@pluno/product-agent-web@0.1.275: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.275: Clean npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > el ? `${e.slice(0, el - 1)}…` : e; ... L3663: if ("uploadUrl" in h) { L3664: const g = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: d }); L3665: if (!g.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(g.status) }); ... L4481: createUri(e, n = {}) { L4482: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

11516try { window.fetch = a; } catch { } try { XMLHttpRequest.prototype.open = r; } catch { } try { XMLHttpRequest.prototype.setRequestHeader = l; } catch { } try { XMLHttpRequest.prototype.send = c;

Low

Ai Review Evidence

After SDK init the widget patches window.fetch and XMLHttpRequest and can send network.batch events on the Pluno session socket.

dist/product-agent-widget.jsView on unpkg · L11516

11212n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({ type: "network.batch", sessionId: this.state.sessionId ?? void 0, page: Ct(), events: n

Low

Ai Review Evidence

After SDK init the widget patches window.fetch and XMLHttpRequest and can send network.batch events on the Pluno session socket.

dist/product-agent-widget.jsView on unpkg · L11212

11701try { const c = /* @__PURE__ */ Symbol("execute_code_timeout"), d = await Promise.race([ new n("sandboxFiles", t.javascript)(e?.value),

Low

Ai Review Evidence

Browser tool calls compile session javascript with an async Function constructor used as execute_code.

dist/product-agent-widget.jsView on unpkg · L11701

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

1{ "name": "@pluno/product-agent-web", "version": "0.1.275", "description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.", "license": "Apache-2.0", "type": "module", "main": "dist/product-agent-sdk.js", "module": "dist/product-agent-sdk.js",

Low

Suspicious Lifecycle Evidence

The published manifest has no preinstall, install, or postinstall scripts; remaining scripts are build, check, test, and prepack verify.

package.jsonView on unpkg · L1

32"test": "vitest run", "verify:package": "node scripts/verify-package-contents.mjs && node scripts/verify-declaration-freshness.mjs", "prepack": "npm run verify:package" },

Low

Suspicious Lifecycle Evidence

The published manifest has no preinstall, install, or postinstall scripts; remaining scripts are build, check, test, and prepack verify.

package.jsonView on unpkg · L32

dist/product-agent-runtime.cjsView file

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function Y(s,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade","earn_credits"]}

Low

Ai Review Evidence

dist/product-agent-runtime.cjs is a one-line minified CommonJS runtime, which is why automated semantic analysis stopped early.

dist/product-agent-runtime.cjsView on unpkg · L1

Source & flagged code

8 flagged

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > el ? `${e.slice(0, el - 1)}…` : e; ... L3663: if ("uploadUrl" in h) { L3664: const g = await fetch(t.http.resolveUrl(h.uploadUrl), { method: h.uploadMethod, headers: h.uploadHeaders, body: d }); L3665: if (!g.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(g.status) }); ... L4481: createUri(e, n = {}) { L4482: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

11516try { window.fetch = a; } catch { } try { XMLHttpRequest.prototype.open = r; } catch { } try { XMLHttpRequest.prototype.setRequestHeader = l; } catch { } try { XMLHttpRequest.prototype.send = c;

Low

Ai Review Evidence

After SDK init the widget patches window.fetch and XMLHttpRequest and can send network.batch events on the Pluno session socket.

dist/product-agent-widget.jsView on unpkg · L11516

11212n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({ type: "network.batch", sessionId: this.state.sessionId ?? void 0, page: Ct(), events: n

Low

Ai Review Evidence

After SDK init the widget patches window.fetch and XMLHttpRequest and can send network.batch events on the Pluno session socket.

dist/product-agent-widget.jsView on unpkg · L11212

11701try { const c = /* @__PURE__ */ Symbol("execute_code_timeout"), d = await Promise.race([ new n("sandboxFiles", t.javascript)(e?.value),

Low

Ai Review Evidence

Browser tool calls compile session javascript with an async Function constructor used as execute_code.

dist/product-agent-widget.jsView on unpkg · L11701

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 1-52json

1{

2 "name": "@pluno/product-agent-web",

3 "version": "0.1.275",

4 "description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.",

5 "license": "Apache-2.0",

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function Y(s,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"