@pluno/product-agent-web@0.1.286: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.286: Suspicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function $n(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > nl ? `${e.slice(0, nl - 1)}…` : e; ... L3765: if ("uploadUrl" in p) { L3766: const f = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3767: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4591: createUri(e, n = {}) { L4592: return

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

9546await s.initializeDirectory(), await s.initializeConversation(), Vf().catch((o) => { Be("web-sdk.attachments", "Failed to delete stale Product Agent attachments", { message: o instanceof Error ? o.message : String(o) }); }), n.disableNetworkCapture || s.enableNetworkCapture(), s.startPageLifecycleRecovery(), s.startStarterPromptUrlWatcher(), e.autoConnect !== !1 && await s.connect();

Medium

Ai Review Evidence

The widget enables network capture automatically unless the caller sets disableNetworkCapture.

dist/product-agent-widget.jsView on unpkg · L9546

11529}, n = window.fetch, i = XMLHttpRequest.prototype.open, s = XMLHttpRequest.prototype.setRequestHeader, o = XMLHttpRequest.prototype.send, a = function(g, y) { const f = Date.now(); let b; try { b = n.call(this, g, y); } catch (_) { throw _; } try { const _ = g instanceof Request ? g : null, S = Zy(g, _), k = Ou(y?.headers ?? _?.headers); if (!Zn(S, k, y?.body)) { const w = { requestId: Tr("fetch"), url: Qt(S, xr), method: (y?.method ?? _?.method ?? "GET").toUpperCase(), requestHeaders: k,

Medium

Ai Review Evidence

Network capture replaces browser fetch and XMLHttpRequest methods and records request metadata and bodies.

dist/product-agent-widget.jsView on unpkg · L11529

11306enableNetworkCapture() { this.networkCaptureCleanup || (this.networkCaptureCleanup = Xm((e) => { sb(e.url, this.options.backendUrl) || this.enqueueNetworkEvent(e); })); } enqueueNetworkEvent(e) { this.queuedNetworkEvents.length >= Fm || (this.queuedNetworkEvents.push(ib(e)), this.networkBatchTimer === null && (this.networkBatchTimer = window.setTimeout(() => { this.networkBatchTimer = null; const n = this.queuedNetworkEvents.splice(0, this.queuedNetworkEvents.length); n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({

Medium

Ai Review Evidence

Captured events are sent as network.batch over the connected socket.

dist/product-agent-widget.jsView on unpkg · L11306

12922function Zn(t, e = {}, n) { if (ob(n)) return !0; const i = Object.entries(e).find(([s]) => s.toLowerCase() === "content-type")?.[1]?.toLowerCase(); if (i?.includes("multipart/form-data") || i?.includes("application/octet-stream")) return !0; try { const s = new URL(t, location.href); if (s.protocol !== "http:" && s.protocol !== "https:") return !0; const o = s.hostname.toLowerCase(), a = s.pathname.toLowerCase(); return o === "pluno.ai" || o.endsWith(".pluno.ai") || a === "/api/product-agent" || a.startsWith("/api/product-agent/") || /(^|\/)(auth|oauth|

Medium

Ai Review Evidence

The capture filter excludes several authentication, token, upload, and Pluno URLs, and redacts sensitive header values.

dist/product-agent-widget.jsView on unpkg · L12922

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

26"scripts": { "build": "vite build --mode sdk && vite build --mode widget && vite build --mode runtime && tsc --emitDeclarationOnly", "check": "tsc --noEmit && npm run check:core && npm run check:architecture-reference",

Medium

Suspicious Lifecycle Evidence

The package has no npm install lifecycle hook; its only lifecycle-like script is prepack.

package.jsonView on unpkg · L26

Source & flagged code

7 flagged

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function $n(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > nl ? `${e.slice(0, nl - 1)}…` : e; ... L3765: if ("uploadUrl" in p) { L3766: const f = await fetch(t.http.resolveUrl(p.uploadUrl), { method: p.uploadMethod, headers: p.uploadHeaders, body: u }); L3767: if (!f.ok) throw Object.assign(new Error("Attachment transfer failed."), { code: String(f.status) }); ... L4591: createUri(e, n = {}) { L4592: return

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

9546await s.initializeDirectory(), await s.initializeConversation(), Vf().catch((o) => { Be("web-sdk.attachments", "Failed to delete stale Product Agent attachments", { message: o instanceof Error ? o.message : String(o) }); }), n.disableNetworkCapture || s.enableNetworkCapture(), s.startPageLifecycleRecovery(), s.startStarterPromptUrlWatcher(), e.autoConnect !== !1 && await s.connect();

Medium

Ai Review Evidence

The widget enables network capture automatically unless the caller sets disableNetworkCapture.

dist/product-agent-widget.jsView on unpkg · L9546

11529}, n = window.fetch, i = XMLHttpRequest.prototype.open, s = XMLHttpRequest.prototype.setRequestHeader, o = XMLHttpRequest.prototype.send, a = function(g, y) { const f = Date.now(); let b; try { b = n.call(this, g, y); } catch (_) { throw _; } try { const _ = g instanceof Request ? g : null, S = Zy(g, _), k = Ou(y?.headers ?? _?.headers); if (!Zn(S, k, y?.body)) { const w = { requestId: Tr("fetch"), url: Qt(S, xr), method: (y?.method ?? _?.method ?? "GET").toUpperCase(), requestHeaders: k,

Medium

Ai Review Evidence

Network capture replaces browser fetch and XMLHttpRequest methods and records request metadata and bodies.

dist/product-agent-widget.jsView on unpkg · L11529

11306enableNetworkCapture() { this.networkCaptureCleanup || (this.networkCaptureCleanup = Xm((e) => { sb(e.url, this.options.backendUrl) || this.enqueueNetworkEvent(e); })); } enqueueNetworkEvent(e) { this.queuedNetworkEvents.length >= Fm || (this.queuedNetworkEvents.push(ib(e)), this.networkBatchTimer === null && (this.networkBatchTimer = window.setTimeout(() => { this.networkBatchTimer = null; const n = this.queuedNetworkEvents.splice(0, this.queuedNetworkEvents.length); n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({

Medium

Ai Review Evidence

Captured events are sent as network.batch over the connected socket.

dist/product-agent-widget.jsView on unpkg · L11306

12922function Zn(t, e = {}, n) { if (ob(n)) return !0; const i = Object.entries(e).find(([s]) => s.toLowerCase() === "content-type")?.[1]?.toLowerCase(); if (i?.includes("multipart/form-data") || i?.includes("application/octet-stream")) return !0; try { const s = new URL(t, location.href); if (s.protocol !== "http:" && s.protocol !== "https:") return !0; const o = s.hostname.toLowerCase(), a = s.pathname.toLowerCase(); return o === "pluno.ai" || o.endsWith(".pluno.ai") || a === "/api/product-agent" || a.startsWith("/api/product-agent/") || /(^|\/)(auth|oauth|

Medium

Ai Review Evidence

The capture filter excludes several authentication, token, upload, and Pluno URLs, and redacts sensitive header values.

dist/product-agent-widget.jsView on unpkg · L12922

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 6-46json

6 "type": "module",

7 "main": "dist/product-agent-sdk.js",

8 "module": "dist/product-agent-sdk.js",

9 "types": "dist/index.d.ts",

10 "homepage":