@pluno/product-agent-web@0.1.277: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.277: Clean npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > el ? `${e.slice(0, el - 1)}…` : e; ... L3690: if ("uploadUrl" in p) { L3691: const g = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3692: if (!g.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(g.status) }); ... L4512: createUri(e, n = {}) { L4513: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

21628async function Y_(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }),

Low

Ai Review Evidence

The widget POSTs the host token endpoint with credentials include after a customer embeds it, which is the scanner account-session signal.

dist/product-agent-widget.jsView on unpkg · L21628

11234enableNetworkCapture() { this.networkCaptureCleanup || (this.networkCaptureCleanup = Gm((e) => { eb(e.url, this.options.backendUrl) || this.enqueueNetworkEvent(e); })); } enqueueNetworkEvent(e) { this.queuedNetworkEvents.length >= Um || (this.queuedNetworkEvents.push(Zy(e)), this.networkBatchTimer === null && (this.networkBatchTimer = window.setTimeout(() => { this.networkBatchTimer = null; const n = this.queuedNetworkEvents.splice(0, this.queuedNetworkEvents.length); n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({

Low

Ai Review Evidence

After init the widget patches fetch and XHR and forwards capped host-request metadata as network.batch on the Pluno session socket.

dist/product-agent-widget.jsView on unpkg · L11234

11547try { window.fetch = a; } catch { } try { XMLHttpRequest.prototype.open = r; } catch { } try { XMLHttpRequest.prototype.setRequestHeader = l; } catch { } try { XMLHttpRequest.prototype.send = c;

Low

Ai Review Evidence

After init the widget patches fetch and XHR and forwards capped host-request metadata as network.batch on the Pluno session socket.

dist/product-agent-widget.jsView on unpkg · L11547

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

1{ "name": "@pluno/product-agent-web", "version": "0.1.277", "description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.", "license": "Apache-2.0", "type": "module", "main": "dist/product-agent-sdk.js", "module": "dist/product-agent-sdk.js", "types": "dist/index.d.ts", "homepage": "https://pluno.ai",

Low

Ai Review Evidence

The widget POSTs the host token endpoint with credentials include after a customer embeds it, which is the scanner account-session signal.

package.jsonView on unpkg · L1

26"scripts": { "build": "vite build --mode sdk && vite build --mode widget && vite build --mode runtime && tsc --emitDeclarationOnly", "check": "tsc --noEmit && npm run check:core && npm run check:architecture-reference", "check:core": "tsc -p tsconfig.core.json && node scripts/check-core-boundaries.mjs", "check:architecture-reference": "tsc --noEmit --strict --target ES2020 --module ESNext --moduleResolution Bundler --lib ES2020,DOM ../spec/product-agent/client-core-architecture-reference.d.ts", "check:public-api": "node scripts/check-public-api-compatibility.mjs", "test

Low

Ai Review Evidence

The widget POSTs the host token endpoint with credentials include after a customer embeds it, which is the scanner account-session signal.

package.jsonView on unpkg · L26

dist/product-agent-runtime.cjsView file

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function ee(s,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade","earn_credits"]}:e==="subscription_required"||e==="subscription_inactive"||e==="payment_issue"||e==="subscription_invalid"||e==="payment_required"?{allowed:!1,reason:"payment_issue",actions:["upgrade"]}:s??{allowed:!0,reason:"allowed",actions:[]}}

Low

Ai Review Evidence

The CommonJS runtime is a two-line minified bundle, which tripped a scanner analysis limit rather than hiding a second payload.

dist/product-agent-runtime.cjsView on unpkg · L1

Source & flagged code

8 flagged

dist/product-agent-widget.jsView file

83for (let i = 0; i < t.length; i++) L84: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L85: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L251: function Fn(t) { L252: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L253: return e.length > el ? `${e.slice(0, el - 1)}…` : e; ... L3690: if ("uploadUrl" in p) { L3691: const g = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3692: if (!g.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(g.status) }); ... L4512: createUri(e, n = {}) { L4513: return e +

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L83

21628async function Y_(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }),

Low

Ai Review Evidence

The widget POSTs the host token endpoint with credentials include after a customer embeds it, which is the scanner account-session signal.

dist/product-agent-widget.jsView on unpkg · L21628

11234enableNetworkCapture() { this.networkCaptureCleanup || (this.networkCaptureCleanup = Gm((e) => { eb(e.url, this.options.backendUrl) || this.enqueueNetworkEvent(e); })); } enqueueNetworkEvent(e) { this.queuedNetworkEvents.length >= Um || (this.queuedNetworkEvents.push(Zy(e)), this.networkBatchTimer === null && (this.networkBatchTimer = window.setTimeout(() => { this.networkBatchTimer = null; const n = this.queuedNetworkEvents.splice(0, this.queuedNetworkEvents.length); n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({

Low

Ai Review Evidence

After init the widget patches fetch and XHR and forwards capped host-request metadata as network.batch on the Pluno session socket.

dist/product-agent-widget.jsView on unpkg · L11234

11547try { window.fetch = a; } catch { } try { XMLHttpRequest.prototype.open = r; } catch { } try { XMLHttpRequest.prototype.setRequestHeader = l; } catch { } try { XMLHttpRequest.prototype.send = c;

Low

Ai Review Evidence

After init the widget patches fetch and XHR and forwards capped host-request metadata as network.batch on the Pluno session socket.

dist/product-agent-widget.jsView on unpkg · L11547

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 1-46json

1{

2 "name": "@pluno/product-agent-web",

3 "version": "0.1.277",

4 "description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.",

5 "license": "Apache-2.0",

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function ee(s,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"