@pluno/product-agent-web@0.1.288: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.288: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function $n(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > nl ? `${e.slice(0, nl - 1)}…` : e; ... L3878: createUri(e, n = {}) { L3879: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3880: } ... L3986: try { L3987: cu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L3988: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

9561}), n.disableNetworkCapture || s.enableNetworkCapture(), s.startPageLifecycleRecovery(), s.startStarterPromptUrlWatcher(), e.autoConnect !== !1 && await s.connect();

Medium

Ai Review Evidence

Widget initialization enables network capture by default unless the caller disables it.

dist/product-agent-widget.jsView on unpkg · L9561

11317enableNetworkCapture() { this.networkCaptureCleanup || (this.networkCaptureCleanup = Xm((e) => { sb(e.url, this.options.backendUrl) || this.enqueueNetworkEvent(e); })); } enqueueNetworkEvent(e) { this.queuedNetworkEvents.length >= Fm || (this.queuedNetworkEvents.push(ib(e)), this.networkBatchTimer === null && (this.networkBatchTimer = window.setTimeout(() => { this.networkBatchTimer = null; const n = this.queuedNetworkEvents.splice(0, this.queuedNetworkEvents.length); n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({

Medium

Ai Review Evidence

Captured nonexcluded browser requests are queued and sent as network batches.

dist/product-agent-widget.jsView on unpkg · L11317

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

39"exports": { ".": { "types": "./dist/index.d.ts", "import": "./dist/product-agent-sdk.js" }, "./widget": { "types": "./dist/widget.d.ts", "import": "./dist/product-agent-widget.js" }, "./runtime": { "types": "./dist/runtime.d.ts", "import": "./dist/product-agent-runtime.js", "require": "./dist/product-agent-runtime.cjs" } }

Medium

Ai Review Evidence

The package exports a browser widget entrypoint.

package.jsonView on unpkg · L39

Source & flagged code

5 flagged

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function $n(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > nl ? `${e.slice(0, nl - 1)}…` : e; ... L3878: createUri(e, n = {}) { L3879: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3880: } ... L3986: try { L3987: cu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L3988: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

9561}), n.disableNetworkCapture || s.enableNetworkCapture(), s.startPageLifecycleRecovery(), s.startStarterPromptUrlWatcher(), e.autoConnect !== !1 && await s.connect();

Medium

Ai Review Evidence

Widget initialization enables network capture by default unless the caller disables it.

dist/product-agent-widget.jsView on unpkg · L9561

11317enableNetworkCapture() { this.networkCaptureCleanup || (this.networkCaptureCleanup = Xm((e) => { sb(e.url, this.options.backendUrl) || this.enqueueNetworkEvent(e); })); } enqueueNetworkEvent(e) { this.queuedNetworkEvents.length >= Fm || (this.queuedNetworkEvents.push(ib(e)), this.networkBatchTimer === null && (this.networkBatchTimer = window.setTimeout(() => { this.networkBatchTimer = null; const n = this.queuedNetworkEvents.splice(0, this.queuedNetworkEvents.length); n.length === 0 || this.socket?.readyState !== WebSocket.OPEN || this.sendNow({

Medium

Ai Review Evidence

Captured nonexcluded browser requests are queued and sent as network batches.

dist/product-agent-widget.jsView on unpkg · L11317

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 19-59json

19 "ai"

20 ],

21 "files": [

22 "dist",

23 "README.md",

24 "INTEGRATION.md"

25 ],

26 "scripts": {