iblai-api-agent-embed

The fragment documents a legitimate-looking iframe authentication integration, but it exposes high-value bearer tokens through a URL query parameter and sends them with postMessage using '*'. These practices create credential disclosure risks and should be replaced with same-origin or tightly restricted postMessage delivery, strict origin validation, short-lived scoped tokens, and avoidance of token-bearing URLs. The shown portion does not demonstrate malware or intentional supply-chain sabotage.