registry / getfloorplan-gltf-widget / 1.13.8

getfloorplan-gltf-widget@1.13.8

Widget for GLTF estate plans.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The optional debug plugin downloads a JavaScript decoder from Google and evaluates it at runtime. A compromised remote asset can execute code in the embedding page's origin.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Consumer imports DebugPanelPlugin and invokes its report update while the debug panel is active.

Impact

Remote code execution in the host browser context.

Mechanism

Unpinned remote JavaScript fetch followed by eval

Rationale

Source confirms a remotely sourced eval path, but no install-time execution or malicious collection/persistence behavior. Treat the unpinned remote execution as a critical vulnerability requiring a warning.

Evidence

package.jsonbuild/index.jsbuild/plugins/DebugPanelPlugin.jsbuild/Api.jsREADME.md

Network endpoints2

www.gstatic.com/draco/v1/decoders/draco_wasm_wrapper.jswww.gstatic.com/draco/v1/decoders/draco_decoder.wasm

Decision evidence

public snapshot

with false-positive risk.

getfloorplan-gltf-widget@1.13.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code