No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This extension uses a regular expression that might make your browser slow or freeze if someone sends a carefully crafted message. Since you are the only one using your chat, the risk is low, but it is worth fixing.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The static analysis flagged a regular expression in this minified file as potentially vulnerable to catastrophic backtracking (ReDoS). The flagged location at line 366 in the built output corresponds to a regex rule used by an inline lexer for parsing JSON-like data. If attacker-controlled input (such as a crafted chat message or lorebook entry) triggers the vulnerable regex, it could cause excessive CPU usage and browser unresponsiveness. However, the vulnerability is local to the user's client and does not persist or expose credentials.
Impact: low · Exploitability: plausible
Developer action: Review the regex patterns in the dirty-json lexer, particularly those matching strings and numbers. Consider using a ReDoS-safe regex or add input-length limits to prevent excessive backtracking. The specific line flagged is in the built output; inspect the source corresponding to that line (likely in the dirty-json lexer definition) and replace with a safer pattern.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.build.js:366
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
The extension uses a tool to read formatted text. That tool has a small flaw that could be used to make your browser run slowly or freeze for a moment if someone sends a tricky message. This is annoying but not dangerous, and your data stays safe.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex /[\-0-9]*\.[0-9]*([eE][\+\-]?)?[0-9]*(?:\s*)/ in the dirty-json lexer may exhibit catastrophic backtracking on crafted input. This is a known ReDoS pattern, but the extension processes this input locally from user-provided or model-generated data. The impact is limited to client-side performance degradation, and there is no demonstrated exploit or external attack path that causes concrete harm beyond a temporary UI freeze.
Impact: low · Exploitability: plausible
Developer action: Consider replacing the dirty-json library with a safer alternative or patching the regex to avoid catastrophic backtracking. Alternatively, validate and limit input length before parsing.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.build.js:3341
Expected scanner matches (28)
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The security scanner flagged a line of code that uses a regular expression to find numbers in text, but the pattern is simple and safe. It will not cause the program to slow down or crash, even with unusual input. This is a routine parsing operation for the extension's memory management feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regex `/#(\d+)(?:-(\d+))?/` at line 8650 is a simple pattern matching a hash followed by one or more digits, optionally followed by a hyphen and more digits. It contains no nested quantifiers or alternations that would cause catastrophic backtracking. The JS-X-Ray 'unsafe-regex' rule is a false positive; this regex does not exhibit ReDoS vulnerability. It is used in the `h5` function to parse numeric ordering from user-supplied comment strings, which is a legitimate, proportional operation for this extension's purpose of assigning ordered identifiers to memory entries.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.build.js:8650
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
The scanner raised a warning about a security risk called prototype pollution, but it's a false alarm. The flagged line is in a test that checks if the extension correctly handles a special key name like __proto__ without causing any real security issue.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: Static analysis flagged a prototype-pollution signal at line 112 in a test file. The signal corresponds to a deliberate test that uses __proto__ as a key to verify that the lock functions store and retrieve it as an own property without mutating Object.prototype. The test explicitly uses Object.hasOwn and JSON.stringify to confirm own-property semantics. No actual prototype pollution occurs in production code; the signal is a known false positive for defensive tests handling prototype-like keys.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- characterMemoryBookLocks.test.js:112
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file is a 'built' version of the extension - the developer's source code was processed by a tool to make it smaller and load faster. It looks messy with short variable names, but that's normal for bundled code and not a sign of a hidden danger. The extension does what it says: manage chat memory for roleplay.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The file is a bundled/minified JavaScript output produced by a build tool (Bun build script). The short variable names, WeakMap caching, lazy initialization (`X8`), and CommonJS interop helpers (`U3`, `EH`, `hH`) are standard bundler patterns (e.g., Rollup, Webpack) and not intentional obfuscation. The imports from SillyTavern internal modules (script.js, extensions.js, group-chats.js, world-info.js, etc.) and the logic for scene marking, summary prompts, and lorebook management match the stated project purpose of a memory management extension. No concealed execution, external network calls to unknown destinations, credential handling, or data exfiltration is observed in the supplied code. The JS-X-Ray signal is a false positive due to the minified nature of the built file.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.build.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file looks like normal code that builds settings screens for the extension. It is not hidden or scrambled—just regular templates.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- templates.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file is just a regular part of the Memory Books extension that shows popup windows to confirm actions. The code is clear and easy to read. The security scanner's warning about hidden code was a mistake—the file is not obfuscated or dangerous.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The file is a legitimate UI module for the Memory Books extension. The full source code is clean, readable, and uses standard ES module imports. The scanner flagged 'obfuscated-code' on line 1, but that line is a standard copyright comment. No actual obfuscation, concealed execution, or any malicious pattern is present. The code handles confirmation popups, uses DOMPurify to sanitize HTML content, and performs expected operations like fetching memory data and managing UI state. The scanner signal is a false positive, likely due to a heuristic mismatch.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- confirmationPopup.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file provides translated text for the Memory Books extension's user interface. It loads translation files from the server and contains all the English labels, messages, and tooltips. The code is clear and straightforward, doing exactly what an internationalization file should do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The file file is a localization module for the Memory Books SillyTavern extension. It contains a license header, standard ES module imports, a function to dynamically fetch locale JSON files using fetch() with a relative URL resolved against import.meta.url (a standard pattern for loading local resources in ES modules), and an exported constant object of English UI translation strings. There is no obfuscated code: all source is plain, well-commented JavaScript. The scanner signal for obfuscated code is a false positive, likely triggered by the long string literals or the fetch + relative URL pattern, but the actual code behavior is transparent and proportionate to its stated purpose of providing internationalization. No concealed execution, dynamic code generation, eval, or hidden data flow is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- locales.js:1
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
Memory Books loads and saves its own prompt files from the SillyTavern server using the same secure API that other extensions use. It does not run any code from those files, so there is no hidden way for an attacker to take over your system.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The bundled file contains a fetch call to the same-origin API endpoint `/user/files/${O3}` for loading prompt configuration, and a corresponding fetch POST to `/api/files/upload` for saving. No dynamic code execution sink (eval, Function constructor, innerHTML assignment, or similar) is present anywhere in the provided code. The fetched JSON payload is validated by a schema checker and used only as data for template substitution and UI state; it is never interpreted as code. The scanner correlation between network retrieval and a code execution sink is a false positive—no dangerous data flow exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.build.js:98-670
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
The scanner raised a warning about prototype pollution, but it's a false alarm. The flagged line is in a test that verifies the extension safely reads a special key name that could otherwise be a security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: Static analysis flagged a prototype-pollution signal at line 118 in a test file. This line is part of a deliberate test asserting that getCharacterMemoryBookLock returns the correct value for a __proto__ key stored as an own property. The test verifies that no prototype mutation occurs. The signal is a false positive; the production functions are designed to prevent prototype pollution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- characterMemoryBookLocks.test.js:118
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a test file that checks whether the extension's connection profile system works correctly. The flagged URL is just an example address used for testing. It's never actually visited or used to make a real connection, so there's no security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged URL appears at line 88 in a test assertion comparing expected output from the profile resolver. It is a hardcoded example string used only to verify correct object shape. The test file never makes any network request, and the URL is never passed to a fetch or similar function. No runtime data flow or attacker-controlled input reaches this value.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- customConnectionProfiles.test.js:88
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This alert points to a test that checks the extension safely handles a special name like '__proto__'. It's a safety test, not a vulnerability.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: Scanner signal at line 89 corresponds to a test assertion that verifies the function correctly stores '__proto__' as a serializable own property on characterOverrides. The test uses JSON.parse(JSON.stringify(...)) to confirm round-trip safety. No prototype pollution occurs; this is a deliberate defensive test.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- stloCharacterFilters.test.js:89
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This extension talks to your own SillyTavern server to save and load your prompt settings. It doesn't download or run any code from the internet. The alert was triggered because the same file has both network access and a code-running tool, but they aren't connected—the code-running tool is just leftover from packaging and isn't used.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The extension uses fetch() to load and save user-specific prompt presets from the same SillyTavern server (/user/files and /api/files/upload). The dynamic require proxy is a bundler artifact that never executes fetched data as code. No evidence connects network retrieval to a code execution sink; downloaded JSON is validated and used only for prompt content, which is passed to the LLM request pipeline, not executed as JavaScript.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.build.js:5-6
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This flagged line just saves chat settings to a file. It does not download or run any code from the internet. The security scanner made a mistake here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The flagged line (28) contains only a call to `loadContextSettings()` and a `return JSON.stringify(data, null, 2)`. There is no evidence of any download, shell execution, `eval`, `new Function`, `child_process`, or similar dangerous operation in the supplied code. The scanner rule 'tavernkeeper.download-and-execute.shell-pipeline' produced a false positive; the code performs standard JSON serialization of context settings data.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- production
- Source
- index.build.js.map:28
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This alert is part of the same safety test that verifies the extension handles '__proto__' correctly without causing issues.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: Scanner signal at line 95 corresponds to a second call to applyStloCharacterFilters with ['__proto__'] to test idempotency. No prototype pollution occurs; the test ensures repeated calls do not change behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- stloCharacterFilters.test.js:95
Gitleaks reported generic-api-key
Expected behavior · high confidence
A security scanner incorrectly thought a heading about saving tokens was an API key. The line is just a section title written in Portuguese, not a secret. There is no real issue.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule flagged line 530 of a Portuguese user guide, which contains the heading '## 🙈 Economia de Tokens: Ocultar/Reexibir Mensagens' (English: 'Token Saving: Hide/Unhide Messages'). The matched string was redacted but the visible context shows only an emoji and section title—no API key, secret, or credential. This is a false positive caused by the emoji combination resembling an entropy-based or pattern-based key detection. No credential is present or exposed.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- documentation
- Source
- userguides/old_guides_no_longer_updated/USER_GUIDE-pt-br.md:530
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a harmless regular expression used to read numbers from memory entry titles. It's not a security issue and works as intended.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex /#(\d+)(?:-(\d+))?/ on line 919 is used to extract numbering from lorebook entry titles (e.g., '#01', '#5', '#7-8'). The pattern is simple and contains no nested quantifiers, alternations, or overlapping groups that would cause catastrophic backtracking. Input originates from local lorebook entry comments managed by the user. The scanner flag is a generic false positive for a safe regex. No supply-chain risk or security vulnerability is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- addlore.js:919
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A security scanner thought this file might contain hidden code, but when we look at the actual source, it's just normal, readable JavaScript. The file is part of a well-known extension that manages chat memory. There is no hidden or tricky code here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner flagged line 1 of file for potential obfuscated code, but the provided source shows a clear, readable, and well-structured JavaScript file with standard imports, license headers, and straightforward logic. The file contains Handlebars templates (e.g., `profileEditTemplate`) which can produce long template strings, but no obfuscation, encoded payloads, or concealed execution is present. The scanner confidence was low, and the evidence directly contradicts the signal. The 'obfuscated-code' detection is a false positive likely triggered by the length or complexity of the inline template string.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- profileManager.js:1
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This alert is from a test that checks the extension stores override data for the name '__proto__' correctly. It's a safety check, not a vulnerability.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: Scanner signal at line 85 corresponds to a deepEqual assertion on lorebook.stlo.characterOverrides.__proto__ that verifies the stored object has expected priority and orderAdjustment. This is a test assertion, not an exploitable prototype pollution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- stloCharacterFilters.test.js:85
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This is a harmless setup script that only checks if a pre-commit hook is already in place and tells you about it. It does nothing secret or risky.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The file file is a standard postinstall script for the Memory Books extension. It checks for a .git directory and then verifies whether a pre-commit hook is already installed and matches the bundled source hook. The code uses only standard Node.js APIs (fs, path, url) and console logging. There is no obfuscation evident; the static signal is a false positive likely triggered by the non-standard 'bun' shebang or escape sequences in the console output strings. No network requests, external data sinks, or execution of untrusted content occurs.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- bin/postinstall.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This extension uses pattern matching to replace placeholders like {{title}} in memory entry titles. The patterns come from the user's own settings or are built into the extension, so they aren't a security risk. The security scanner flagged it only because it uses dynamic regular expressions, but since the user controls the patterns, it's safe and expected behavior for this kind of feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regex construction at line 536 is used to replace template placeholders like {{title}} in user-configured title format strings. The patterns are either hardcoded (e.g., from a fixed set of templates) or provided by the user via the extension's settings UI. The regex is built by escaping literal curly braces and does not accept arbitrary untrusted input from external sources. While the code contains multiple regex operations (including in function `lV` that constructs a regex from a title format pattern), the inputs originate from local user configuration or predefined lists, not from external untrusted data. There is no demonstrated path for an attacker to inject a malicious regex pattern or trigger a ReDoS attack that would cause meaningful harm beyond a potential self-induced delay, which is a local quality concern. No evidence of actual exploit or exposure is provided.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.build.js:536
Gitleaks reported generic-api-key
Expected behavior · high confidence
A security scanner flagged a line in a French translation file as a possible password or API key. But that line is just the French translation for 'API Provider' — a UI label. The file doesn't contain any real passwords or keys. This is a harmless false alarm.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The Gitleaks scanner flagged line 602 of the French locale file (fr-fr.json) with a generic-api-key pattern. However, the supplied code context shows that line 602 contains the translation key "STMemoryBooks_APIProvider" with the French label "API/Fournisseur :". The file is a localization JSON containing only UI string mappings for the SillyTavern-MemoryBooks extension. No actual API keys, secrets, or credential values are stored in this file. The scanner likely matched a substring like "Clé API" (French for "API Key") from nearby placeholder strings, which are UI labels, not real credentials. This is a false positive with no security exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- locales/fr-fr.json:602
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a test file that checks whether the extension's connection profile system works correctly. The flagged URL is just an example address used for testing. It's never actually visited or used to make a real connection, so there's no security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged URL appears at line 79 as a mock profile value 'api-url' in a test input object. It is a localhost example used to exercise the profile resolver's handling of keyless custom profiles. No actual HTTP connection is initiated from this file. The URL is static test data with no path to runtime exploitation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- customConnectionProfiles.test.js:79
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This alert is from a test that verifies the extension stores the name '__proto__' as its own property, preventing prototype pollution. It's a safety test, not a vulnerability.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: Scanner signal at line 84 corresponds to an assertion using Object.prototype.hasOwnProperty.call to confirm '__proto__' is stored as an own property on characterOverrides, not polluting the Object prototype. This is a protective test.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- stloCharacterFilters.test.js:84
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The security scanner thought this file might contain hidden or scrambled code, but when we look at the actual code, it's clear and readable. This is likely a mistake by the scanner.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner signal 'obfuscated-code' was triggered on line 1 of file, which is a copyright comment. The file is a well-structured extension entry point with standard imports and functions. No actual obfuscation is present in the supplied source code. The scanner confidence is low, and the signal is likely a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.js:1
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This alert is from a test that checks the extension correctly reports that it added a character with the name '__proto__'. It's a normal test operation.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: Scanner signal at line 93 corresponds to an assertion checking that firstResult.addedNames includes '__proto__'. This is a test validation that the function reports the added name correctly. No runtime exploit path exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- stloCharacterFilters.test.js:93
Gitleaks reported generic-api-key
Expected behavior · medium confidence
A security scanner thought it found a password or secret key in an old help file, but the actual text is just a chapter heading about hiding messages. There is no real secret here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The Gitleaks scanner flagged a generic API key pattern at line 23, but the actual line content in the provided source is a table of contents entry referencing token-saving functionality. The matched value was removed by the scanner's scrubber, and the visible source context contains no credential string, code, or sensitive configuration. The file is an outdated Portuguese-language user guide with no executable logic, API endpoints, or secret storage. The scanner result is a false positive.
Impact: none · Exploitability: unlikely
Developer action: No code change is needed; this is a false positive. If the project maintains a Gitleaks allowlist, consider adding an exception for documentation files to reduce future noise.
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- documentation
- Source
- userguides/old_guides_no_longer_updated/USER_GUIDE-pt-br.md:23
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
The scanner raised a warning about prototype pollution, but it's a false alarm. The flagged line is in a test that checks if the extension correctly uses Object.hasOwn to safely handle a special key name, proving the extension is secure against this risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: Static analysis flagged a prototype-pollution signal at line 113 in a test file. This line is part of a deliberate test asserting Object.hasOwn on a __proto__ key stored in the locks object. The test confirms that the key is an own property, which is the correct defensive behavior to prevent prototype pollution. No vulnerability exists; the signal is a false positive from a test exercising edge-case handling.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- characterMemoryBookLocks.test.js:113
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A security scanner flagged this file as possibly obfuscated, but the actual code is clean and easy to read. There's no hidden or tricky behavior. This is a harmless false alarm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JavaScript-analysis scanner reported a static obfuscation signal (JS-X-Ray rule 'javascript.xray.obfuscated-code') with low confidence. Examination of the supplied source code reveals no obfuscation; the file is clear, readable, contains standard ES module imports, well-named functions, and comments. The signal is a false positive typical of static analysis tools that misclassify dynamic constructs or minified code. No actual obfuscation, concealed execution, or hidden data flow was observed.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- sidePromptsPopup.js:1
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This alert is from a test that intentionally uses '__proto__' as a character name to check the extension handles it safely. It's a safety test, not a vulnerability.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: Scanner signal at line 82 corresponds to the initial call to applyStloCharacterFilters(lorebook, ['__proto__']) within a test. This is a deliberate test invocation to verify safe handling of the '__proto__' key. No prototype pollution occurs.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- stloCharacterFilters.test.js:82