registry / getfloorplan-gltf-widget / 1.13.6

getfloorplan-gltf-widget@1.13.6

Widget for GLTF estate plans.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The debug plugin downloads and evaluates mutable remote JavaScript. A compromised remote response executes in the embedding application's browser context.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Consumer imports/installs DebugPanelPlugin, opens it, and triggers its report.

Impact

Remote code execution in the host page context.

Mechanism

Remote JavaScript fetch followed by eval

Attack narrative

DebugPanelPlugin's report path fetches draco_wasm_wrapper.js from a mutable gstatic URL, slices the returned source, and evaluates it with eval(). No hash, signature, or bundled copy constrains the executed JavaScript. A response changed at that endpoint can execute arbitrary code in the application that enabled the plugin.

Rationale

This is a concrete remote code-execution primitive, despite being gated behind an explicitly enabled debug plugin. No install-time behavior was found.

Evidence

package.jsonbuild/plugins/DebugPanelPlugin.jsbuild/createWidget.js

Network endpoints2

www.gstatic.com/draco/v1/decoders/draco_wasm_wrapper.jswww.gstatic.com/draco/v1/decoders/draco_decoder.wasm

getfloorplan-gltf-widget@1.13.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code