@pluno/product-agent-web@0.1.265: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.265: Clean npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > Yc ? `${e.slice(0, Yc - 1)}…` : e; ... L3508: if ("uploadUrl" in h) { L3509: const f = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: u }); L3510: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4326: createUri(e, n = {}) { L4327: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

21385const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }),

Low

Ai Review Evidence

The widget posts the current page origin and URL to a token endpoint with credentials include.

dist/product-agent-widget.jsView on unpkg · L21385

10347readAccount: async (u) => { const l = this.clientRuntime.engine.getState().slices.account, h = this.options.accountLoader ? await this.options.accountLoader() : l.refusal ? null : this.options.initialAccount; if (!h) throw new Error("Account information is unavailable."); return s(), xh(h, { id: u.userId, email: this.state.user?.email ?? null, name: this.state.user?.name ?? null, isSuperuser: !1

Low

Ai Review Evidence

The widget posts the current page origin and URL to a token endpoint with credentials include.

dist/product-agent-widget.jsView on unpkg · L10347

11337try { window.fetch = a; } catch { } try { XMLHttpRequest.prototype.open = r; } catch { } try { XMLHttpRequest.prototype.setRequestHeader = c; } catch { } try { XMLHttpRequest.prototype.send = d;

Low

Ai Review Evidence

The widget patches window.fetch and XMLHttpRequest and later sends captured events over the Pluno socket.

dist/product-agent-widget.jsView on unpkg · L11337

12650const o = s.hostname.toLowerCase(), a = s.pathname.toLowerCase(); return o === "pluno.ai" || o.endsWith(".pluno.ai") || a === "/api/product-agent" || a.startsWith("/api/product-agent/") || /(^|\/)(auth|oauth|login|logout)(\/|$)/.test(a) || /(^|\/)[^/]*token[^/]*(\/|$)/.test(a) || /(^|\/)(upload|uploads|attachments)(\/|$)/.test(a) || [...s.searchParams.keys()].some((r) => /^(x-amz-signature|x-goog-signature|signature|sig)$/i.test(r));

Low

Ai Review Evidence

The widget patches window.fetch and XMLHttpRequest and later sends captured events over the Pluno socket.

dist/product-agent-widget.jsView on unpkg · L12650

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

1{ "name": "@pluno/product-agent-web", "version": "0.1.265", "description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.",

Low

Ai Review Evidence

The widget posts the current page origin and URL to a token endpoint with credentials include.

package.jsonView on unpkg · L1

33"verify:package": "node scripts/verify-package-contents.mjs && node scripts/verify-declaration-freshness.mjs", "prepack": "npm run verify:package"

Low

Ai Review Evidence

The widget posts the current page origin and URL to a token endpoint with credentials include.

package.jsonView on unpkg · L33

Source & flagged code

8 flagged

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > Yc ? `${e.slice(0, Yc - 1)}…` : e; ... L3508: if ("uploadUrl" in h) { L3509: const f = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: u }); L3510: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4326: createUri(e, n = {}) { L4327: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

21385const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }),

Low

Ai Review Evidence

The widget posts the current page origin and URL to a token endpoint with credentials include.

dist/product-agent-widget.jsView on unpkg · L21385

10347readAccount: async (u) => { const l = this.clientRuntime.engine.getState().slices.account, h = this.options.accountLoader ? await this.options.accountLoader() : l.refusal ? null : this.options.initialAccount; if (!h) throw new Error("Account information is unavailable."); return s(), xh(h, { id: u.userId, email: this.state.user?.email ?? null, name: this.state.user?.name ?? null, isSuperuser: !1

Low

Ai Review Evidence

The widget posts the current page origin and URL to a token endpoint with credentials include.

dist/product-agent-widget.jsView on unpkg · L10347

11337try { window.fetch = a; } catch { } try { XMLHttpRequest.prototype.open = r; } catch { } try { XMLHttpRequest.prototype.setRequestHeader = c; } catch { } try { XMLHttpRequest.prototype.send = d;

Low

Ai Review Evidence

The widget patches window.fetch and XMLHttpRequest and later sends captured events over the Pluno socket.

dist/product-agent-widget.jsView on unpkg · L11337

12650const o = s.hostname.toLowerCase(), a = s.pathname.toLowerCase(); return o === "pluno.ai" || o.endsWith(".pluno.ai") || a === "/api/product-agent" || a.startsWith("/api/product-agent/") || /(^|\/)(auth|oauth|login|logout)(\/|$)/.test(a) || /(^|\/)[^/]*token[^/]*(\/|$)/.test(a) || /(^|\/)(upload|uploads|attachments)(\/|$)/.test(a) || [...s.searchParams.keys()].some((r) => /^(x-amz-signature|x-goog-signature|signature|sig)$/i.test(r));

Low

Ai Review Evidence

The widget patches window.fetch and XMLHttpRequest and later sends captured events over the Pluno socket.

dist/product-agent-widget.jsView on unpkg · L12650

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 1-53json

1{

2 "name": "@pluno/product-agent-web",

3 "version": "0.1.265",

4 "description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.",

Low

Ai Review Evidence

The widget posts the current page origin and URL to a token endpoint with credentials include.

package.jsonView on unpkg · L1

5