@pluno/product-agent-web@0.1.269: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.269: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function $n(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > Xc ? `${e.slice(0, Xc - 1)}…` : e; ... L3564: if ("uploadUrl" in h) { L3565: const f = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: u }); L3566: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4382: createUri(e, n = {}) { L4383: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

dist/product-agent-sdk.jsView file

11514const c = i === "execute_code", d = i === "execute_code_in_browser_tab" && a !== null && typeof a == "object" && a.tabId === "local:current"; if (!c && !d || !El(a)) { this.send({ type: "tool.result",

Medium

Ai Review Evidence

The SDK accepts execute_code tool calls and runs supplied JavaScript with AsyncFunction in the host page.

dist/product-agent-sdk.jsView on unpkg · L11514

12089async function _i(t, e) { const s = Object.getPrototypeOf(async function() { }).constructor, n = t.timeoutMs ?? wd, i = Date.now(), r = []; let a; const o = { log: console.log, info: console.info, warn: console.warn, error: console.error }, c = (d) => (...l) => { r.push({ level: d, args: l }), o[d](...l); }; console.log = c("log"), console.info = c("info"), console.warn = c("warn"), console.error = c("error"); try { const d = /* @__PURE__ */ Symbol("execute_code_timeout"), l = await Promise.race([ new s("sandboxFiles", t.javascript)(e?.value),

Medium

Ai Review Evidence

The SDK accepts execute_code tool calls and runs supplied JavaScript with AsyncFunction in the host page.

dist/product-agent-sdk.jsView on unpkg · L12089

9849}), s.disableNetworkCapture || i.enableNetworkCapture(), i.startPageLifecycleRecovery(), i.startStarterPromptUrlWatcher(), e.autoConnect !== !1 && await i.connect(); } catch (r) {

Medium

Ai Review Evidence

Initialization enables fetch/XHR traffic capture by default and sends captured batches over its connected transport.

Source & flagged code

6 flagged

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function $n(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > Xc ? `${e.slice(0, Xc - 1)}…` : e; ... L3564: if ("uploadUrl" in h) { L3565: const f = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: u }); L3566: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4382: createUri(e, n = {}) { L4383: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

dist/product-agent-sdk.jsView file

11514const c = i === "execute_code", d = i === "execute_code_in_browser_tab" && a !== null && typeof a == "object" && a.tabId === "local:current"; if (!c && !d || !El(a)) { this.send({ type: "tool.result",

Medium

Ai Review Evidence

The SDK accepts execute_code tool calls and runs supplied JavaScript with AsyncFunction in the host page.

dist/product-agent-sdk.jsView on unpkg · L11514

12089async function _i(t, e) { const s = Object.getPrototypeOf(async function() { }).constructor, n = t.timeoutMs ?? wd, i = Date.now(), r = []; let a; const o = { log: console.log, info: console.info, warn: console.warn, error: console.error }, c = (d) => (...l) => { r.push({ level: d, args: l }), o[d](...l); }; console.log = c("log"), console.info = c("info"), console.warn = c("warn"), console.error = c("error"); try { const d = /* @__PURE__ */ Symbol("execute_code_timeout"), l = await Promise.race([ new s("sandboxFiles", t.javascript)(e?.value),

Medium

Ai Review Evidence

The SDK accepts execute_code tool calls and runs supplied JavaScript with AsyncFunction in the host page.

dist/product-agent-sdk.jsView on unpkg · L12089

9849}), s.disableNetworkCapture || i.enableNetworkCapture(), i.startPageLifecycleRecovery(), i.startStarterPromptUrlWatcher(), e.autoConnect !== !1 && await i.connect(); } catch (r) {

Medium

Ai Review Evidence

Initialization enables fetch/XHR traffic capture by default and sends captured batches over its connected transport.