registry / Credential exfiltration / @vtex/faststore-plugin-buyer-portal / 2.0.37

@vtex/faststore-plugin-buyer-portal@2.0.37

A plugin for faststore with buyer portal

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Source inspection confirms automatic cross-origin forwarding of VTEX tokens and customer/session data to fixed external hosts. Because the hosts are integrated agent applications but their trust and consent boundaries are unresolved, this warrants a warning rather than a malicious verdict.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An authorized user loads either agent page and its iframe signals readiness or finishes loading.

Impact

The external application receives session credentials that could enable access to the associated VTEX account, along with customer identifiers.

Mechanism

The page sends authentication and account data through postMessage to the origin selected by a hardcoded external URL.

AI rationale

Evidence

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxsrc/pages/buyer-organization-manager.tsxsrc/features/order-entry/layouts/OrderEntryLayout.tsxsrc/pages/order-entry.tsx

Network endpoints2

buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agentorder-entry-agent.vercel.app/app/order-entry-agent

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Authenticated portal pages obtain a VTEX token from session context or cookies and pass it into the agent layouts.
The buyer organization manager layout sends the token and customer identifiers to a fixed external iframe origin when the iframe signals readiness or loads.
The order-entry layout sends VTEX tokens, session data, and customer identifiers to a second fixed external iframe origin.
The recipients are named for the embedded agent features, but the source does not establish that either external host is a trusted credential recipient or show recipient-specific consent.

Evidence against

The pages are authenticated and the external frames correspond to the package’s buyer-agent and order-entry features; this suggests a product integration, but does not resolve the credential exposure risk.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

5 flagged

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

•Credential-bearing message sent to a fixed external iframe in src/features/b2b-[redacted].tsx: : "https://buyer-bulk-ops-agent.vercel.app/app/buyer-bulk-ops-agent"; const targetWindow = iframeRef.current?.contentWindow; targetWindow.postMessage( if (event.source !== iframeRef.current?.contentWindow) return; if (iframeRef.current?.contentWindow && vtexIdclientAutCookie) { <iframe

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

src/pages/buyer-organization-manager.tsxView file

61const cookieHeader = props.clientContext?.cookie ?? ""; const tokenFromContext = props.clientContext?.vtexIdclientAutCookie ?? ""; const { token: tokenFromCookie, accountFromCookie } = getAuthCookieInfo(cookieHeader); // Prefer a token-like value if available; otherwise extract from cookie header. const vtexIdclientAutCookie = t

Medium

Ai Review Evidence

Authenticated portal pages obtain a VTEX token from session context or cookies and pass it into the agent layouts.

src/pages/buyer-organization-manager.tsxView on unpkg · L61

58const B2BAgentPage = (props: AuthRouteProps<B2BAgentPageData>) => { if (!props.authorized) return null; const cookieHeader = props.clientContext?.cookie ?? ""; const tokenFromContext = props.clientContext?.vtexIdclientAutCookie ?? ""; const { token: tokenFromCookie, accountFromCookie } = getAuthCookieInfo(cookieHeader); // Prefer a token-like value if available; otherwise extract from cookie header. const vtexIdclientAutCookie = tokenFromContext && !tokenFromContext.includ

Medium

Ai Review Evidence

Authenticated portal pages obtain a VTEX token from session context or cookies and pass it into the agent layouts.

src/pages/buyer-organization-manager.tsxView on unpkg · L58

73if (!vtexIdclientAutCookie) { throw new Error("Missing VTEX auth token for B2B Agent iframe"); } // account/locale via discovery.config (recomendado) const account = storeConfig?.api?.storeId ?? accountFromCookie ?? ""; const locale = storeConfig?.session?.locale ?? "en-US"; const customerId = props.clientContext?.customerId; const userId = props.c

Medium

Ai Review Evidence

Authenticated portal pages obtain a VTEX token from session context or cookies and pass it into the agent layouts.

src/pages/buyer-organization-manager.tsxView on unpkg · L73

84return ( <LocalizationProvider labels={props.data?.localizationLabels ?? {}}> <B2BAgentLayout vtexIdclientAutCookie={vtexIdclientAutCookie} account={account} locale={locale} customerId={customerId} userId={userId} /> </LocalizationProvide

Medium

Ai Review Evidence

Authenticated portal pages obtain a VTEX token from session context or cookies and pass it into the agent layouts.

src/pages/buyer-organization-manager.tsxView on unpkg · L84

Source & flagged code

5 flagged · loading source

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxView on unpkg

src/pages/buyer-organization-manager.tsxView file

Medium

Findings

1 Critical7 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationsrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsx

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencesrc/pages/buyer-organization-manager.tsx

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @vtex/faststore-plugin-buyer-portal@2.0.37.

See all versions of @vtex/faststore-plugin-buyer-portal for other recorded verdicts.

Review the evidence and your use of @vtex/faststore-plugin-buyer-portal@2.0.37 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 13:34:59.001Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.