registry / getfloorplan-gltf-widget / 1.13.1

getfloorplan-gltf-widget@1.13.1

Widget for GLTF estate plans.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The risky primitive is user/runtime-triggered Draco decoder loading in a debug plugin and is package-aligned.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer imports/uses the widget, API, optional SentryPlugin, or DebugPanelPlugin at browser runtime.

Impact

Expected widget data loading and optional diagnostics; no confirmed unauthorized code execution or exfiltration.

Mechanism

browser asset/API loading plus optional telemetry and Draco decoder eval

Rationale

Static source inspection found dangerous-looking eval/network patterns, but they are confined to package-aligned browser functionality: Draco decoder loading, widget/API fetches, and optional Sentry reporting. With no lifecycle execution, credential harvesting, persistence, shelling out, or covert endpoints, the scanner hints appear noisy rather than malicious.

Evidence

package.jsonbuild/index.jsbuild/Api.jsbuild/createWidget.jsbuild/plugins/DebugPanelPlugin.jsbuild/plugins/SentryPlugin.js

Network endpoints2

www.gstatic.com/draco/v1/decoders/draco_wasm_wrapper.jswww.gstatic.com/draco/v1/decoders/draco_decoder.wasm

getfloorplan-gltf-widget@1.13.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code