registry / getfloorplan-gltf-widget / 1.13.3

getfloorplan-gltf-widget@1.13.3

Widget for GLTF estate plans.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

The optional DebugPanelPlugin remotely loads and evaluates a Draco decoder at runtime. A change to that remotely served script can execute code in the host page.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer imports and uses DebugPanelPlugin, then triggers its GLTF report update.

Impact

Remote code execution in the embedding browser origin.

Mechanism

Unpinned remote JavaScript fetch followed by eval.

Rationale

This is a real remote-code-execution capability, but inspection indicates it is a package-aligned, user-invoked decoder-loading path rather than covert install-time malware. It warrants a warning until the decoder is bundled or integrity-verified.

Evidence

package.jsonbuild/index.jsbuild/plugins/DebugPanelPlugin.jsbuild/Api.js

Network endpoints2

www.gstatic.com/draco/v1/decoders/draco_wasm_wrapper.jswww.gstatic.com/draco/v1/decoders/draco_decoder.wasm

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with false-positive risk.

getfloorplan-gltf-widget@1.13.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code