@pluno/product-agent-web@0.1.310: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.310: Clean npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > sl ? `${e.slice(0, sl - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: hu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

1209function Kn(t, e) { if (!We(t.profile, $d[Mh[e.kind]])) throw new Error("Feature capability unavailable."); if (["decisions", "decision", "preferencePrompts"].includes(e.kind)

Low

Ai Review Evidence

Widget feature mutations check the active profile's capabilities before changing preferences.

dist/product-agent-widget.jsView on unpkg · L1209

21761async function cv(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }), ...e ? {

Low

Ai Review Evidence

Widget authentication uses caller-configured tokens or a token endpoint; browser cookie domain rules apply to its authenticated request.

dist/product-agent-widget.jsView on unpkg · L21761

13920pc = e.loginRequired || e.token || e.webSocketFactory ? void 0 : e.tokenProvider ?? (e.tokenEndpoint ? async (h) => cv( e.tokenEndpoint, h?.signal ) : void 0); if (!e.loginRequired && !e.signupRequired && !e.token && !pc && !e.

Low

Ai Review Evidence

Widget authentication uses caller-configured tokens or a token endpoint; browser cookie domain rules apply to its authenticated request.

dist/product-agent-widget.jsView on unpkg · L13920

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

26"scripts": { "build": "vite build --mode sdk && vite build --mode widget && vite build --mode runtime && tsc --emitDeclarationOnly", "check": "tsc --noE

Low

Suspicious Lifecycle Evidence

The manifest has no registry install lifecycle hooks or runtime self-dependency.

package.jsonView on unpkg · L26

dist/product-agent-runtime.cjsView file

1startNewSession(e={}){return this.cancelPendingSubmissions(),this.submissionPreviews.clear(),this.retainedTranscript=null,this.model=this.initialModel,this.modelExplicit=!1,this.emit("state",this.getState()),e.notifyTransport===!1?Promise.resolve():this.navigate({type:"session.new"})}async

Low

Ai Review Evidence

The CommonJS runtime implements session state and dispatches session navigation through its adapter.

dist/product-agent-runtime.cjsView on unpkg · L1

Source & flagged code

7 flagged

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > sl ? `${e.slice(0, sl - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: hu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

1209function Kn(t, e) { if (!We(t.profile, $d[Mh[e.kind]])) throw new Error("Feature capability unavailable."); if (["decisions", "decision", "preferencePrompts"].includes(e.kind)

Low

Ai Review Evidence

Widget feature mutations check the active profile's capabilities before changing preferences.

dist/product-agent-widget.jsView on unpkg · L1209

21761async function cv(t, e) { const n = await fetch(t, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify({ origin: location.origin, url: location.href }), ...e ? {

Low

Ai Review Evidence

Widget authentication uses caller-configured tokens or a token endpoint; browser cookie domain rules apply to its authenticated request.

dist/product-agent-widget.jsView on unpkg · L21761

13920pc = e.loginRequired || e.token || e.webSocketFactory ? void 0 : e.tokenProvider ?? (e.tokenEndpoint ? async (h) => cv( e.tokenEndpoint, h?.signal ) : void 0); if (!e.loginRequired && !e.signupRequired && !e.token && !pc && !e.

Low

Ai Review Evidence

Widget authentication uses caller-configured tokens or a token endpoint; browser cookie domain rules apply to its authenticated request.

dist/product-agent-widget.jsView on unpkg · L13920

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 6-46json

6 "type": "module",

7 "main": "dist/product-agent-sdk.js",

8 "module": "dist/product-agent-sdk.js",

9 "types": "dist/index.d.ts",

10 "homepage":

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function te(i,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"