBatchTimer = null; const n = this.queuedNetworkEvents.splice(0, this.queuedNetworkEvents.length); n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({ type: "network.batch",

Medium

Ai Review Evidence

Captured events are batched and sent to the backend over the authenticated socket.

dist/product-agent-widget.jsView on unpkg · L11020

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

Source & flagged code

5 flagged

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > Yc ? `${e.slice(0, Yc - 1)}…` : e; ... L3508: if ("uploadUrl" in h) { L3509: const g = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: u }); L3510: if (!g.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(g.status) }); ... L4321: createUri(e, n = {}) { L4322: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

9268}), n.disableNetworkCapture || s.enableNetworkCapture(), s.startPageLifecycleRecovery(), s.startStarterPromptUrlWatcher(), e.autoConnect !== !1 && await s.connect();

Medium

Ai Review Evidence

The widget enables network capture during initialization unless the caller explicitly disables it.

dist/product-agent-widget.jsView on unpkg · L9268

11251const w = f instanceof Request ? f : null, S = Fy(f, w), x = Au(y?.headers ?? w?.headers); if (!Yn(S, x, y?.body)) { const _ = { requestId: Sr("fetch"), url: Qt(S, br), method: (y?.method ?? w?.method ?? "GET").toUpperCase(), requestHeaders: x, requestBody: Wl(y?.body), resourceType: "fetch", startedAt: new Date(g).toISOString()

Medium

Ai Review Evidence

It wraps browser fetch calls and collects request URLs, methods, headers, and textual request bodies.

dist/product-agent-widget.jsView on unpkg · L11251

11020this.networkCaptureCleanup || (this.networkCaptureCleanup = jm((e) => { Vy(e.url, this.options.backendUrl) || this.enqueueNetworkEvent(e); })); } enqueueNetworkEvent(e) { this.queuedNetworkEvents.length >= qm || (this.queuedNetworkEvents.push(Wy(e)), this.networkBatchTimer === null && (this.networkBatchTimer = window.setTimeout(() => { this.networkBatchTimer = null; const n = this.queuedNetworkEvents.splice(0, this.queuedNetworkEvents.length); n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({ type: "network.batch",

Medium

Ai Review Evidence

Captured events are batched and sent to the backend over the authenticated socket.

dist/product-agent-widget.jsView on unpkg · L11020

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg