registry / @vtex/faststore-plugin-buyer-portal / 2.0.19

@vtex/faststore-plugin-buyer-portal@2.0.19

A plugin for faststore with buyer portal

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Visiting either authenticated agent route loads a remote Vercel iframe and sends VTEX authentication/session data to it. This is a concrete credential delegation boundary, but not install-time execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An authenticated user opens buyer-organization-manager or order-entry.

Impact

The remote agent services can receive reusable VTEX credentials and related account/session data.

Mechanism

Cross-origin iframe postMessage of authentication and user context.

Rationale

Source inspection does not support the scanner’s malicious install-hook claim. It does show deliberate runtime transfer of credentials to fixed third-party-hosted agent endpoints, warranting a warning pending trust/ownership validation.

Evidence

package.json.husky/pre-commitsrc/pages/buyer-organization-manager.tsxsrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxsrc/features/order-entry/layouts/OrderEntryLayout.tsxdocs/scope_of_work/organization-self-management.mdbeta-release.sh

Network endpoints2

buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agentorder-entry-agent.vercel.app/app/order-entry-agent

@vtex/faststore-plugin-buyer-portal@2.0.19

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code