registry / @vtex/faststore-plugin-buyer-portal / 2.0.36

@vtex/faststore-plugin-buyer-portal@2.0.36

A plugin for faststore with buyer portal

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The package forwards VTEX authentication context to fixed, feature-named agent apps through origin-restricted iframe messaging. The inspected source supports an intended feature integration and shows no unrelated collection, malicious use, or install-time attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user opens the buyer organization manager or order-entry page, and its embedded agent signals readiness or loads.

Impact

The embedded agent receives authentication context for its feature; inspected package code does not establish an unrelated recipient or malicious use.

Mechanism

Each page passes VTEX authentication context to its corresponding agent iframe. The sender targets the iframe's URL-derived origin and checks message origin and source.

AI rationale

Evidence

package.jsonsrc/pages/buyer-organization-manager.tsxsrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxsrc/pages/order-entry.tsxsrc/features/order-entry/layouts/OrderEntryLayout.tsx

Network endpoints2

buyer-bulk-ops-agent.vercel.apporder-entry-agent.vercel.app

Decision evidence

public snapshot

AI called this Clean at 78.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

package.json lists Husky under prepare and shows no preinstall, install, or postinstall hook.
The buyer organization page supplies its VTEX token to a buyer-agent component. That component sends the token to its fixed, feature-specific iframe origin after the iframe signals readiness.
The order-entry page supplies authentication context to its feature-specific agent component, which sends that context to its fixed iframe origin after readiness.

Evidence against

Both agent iframes receive VTEX authentication data from separately hosted Vercel apps; their receiver implementations are outside this package snapshot.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 758 file(s), 1.36 MB of source, external domains: analytics.vtex.com, b2bfaststoredev.vtexassets.com, beta.vtexobservability.com, buyer-bulk-ops-agent.vercel.app, jsonata.org, order-entry-agent.vercel.app, rc.vtex.com, stable.vtexobservability.com, test-store.vtex.com, vtex.vtexcommercestable.com.br, www.google.com

Source & flagged code

5 flagged

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

•Credential-bearing message sent to a fixed external iframe in src/features/b2b-[redacted].tsx: : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; const targetWindow = iframeRef.current?.contentWindow; targetWindow.postMessage( if (event.source !== iframeRef.current?.contentWindow) return; if (iframeRef.current?.contentWindow && vtexIdclientAutCookie) { <iframe

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

6const B2B_AGENT_URL = isDevelopment() ? "http://localhost:3001/app/buyer-bulk-ops-agent" : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; interface B2BAgentLayoutProps { vtexIdclient

Low

Ai Review Evidence

The buyer organization page supplies its VTEX token to a buyer-agent component. That component sends the token to its fixed, feature-specific iframe origin after the iframe signals readiness.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

package.jsonView file

12"scripts": { "lint": "eslint . --ext .js,.jsx,.ts,.tsx", "lint:fix": "eslint . --ext .js,.jsx,.ts,.tsx --fix", "typecheck": "tsc --noEmit", "test": "vitest run", "test:watch": "vitest", "test:coverage": "vitest run --coverage", "i18n:check": "node scripts/check-localization-keys.mjs check --base=main", "i18n:refresh": "node scripts/check-localization-keys.mjs refresh", "prepare": "husky", "release": "yarn release:stable", "release:stable": "yarn check --integrity && yarn release-it -c .release-it.json --ci --no-npm", "release:beta": "./beta-rel

Low

Suspicious Lifecycle Evidence

package.json lists Husky under prepare and shows no preinstall, install, or postinstall hook.

package.jsonView on unpkg · L12

src/pages/buyer-organization-manager.tsxView file

61const cookieHeader = props.clientContext?.cookie ?? ""; const tokenFromContext = props.clientContext?.vtexIdclientAutCookie ?? ""; const { token: tokenFromCookie, accountFromCookie } = getAuthCookieInfo(cookieHeader); // Prefer a token-like value if available; otherwise extract from cookie header. const vtexIdclientAutCookie = t

Low

Ai Review Evidence

The buyer organization page supplies its VTEX token to a buyer-agent component. That component sends the token to its fixed, feature-specific iframe origin after the iframe signals readiness.

src/pages/buyer-organization-manager.tsxView on unpkg · L61

84return ( <LocalizationProvider labels={props.data?.localizationLabels ?? {}}> <B2BAgentLayout vtexIdclientAutCookie={vtexIdclientAutCookie} account={account}

Low

Ai Review Evidence

The buyer organization page supplies its VTEX token to a buyer-agent component. That component sends the token to its fixed, feature-specific iframe origin after the iframe signals readiness.

src/pages/buyer-organization-manager.tsxView on unpkg · L84

Source & flagged code

5 flagged · loading source

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

Low

Ai Review Evidence

The buyer organization page supplies its VTEX token to a buyer-agent component. That component sends the token to its fixed, feature-specific iframe origin after the iframe signals readiness.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg · L6

Findings

1 Critical3 Medium8 Low

CriticalHardcoded Runtime Data Exfiltrationsrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsx

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencesrc/pages/buyer-organization-manager.tsx

LowAi Review Evidencesrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsx

Affected versions and remediation

This report applies to @vtex/faststore-plugin-buyer-portal@2.0.36.

See all versions of @vtex/faststore-plugin-buyer-portal for other recorded verdicts.

Review the evidence and your use of @vtex/faststore-plugin-buyer-portal@2.0.36 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 12:57:14.951Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.