registry / @vtex/faststore-plugin-buyer-portal / 2.0.25

@vtex/faststore-plugin-buyer-portal@2.0.25

A plugin for faststore with buyer portal

AI Security Review

scanned 14d ago · by lpm-firewall-ai

An authenticated, package-defined buyer-portal route embeds a remote Vercel agent and transfers a VTEX authentication token plus account context to it. This is a concrete credential disclosure surface, though no install-time behavior or local persistence was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An authorized user opens /pvt/organization-account/buyer-organization-manager.

Impact

The remote agent origin receives a reusable auth token and associated account identifiers.

Mechanism

Cross-origin iframe postMessage of authentication and customer context

Rationale

The credential transfer to a hardcoded third-party-hosted receiver is real source behavior, but the inspected package does not establish malicious intent, stealth, install-time execution, or persistence. Treat it as an unresolved credential-exfiltration risk rather than a publish-blocking malware finding.

Evidence

package.jsonplugin.config.jssrc/pages/buyer-organization-manager.tsxsrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsx

Network endpoints1

buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent

Decision evidence

public snapshot

@vtex/faststore-plugin-buyer-portal@2.0.25

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code