@pluno/product-agent-web@0.1.305: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.305: Clean npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > sl ? `${e.slice(0, sl - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: hu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

21760async function cv(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ o

Low

Ai Review Evidence

The widget obtains a session through a browser fetch request; browser cookie destination rules apply.

dist/product-agent-widget.jsView on unpkg · L21760

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

60"dependencies": { "socket.io-client": "4.8.3" }, "overrides": {

Low

Suspicious Lifecycle Evidence

package.json has no automatic install hooks and depends on socket.io-client rather than itself.

package.jsonView on unpkg · L60

dist/product-agent-runtime.cjsView file

1dispatch(e){return this.adapter.dispatch(e)}async navigate(e){const t=++this.navigationRevision;this.pendingNavigation=!0,this.model=this.initialModel,this.emit("state",t

Low

Ai Review Evidence

The CommonJS runtime dispatches operations through its supplied adapter.

dist/product-agent-runtime.cjsView on unpkg · L1

dist/product-agent-sdk.jsView file

11867const c = i === "execute_code", d = i === "execute_code_in_browser_tab" && a !== null && typeof a == "object" && a.tabId === "local:current"; if (!c && !d || !Dl(a)) { this.send({ t

Low

Ai Review Evidence

Browser execution is part of session tool handling, restricts tab execution to the current tab, and rejects frame targeting.

dist/product-agent-sdk.jsView on unpkg · L11867

13749for (const [i, r] of Object.entries(t)) i === "pageContent" ? n[i] = r : Vr(i) ? n[i] = Qt : n[i] = i.toLowerCase() === "url" ? tu(r) : Ft(r, e + 1, s); return n; } func

Low

Ai Review Evidence

Network reporting redacts sensitive fields and token-bearing URLs.

dist/product-agent-sdk.jsView on unpkg · L13749

Source & flagged code

7 flagged

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > sl ? `${e.slice(0, sl - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: hu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

21760async function cv(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ o

Low

Ai Review Evidence

The widget obtains a session through a browser fetch request; browser cookie destination rules apply.

dist/product-agent-widget.jsView on unpkg · L21760

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 40-67json

40 ".": {

41 "types": "./dist/index.d.ts",

42 "import": "./dist/product-agent-sdk.js"

43 },

44 "./widget": {

45 "types": "./dist/widget.d.ts",

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function te(i,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"

dist/product-agent-sdk.jsView file

11867const c = i === "execute_code", d = i === "execute_code_in_browser_tab" && a !== null && typeof a == "object" && a.tabId === "local:current"; if (!c && !d || !Dl(a)) { this.send({ t

Low

Ai Review Evidence

Browser execution is part of session tool handling, restricts tab execution to the current tab, and rejects frame targeting.

dist/product-agent-sdk.jsView on unpkg · L11867

13749for (const [i, r] of Object.entries(t)) i === "pageContent" ? n[i] = r : Vr(i) ? n[i] = Qt : n[i] = i.toLowerCase() === "url" ? tu(r) : Ft(r, e + 1, s); return n; } func

Low

Ai Review Evidence

Network reporting redacts sensitive fields and token-bearing URLs.

dist/product-agent-sdk.jsView on unpkg · L13749