@pluno/product-agent-web@0.1.304: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.304: Clean npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > sl ? `${e.slice(0, sl - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: hu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

9369const Fm = "https://app.pluno.ai", $m = 2e4, Hm = 1e4, Km = 6e4, Wm = 6e4, Vm = 1e4, Gm = 1e4, Jm = 1e3, Ia = 3e4, $l = 0.2, Ar = 6e4, Rr =

Low

Ai Review Evidence

The SDK and widget default their backend to https://app.pluno.ai and send product-agent HTTP and websocket traffic to the caller-configured backend URL.

dist/product-agent-widget.jsView on unpkg · L9369

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

dist/product-agent-sdk.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pluno/product-agent-web@0.1.288 matchedIdentity = npm:[redacted]:0.1.288 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/product-agent-sdk.jsView on unpkg

9969const dd = "https://app.pluno.ai", ld = 2e4, ud = 1e4, hd = 6e4, pd = 6e4, fd = 1e4, gd = 1e4, md = 1e3, dn = 3e4, bi =

Low

Ai Review Evidence

The SDK and widget default their backend to https://app.pluno.ai and send product-agent HTTP and websocket traffic to the caller-configured backend URL.

dist/product-agent-sdk.jsView on unpkg · L9969

package.jsonView file

26"scripts": { "build": "vite build --mode sdk && vite build --mode widget && vite build --mode runtime && tsc --emitDeclarationOnly", "check": "tsc --noEmit && npm run che

Low

Suspicious Lifecycle Evidence

package.json has build, check, test, and prepack scripts only, with socket.io-client as the sole runtime dependency and no install lifecycle hook.

package.jsonView on unpkg · L26

dist/product-agent-runtime.cjsView file

1Display timestamps must retain the backend UTC precision.");return`${e[1]}.${(e[2]??"").padEnd(6,"0")}`}function w(i){if

Low

Ai Review Evidence

The CommonJS runtime bundle is client session and display state code and does not open network connections or spawn processes.

dist/product-agent-runtime.cjsView on unpkg · L1

Source & flagged code

7 flagged

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > sl ? `${e.slice(0, sl - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: hu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

9369const Fm = "https://app.pluno.ai", $m = 2e4, Hm = 1e4, Km = 6e4, Wm = 6e4, Vm = 1e4, Gm = 1e4, Jm = 1e3, Ia = 3e4, $l = 0.2, Ar = 6e4, Rr =

Low

Ai Review Evidence

The SDK and widget default their backend to https://app.pluno.ai and send product-agent HTTP and websocket traffic to the caller-configured backend URL.

dist/product-agent-widget.jsView on unpkg · L9369

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

dist/product-agent-sdk.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pluno/product-agent-web@0.1.288 matchedIdentity = npm:[redacted]:0.1.288 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/product-agent-sdk.jsView on unpkg

9969const dd = "https://app.pluno.ai", ld = 2e4, ud = 1e4, hd = 6e4, pd = 6e4, fd = 1e4, gd = 1e4, md = 1e3, dn = 3e4, bi =

Low

Ai Review Evidence

The SDK and widget default their backend to https://app.pluno.ai and send product-agent HTTP and websocket traffic to the caller-configured backend URL.

dist/product-agent-sdk.jsView on unpkg · L9969

package.jsonView file

Lines 6-46json

6 "type": "module",

7 "main": "dist/product-agent-sdk.js",

8 "module": "dist/product-agent-sdk.js",

9 "types": "dist/index.d.ts",

10 "homepage":

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function te(i,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"