@pluno/product-agent-web@0.1.283: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.283: Clean npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function $n(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > nl ? `${e.slice(0, nl - 1)}…` : e; ... L3764: if ("uploadUrl" in p) { L3765: const f = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3766: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4589: createUri(e, n = {}) { L4590: return

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

11536const _ = g instanceof Request ? g : null, S = Zy(g, _), k = Ou(y?.headers ?? _?.headers); if (!Zn(S, k, y?.body)) { const w = { requestId: Tr("fetch"), url: Qt(S, xr), method: (y?.method ?? _?.method ?? "GET").toUpperCase(), requestHeaders: k, requestBody: Yl(y?.body), resourceType: "fetch", startedAt: new Date(f).toISOString() };

Low

Ai Review Evidence

The widget wraps host fetch and XMLHttpRequest after mount and POSTs to a host-configured token endpoint with credentials include.

dist/product-agent-widget.jsView on unpkg · L11536

21703async function tv(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }),

Low

Ai Review Evidence

The widget wraps host fetch and XMLHttpRequest after mount and POSTs to a host-configured token endpoint with credentials include.

dist/product-agent-widget.jsView on unpkg · L21703

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

2"name": "@pluno/product-agent-web", "version": "0.1.283", "description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.", "license": "Apache-2.0", "type": "module", "main": "dist/product-agent-sdk.js", "module": "dist/product-agent-sdk.js",

Low

Ai Review Evidence

The widget wraps host fetch and XMLHttpRequest after mount and POSTs to a host-configured token endpoint with credentials include.

package.jsonView on unpkg · L2

32"test": "vitest run", "verify:package": "node scripts/verify-package-contents.mjs && node scripts/verify-declaration-freshness.mjs", "prepack": "npm run verify:package"

Low

Ai Review Evidence

The widget wraps host fetch and XMLHttpRequest after mount and POSTs to a host-configured token endpoint with credentials include.

package.jsonView on unpkg · L32

dist/product-agent-runtime.cjsView file

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function X(s,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade","earn_credits"]}:e==="subscription_required"||e==="subscription_inactive"||e==="payment_issue"||e==="subscription_invalid"||e==="payment_required"?{allowed:!1,reason:"payment_issue",actions:["upgrade"]}:s??{allowed:!0,reason:"allowed",actions:[]}}

Low

Ai Review Evidence

dist/product-agent-runtime.cjs is a two-line minified CommonJS bundle, which is why a scanner stage stopped early.

dist/product-agent-runtime.cjsView on unpkg · L1

Source & flagged code

7 flagged

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function $n(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > nl ? `${e.slice(0, nl - 1)}…` : e; ... L3764: if ("uploadUrl" in p) { L3765: const f = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3766: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4589: createUri(e, n = {}) { L4590: return

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

11536const _ = g instanceof Request ? g : null, S = Zy(g, _), k = Ou(y?.headers ?? _?.headers); if (!Zn(S, k, y?.body)) { const w = { requestId: Tr("fetch"), url: Qt(S, xr), method: (y?.method ?? _?.method ?? "GET").toUpperCase(), requestHeaders: k, requestBody: Yl(y?.body), resourceType: "fetch", startedAt: new Date(f).toISOString() };

Low

Ai Review Evidence

The widget wraps host fetch and XMLHttpRequest after mount and POSTs to a host-configured token endpoint with credentials include.

dist/product-agent-widget.jsView on unpkg · L11536

21703async function tv(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }),

Low

Ai Review Evidence

The widget wraps host fetch and XMLHttpRequest after mount and POSTs to a host-configured token endpoint with credentials include.

dist/product-agent-widget.jsView on unpkg · L21703

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 1-52json

1{

2 "name": "@pluno/product-agent-web",

3 "version": "0.1.283",

4 "description": "Browser SDK and default widget for embedding Pluno Product Agent into customer web apps.",

5 "license": "Apache-2.0",

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function X(s,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"