registry / sloth-d2c-figma-plugin / 2.0.4-beta.21

sloth-d2c-figma-plugin@2.0.4-beta.21

A Figma plugin for D2C

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Importing either primary package entry point in a browser-like environment fetches and executes remote JavaScript. The loader is concealed inside obfuscated distribution bundles.

Static reason

One or more suspicious static signals were detected.

Trigger

Import or require the package where document is available.

Impact

A CDN-controlled payload can execute with the importing application's browser privileges.

Mechanism

Automatic remote script injection and execution.

Attack narrative

The package's public import and require entry points resolve to obfuscated bundles. In browser-like environments, each bundle automatically injects a script URL from a Tencent Music CDN. Because this is executable JavaScript loaded at import time rather than a pinned package dependency, control of the remote resource can change code executed by consumers without a package update.

AI rationale

The package contains an automatic, obfuscated remote-code loader in both primary entry points. Although no install hook exists and the URL suggests a formatter dependency, the import-time execution of mutable remote code is a concrete supply-chain attack surface.

Evidence

dist/core.cjs.jsdist/core.esm.js

Network endpoints1

cdn-y.tencentmusic.com/sloth/d2c/sdk/prettier@3.5.3/standalone.js

Decision evidence

public snapshot

sloth-d2c-figma-plugin@2.0.4-beta.21

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code