registry / getfloorplan-gltf-widget / 1.13.9

getfloorplan-gltf-widget@1.13.9

Widget for GLTF estate plans.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The optional debug plugin remotely loads and evaluates a Draco decoder at runtime. This creates a third-party remote-code execution dependency, but no install-time behavior or data-exfiltration chain was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer imports and initializes DebugPanelPlugin, then opens its report/debug panel.

Impact

A compromised remote decoder endpoint could execute JavaScript in the embedding application's origin.

Mechanism

Fetches and evals a remote Draco decoder script.

Rationale

This is a concrete remote code-loading capability in an optional debugging feature, not evidence of install-time malware or an observed theft/destructive chain. It warrants a warning because remote executable code is evaluated without integrity verification.

Evidence

package.jsonbuild/index.jsbuild/plugins/DebugPanelPlugin.jsbuild/Api.jsbuild/getBestRoute.js

Network endpoints2

www.gstatic.com/draco/v1/decoders/draco_wasm_wrapper.jswww.gstatic.com/draco/v1/decoders/draco_decoder.wasm

Decision evidence

public snapshot

getfloorplan-gltf-widget@1.13.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code