@pluno/product-agent-web@0.1.285: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.285: Clean npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function $n(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > nl ? `${e.slice(0, nl - 1)}…` : e; ... L3765: if ("uploadUrl" in p) { L3766: const f = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3767: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4591: createUri(e, n = {}) { L4592: return

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

21891const i = t.dataset.plunoPreviewChannel, s = t.dataset.plunoTokenEndpoint; let o; const a = _w({ token: t.dataset.plunoToken, tokenEndpoint: s, backendUrl: t.dataset.plunoBackendUrl, webSocketFactory: i ? ww(i) : void 0, launcherLabel: t.dataset.plunoLauncherLabel,

Low

Ai Review Evidence

The widget obtains its token, token endpoint and backend from embedding-page configuration.

dist/product-agent-widget.jsView on unpkg · L21891

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

dist/product-agent-sdk.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pluno/product-agent-web@0.1.305 matchedIdentity = npm:[redacted]:0.1.305 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/product-agent-sdk.jsView on unpkg

13713const pu = Object.freeze({ init: (t) => Kt.init(t) }); function fu(t) { return Kt.init(t); } export { vi as PLUNO

Low

Ai Review Evidence

The SDK exposes explicit initialization functions.

dist/product-agent-sdk.jsView on unpkg · L13713

package.jsonView file

60"dependencies": { "socket.io-client": "4.8.3" }, "overrides

Low

Suspicious Lifecycle Evidence

package.json has no registry install hooks or runtime self-dependency; its dependency is socket.io-client.

package.jsonView on unpkg · L60

dist/product-agent-runtime.cjsView file

1class Ce{constructor(e,t,s){this.adapter=t,this.state=E(e),this.hasBeenReady=e.status==="connected"&&e.submissionReady!==!1,this.model=s}adapte

Low

Ai Review Evidence

The CommonJS runtime implements an adapter-backed session client.

dist/product-agent-runtime.cjsView on unpkg · L1

Source & flagged code

7 flagged

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function $n(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > nl ? `${e.slice(0, nl - 1)}…` : e; ... L3765: if ("uploadUrl" in p) { L3766: const f = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3767: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4591: createUri(e, n = {}) { L4592: return

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

21891const i = t.dataset.plunoPreviewChannel, s = t.dataset.plunoTokenEndpoint; let o; const a = _w({ token: t.dataset.plunoToken, tokenEndpoint: s, backendUrl: t.dataset.plunoBackendUrl, webSocketFactory: i ? ww(i) : void 0, launcherLabel: t.dataset.plunoLauncherLabel,

Low

Ai Review Evidence

The widget obtains its token, token endpoint and backend from embedding-page configuration.

dist/product-agent-widget.jsView on unpkg · L21891

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

dist/product-agent-sdk.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pluno/product-agent-web@0.1.305 matchedIdentity = npm:[redacted]:0.1.305 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/product-agent-sdk.jsView on unpkg

13713const pu = Object.freeze({ init: (t) => Kt.init(t) }); function fu(t) { return Kt.init(t); } export { vi as PLUNO

Low

Ai Review Evidence

The SDK exposes explicit initialization functions.

dist/product-agent-sdk.jsView on unpkg · L13713

package.jsonView file

Lines 40-67json

40 ".": {

41 "types": "./dist/index.d.ts",

42 "import": "./dist/product-agent-sdk.js"

43 },

44 "./widget": {

45 "types": "./dist/widget.d.ts",

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function ee(i,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"