registry / getfloorplan-gltf-widget / 1.13.0

getfloorplan-gltf-widget@1.13.0

Widget for GLTF estate plans.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No install-time or default-import attack was confirmed. The unresolved risk is a user-invoked debug plugin that fetches and evals remote Draco decoder JavaScript from Google at runtime.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer imports DebugPanelPlugin, initializes it, then shows the debug panel/report

Impact

Runtime execution of remote third-party decoder code in the host page context

Mechanism

remote JavaScript fetch plus eval for Draco decoding

Attack narrative

If an application explicitly wires in DebugPanelPlugin and opens the debug report, the plugin downloads Google's Draco wrapper and WASM decoder, then evals the wrapper to initialize DracoDecoderModule. This is aligned with GLTF debugging, but it is still a remote-code execution primitive in the page context and is not pinned or bundled.

Rationale

Source inspection does not support a malicious verdict because the risky code is an optional debug feature and no harvesting, persistence, install hook, or exfiltration was found. The remote eval of third-party decoder code is a real dangerous capability, so warn rather than mark clean.

Evidence

package.jsonbuild/index.jsbuild/plugins/DebugPanelPlugin.jsbuild/plugins/SentryPlugin.jsbuild/basis/basis_transcoder.wasm

Network endpoints3

www.gstatic.com/draco/v1/decoders/draco_wasm_wrapper.js/draco/v1/decoders/draco_decoder.wasm

getfloorplan-gltf-widget@1.13.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code