registry / getfloorplan-gltf-widget / 1.13.2

getfloorplan-gltf-widget@1.13.2

Widget for GLTF estate plans.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time behavior was found. A user-enabled debug plugin fetches and evals a remote Draco decoder from Google CDN, which is a real runtime remote-code trust surface but package-aligned.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer imports/enables DebugPanelPlugin and opens the debug panel or clicks update report.

Impact

Remote CDN JavaScript executes in the browser context during debug reporting if that plugin is used.

Mechanism

remote Draco decoder fetch plus eval

Attack narrative

The exported DebugPanelPlugin renders a debug UI. When made visible or asked to update its report, it loads Google's Draco decoder wrapper and wasm, evals the wrapper to obtain DracoDecoderModule, then uses it to inspect GLTF data. This is not install-time malware and appears aligned with GLTF debugging, but it leaves consumers trusting live remote code at runtime.

Rationale

Static inspection confirms a reachable eval of remote CDN JavaScript, but the behavior is debug-plugin scoped and GLTF/Draco aligned rather than credential theft, persistence, or unconsented execution. Warn for the remote-code trust surface rather than block as malicious.

Evidence

package.jsonbuild/index.jsbuild/Api.jsbuild/createWidget.jsbuild/plugins/DebugPanelPlugin.jsbuild/plugins/SentryPlugin.js

Network endpoints2

getfloorplan-gltf-widget@1.13.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code