Loading npm security reports…

@vtex/faststore-plugin-buyer-portal@2.0.27: Malicious npm | LPM Firewall

registry / @vtex/faststore-plugin-buyer-portal / 2.0.27

@vtex/faststore-plugin-buyer-portal@2.0.27

A plugin for faststore with buyer portal

AI Security Review

scanned 3h ago · by lpm-firewall-ai

When an authorized user opens either agent page, the package loads a hard-coded external iframe and delivers VTEX authentication material to it. This is a concrete credential-disclosure surface outside the VTEX package origin.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An authorized user opens the buyer organization manager or order-entry page.

Impact

The external Vercel applications receive a reusable VTEX authentication token and associated account, customer, and session data.

Mechanism

Cross-origin iframe authentication-token transfer through postMessage.

Attack narrative

The page code obtains the VTEX authentication-cookie value for an authorized user. The layouts load fixed Vercel-hosted frames and send that token, plus account and user context, to those frames using postMessage. Origin checks limit delivery to the configured Vercel hosts, but do not prevent those external hosts from receiving the credential.

Rationale

The package deliberately transfers authentication credentials to hard-coded external Vercel applications during normal page use. There is no install-time hook abuse, but the runtime credential exfiltration is concrete and sufficient to block publication.

Evidence

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxsrc/features/order-entry/layouts/OrderEntryLayout.tsxsrc/pages/order-entry.tsxsrc/pages/buyer-organization-manager.tsx

Network endpoints2

/app/buyer-bulk-ops-agent

Source & flagged code

5 flagged · loading source

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

•Credential-bearing message sent to a fixed external iframe in src/features/b2b-[redacted].tsx: : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; const targetWindow = iframeRef.current?.contentWindow; targetWindow.postMessage( if (event.source !== iframeRef.current?.contentWindow) return; if (iframeRef.current?.contentWindow && vtexIdclientAutCookie) { <iframe

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

6const B2B_AGENT_URL = isDevelopment() ? "http://localhost:3001/app/buyer-bulk-ops-agent" : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent";

High

Ai Review Evidence

The package embeds hard-coded Vercel-hosted agent applications at runtime.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

51targetWindow.postMessage( { type: "AUTH_TOKEN_UPDATE", vtexIdclientAutCookie, account, locale, customerId, userId, }, agentOrigin );

High

Ai Review Evidence

It sends an authentication token and customer/account identifiers to the embedded cross-origin frame.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L51

src/features/order-entry/layouts/OrderEntryLayout.tsxView file

10const B2B_AGENT_URL = isDevelopment() ? "http://localhost:3001/app/order-entry-agent" : "https://order-entry-agent.vercel.app/app/order-entry-agent";

High

Ai Review Evidence

The package embeds hard-coded Vercel-hosted agent applications at runtime.

src/features/order-entry/layouts/OrderEntryLayout.tsxView on unpkg · L10

src/pages/order-entry.tsxView file

100// Prefer a token-like value if available; otherwise extract from cookie header. const vtexIdclientAutCookie = tokenFromContext && !tokenFromContext.includes("=") ? tokenFromContext : tokenFromCookie; if (!vtexIdclientAutCookie) { throw new Error("Missing VTEX auth token for B2B Agent iframe"); }

High

Ai Review Evidence

The order-entry page extracts the VTEX authentication cookie value before passing it to the remote frame.

src/pages/order-entry.tsxView on unpkg · L100

Source & flagged code

5 flagged

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

Lines 1-71typescript

1import { useEffect, useMemo, useRef } from "react";

2

3import { useLocalization } from "../../../shared/localization/LocalizationContext";

4import { isDevelopment } from "../../../shared/utils/environment";

5

6const B2B_AGENT_URL = isDevelopment()

7 ? "http://localhost:3001/app/buyer-bulk-ops-agent"

8 : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent";

High

Ai Review Evidence

The package embeds hard-coded Vercel-hosted agent applications at runtime.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

9

10interface B2BAgentLayoutProps {

11 vtexIdclientAutCookie: string;

12 account: string;

13 locale?: string;

14 customerId?: string;

15 userId?: string;

16}

17

18const containerStyle: React.CSSProperties = {

19 display: "flex",

20 flexDirection: "column",

21 width: "100%",

22 height: "100vh",

23 overflow: "hidden",

24};

25

26const iframeStyle: React.CSSProperties = {

31};

32

33export const B2BAgentLayout = ({

34 vtexIdclientAutCookie,

35 account,

36 locale,

37 customerId,

38 userId,

39}: B2BAgentLayoutProps) => {

40 const { t } = useLocalization();

41 const iframeRef = useRef<HTMLIFrameElement>(null);

42

43 const agentOrigin = useMemo(() => new URL(B2B_AGENT_URL).origin, []);

44

45 useEffect(() => {

46 function postAuthToIframe() {

47 const targetWindow = iframeRef.current?.contentWindow;

48 if (!targetWindow) return;

49

50 // We send only the token (not the full Cookie header) to reduce exposure.

51 targetWindow.postMessage(

52 {

53 type: "AUTH_TOKEN_UPDATE",

54 vtexIdclientAutCookie,

55 account,

56 locale,

57 customerId,

58 userId,

59 },

60 agentOrigin

61 );

High

Ai Review Evidence

It sends an authentication token and customer/account identifiers to the embedded cross-origin frame.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L51

62 }

63

64 function onMessage(event: MessageEvent) {

65 // Only accept messages coming from the iframe's origin.

66 if (event.origin !== agentOrigin) return;

67

68 // Ensure the message is from the iframe window we embedded.

69 if (event.source !== iframeRef.current?.contentWindow) return;

70

71 // Handshake: child tells it is ready; parent responds by sending auth.

•Credential-bearing message sent to a fixed external iframe in src/features/b2b-[redacted].tsx: : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; const targetWindow = iframeRef.current?.contentWindow; targetWindow.postMessage( if (event.source !== iframeRef.current?.contentWindow) return; if (iframeRef.current?.contentWindow && vtexIdclientAutCookie) { <iframe

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

src/features/order-entry/layouts/OrderEntryLayout.tsxView file

Lines 1-30typescript

1import { useEffect, useMemo, useRef } from "react";

2

3import storeConfig from "discovery.config";

4

5import { useRouter } from "next/router";

6

src/pages/order-entry.tsxView file

Lines 80-120typescript

80};

81

82export const loader = withLoaderErrorBoundary(loaderFunction, {

83 componentName: "OrderEntryPage",

84 redirectToError: true,

85});

86