registry / getfloorplan-gltf-widget / 1.13.7

getfloorplan-gltf-widget@1.13.7

Widget for GLTF estate plans.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The optional debug plugin dynamically executes JavaScript downloaded at runtime from a fixed Google CDN endpoint. This is a remote-code execution capability, but it is only reached when the debug report feature is activated.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Consumer imports and activates DebugPanelPlugin, then opens it to generate a report.

Impact

A compromised or substituted CDN response could execute arbitrary code in the host browser origin.

Mechanism

Fetch remote Draco wrapper text and eval it

Rationale

Source inspection confirms a runtime remote-code execution primitive, not install-time malware or data theft. Its feature-aligned, explicitly activated debug use makes a warning more appropriate than a block.

Evidence

package.jsonbuild/index.jsbuild/plugins/DebugPanelPlugin.jsbuild/Api.jsbuild/createWidget.js

Network endpoints2

www.gstatic.com/draco/v1/decoders/draco_wasm_wrapper.jswww.gstatic.com/draco/v1/decoders/draco_decoder.wasm

Decision evidence

public snapshot

getfloorplan-gltf-widget@1.13.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code