@pluno/product-agent-web@0.1.276: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.276: Clean npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > el ? `${e.slice(0, el - 1)}…` : e; ... L3690: if ("uploadUrl" in p) { L3691: const g = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3692: if (!g.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(g.status) }); ... L4512: createUri(e, n = {}) { L4513: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

21628async function Y_(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }),

Low

Ai Review Evidence

The widget POSTs to the integrator-supplied token endpoint with credentials include so the host app can mint a short-lived Pluno embed token.

dist/product-agent-widget.jsView on unpkg · L21628

10553readAccount: async (u) => { const d = this.clientRuntime.engine.getState().slices.account, p = this.options.accountLoader ? await this.options.accountLoader() : d.refusal ? null : this.options.initialAccount; if (!p) throw new Error("Account information is unavailable.");

Low

Ai Review Evidence

Account reads use accountLoader or initialAccount plus Pluno user id, email, and name, not host-account takeover.

dist/product-agent-widget.jsView on unpkg · L10553

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

33"verify:package": "node scripts/verify-package-contents.mjs && node scripts/verify-declaration-freshness.mjs", "prepack": "npm run verify:package"

Low

Suspicious Lifecycle Evidence

package.json publishes a browser SDK and widget with no npm preinstall, install, or postinstall hooks.

package.jsonView on unpkg · L33

dist/product-agent-runtime.cjsView file

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function ee(s,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade","earn_credits"]}

Low

Ai Review Evidence

dist/product-agent-runtime.cjs is a minified product runtime for credits, queries, and session directory, which is why a bounded scanner stage stopped.

dist/product-agent-runtime.cjsView on unpkg · L1

Source & flagged code

6 flagged

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > el ? `${e.slice(0, el - 1)}…` : e; ... L3690: if ("uploadUrl" in p) { L3691: const g = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3692: if (!g.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(g.status) }); ... L4512: createUri(e, n = {}) { L4513: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

21628async function Y_(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }),

Low

Ai Review Evidence

The widget POSTs to the integrator-supplied token endpoint with credentials include so the host app can mint a short-lived Pluno embed token.

dist/product-agent-widget.jsView on unpkg · L21628

10553readAccount: async (u) => { const d = this.clientRuntime.engine.getState().slices.account, p = this.options.accountLoader ? await this.options.accountLoader() : d.refusal ? null : this.options.initialAccount; if (!p) throw new Error("Account information is unavailable.");

Low

Ai Review Evidence

Account reads use accountLoader or initialAccount plus Pluno user id, email, and name, not host-account takeover.

dist/product-agent-widget.jsView on unpkg · L10553

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 13-53json

13 },

14 "keywords": [

15 "pluno",

16 "product-agent",

17 "widget",

18 "sdk",

19 "ai"

20 ],

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function ee(s,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"