@pluno/product-agent-web@0.1.312: Clean npm security report | LPM Firewall

Loading npm security reports…

@pluno/product-agent-web@0.1.312: Clean npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > ol ? `${e.slice(0, ol - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: gu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

7026const q = await Promise.resolve(fetch(u, { method: s ?? (i === void 0 ? "GET" : "POST"), cache: "no-store", signal: p.signal, headers: { "x-product-agent-auth-request-id": m, authorization: l || o === "

Low

Ai Review Evidence

The widget sends its configured auth token in requests made by the SDK to its configured backend URL.

dist/product-agent-widget.jsView on unpkg · L7026

10971const n = this.pendingTransportDiagnostics.slice(0, 20), i = this.pendingHealthDiagnostics.slice(0, 20), s = [...n].reverse().find((r) => r.phase.startsWith("auth_")), o = s?.requestId ?? s?.connectionAttemptId, a = this.options.productVariant === "customer_embedded" ? "/api/product-agent/embed/diagnostics" : "/api/product-agent/runtime/diagnostics"; try { const r = await fetch(new U

Low

Ai Review Evidence

Widget diagnostics are posted to product-agent diagnostics routes on that backend.

dist/product-agent-widget.jsView on unpkg · L10971

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

26"scripts": { "build": "vite build --mode sdk && vite build --mode widget && vite build --mode runtime && tsc --emitDeclarationOnly", "check": "tsc --noEmit && npm run check:core && npm run check:architecture-reference", "check:core": "tsc -p tsconfig.core.json && node scripts/check-core-boundaries.mjs", "check:

Low

Suspicious Lifecycle Evidence

package.json has no install lifecycle hook; its prepack hook runs package verification.

package.jsonView on unpkg · L26

dist/product-agent-runtime.cjsView file

1e;exports.mergeProductAgentEntityPages=$;exports.normalizeProductAgentEntityPage=I;exports.[redacted]B;exports.[redacted]te;exports.[redacted]

Low

Ai Review Evidence

The runtime bundle exposes query, interaction, session-history, and local-storage decision helpers; the inspected excerpt shows no account-setting mutation or external reporting.

dist/product-agent-runtime.cjsView on unpkg · L1

Source & flagged code

6 flagged

dist/product-agent-widget.jsView file

122for (let i = 0; i < t.length; i++) L123: e = Math.imul(e ^ t.charCodeAt(i), 16777619) >>> 0, n = Math.imul(n ^ t.charCodeAt(i), 33) >>> 0; L124: return `selection:${e.toString(16)}:${n.toString(16)}`; ... L290: function Hn(t) { L291: const e = t.replace(/\n\s*at\s[\s\S]*$/, "").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED]").replace(/\b(?:set-cookie|cookie)... L292: return e.length > ol ? `${e.slice(0, ol - 1)}…` : e; ... L3890: createUri(e, n = {}) { L3891: return e + "://" + this._hostname() + this._port() + this.opts.path + this._query(n); L3892: } ... L3998: try { L3999: gu = typeof XMLHttpRequest < "u" && "withCredentials" in new XMLHttpRequest(); L4000: } catch {

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/product-agent-widget.jsView on unpkg · L122

7026const q = await Promise.resolve(fetch(u, { method: s ?? (i === void 0 ? "GET" : "POST"), cache: "no-store", signal: p.signal, headers: { "x-product-agent-auth-request-id": m, authorization: l || o === "

Low

Ai Review Evidence

The widget sends its configured auth token in requests made by the SDK to its configured backend URL.

dist/product-agent-widget.jsView on unpkg · L7026

10971const n = this.pendingTransportDiagnostics.slice(0, 20), i = this.pendingHealthDiagnostics.slice(0, 20), s = [...n].reverse().find((r) => r.phase.startsWith("auth_")), o = s?.requestId ?? s?.connectionAttemptId, a = this.options.productVariant === "customer_embedded" ? "/api/product-agent/embed/diagnostics" : "/api/product-agent/runtime/diagnostics"; try { const r = await fetch(new U

Low

Ai Review Evidence

Widget diagnostics are posted to product-agent diagnostics routes on that backend.

dist/product-agent-widget.jsView on unpkg · L10971

dist/product-agent-runtime.cjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-agent-runtime.cjs#virtual:string-array:round1View on unpkg

package.jsonView file

Lines 6-46json

6 "type": "module",

7 "main": "dist/product-agent-sdk.js",

8 "module": "dist/product-agent-sdk.js",

9 "types": "dist/index.d.ts",

10 "homepage":

dist/product-agent-runtime.cjsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function te(i,e){return e==="limit_exceeded"?{allowed:!1,reason:"credits_exhausted",actions:["upgrade"