registry / getfloorplan-gltf-widget / 1.13.10

getfloorplan-gltf-widget@1.13.10

Widget for GLTF estate plans.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The optional debug plugin downloads and evaluates a Draco decoder wrapper from Google when its report is generated. This creates runtime remote-code execution exposure, but source inspection found no malicious follow-on behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer imports and initializes DebugPanelPlugin, then opens it or requests its GLTF report.

Impact

A changed or compromised remote decoder response could execute in the host page's origin.

Mechanism

Remote JavaScript fetch followed by eval

Rationale

The package contains a concrete unpinned remote eval chain in an optional debugging feature, warranting a warning. Its scoped, user-invoked Draco-decoder purpose and absence of install hooks or exfiltration do not establish malicious intent.

Evidence

build/plugins/DebugPanelPlugin.jspackage.jsonbuild/index.js

Network endpoints2

www.gstatic.com/draco/v1/decoders/draco_wasm_wrapper.jswww.gstatic.com/draco/v1/decoders/draco_decoder.wasm

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence with false-positive risk.

getfloorplan-gltf-widget@1.13.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code