registry / getfloorplan-gltf-widget / 1.14.0

getfloorplan-gltf-widget@1.14.0

Widget for GLTF estate plans.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The optional DebugPanelPlugin retrieves JavaScript and WebAssembly from gstatic and evaluates the JavaScript at runtime. This creates remote code execution in the embedding browser if the debug report path is used.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Consumer imports and initializes DebugPanelPlugin, then opens it or otherwise triggers updateReport.

Impact

A changed or intercepted remote decoder script executes with the embedding page's privileges.

Mechanism

Remote JavaScript fetch followed by eval

Rationale

This is a concrete remote-code-execution primitive, though it is limited to an explicitly imported debug plugin and does not run at install time. No credential harvesting, filesystem mutation, or exfiltration was found in inspected entrypoints.

Evidence

package.jsonbuild/index.jsbuild/plugins/DebugPanelPlugin.js

Network endpoints2

www.gstatic.com/draco/v1/decoders/draco_wasm_wrapper.jswww.gstatic.com/draco/v1/decoders/draco_decoder.wasm

Decision evidence

public snapshot

AI called this at 90.0% confidence with false-positive risk.

getfloorplan-gltf-widget@1.14.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code