TavernKeeper Scan Report

bmen25124/SillyTavern-WTracker

Commit 8a5e42e Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 49 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

Dependency advisory GHSA-4x5r-pxfx-6jf8 applies

Minor caution · medium confidence

A dependency used by this SillyTavern extension has a known low-severity issue. Because the extension ships only a bundled file to end users and many advisories affect build-time or test-time tools that never reach the user, the practical risk is limited.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4x5r-pxfx-6jf8 to a dependency declared by this repository.

Contextual assessment: The advisory is matched against a dependency declared in package-lock.json. The project ships a webpack bundle (dist/index.js) as a SillyTavern extension; devDependencies and their transitive trees are not included in the shipped artifact. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the extension's limited attack surface (processing LLM-generated tracking data in the browser), concrete user harm is unlikely. The low scanner severity further supports a limited practical impact.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version if one is available; for dev-only dependencies, updating during the next maintenance cycle is sufficient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4x5r-pxfx-6jf8
File role
production
Source
package-lock.json

Dependency advisory GHSA-fv7c-fp4j-7gwp applies

Minor caution · medium confidence

A dependency has a high-severity advisory, but the extension only ships a bundled JavaScript file to users. Build-time and test-time tools are not included in what users run, so the practical danger is low unless the vulnerable package is a production dependency with reachable code.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fv7c-fp4j-7gwp to a dependency declared by this repository.

Contextual assessment: The scanner reports a high-severity advisory for a dependency in the lockfile. The project has only three production dependencies (fast-xml-parser, handlebars, sillytavern-utils-lib) and numerous devDependencies (babel, jest, webpack, sass, etc.). The shipped artifact is a webpack bundle; devDependencies and their transitive dependencies do not ship to end users. Without a confirmed package mapping showing the advisory affects a production dependency with runtime-reachable vulnerable code, and given the browser-extension context with limited attack surface, the practical impact is low. The high scanner severity alone does not establish immediate danger.

Impact: low · Exploitability: unlikely

Developer action: Identify which package this advisory maps to. If it is a production dependency, verify whether the vulnerable code path is reachable in the extension's bundled output and update to a patched version. If it is a devDependency, update during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fv7c-fp4j-7gwp
File role
production
Source
package-lock.json

Dependency advisory GHSA-mh29-5h37-fv8m applies

Minor caution · medium confidence

A dependency has a known medium-severity issue. Since the extension ships only a bundled file and many advisories affect build-time tools that never reach the user, the practical risk is limited.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh29-5h37-fv8m to a dependency declared by this repository.

Contextual assessment: The advisory is matched against a dependency in package-lock.json. The extension ships a webpack bundle to end users; devDependencies are not included. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the extension's limited browser-context attack surface, concrete user harm is unlikely.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-mh29-5h37-fv8m
File role
production
Source
package-lock.json

Dependency advisory GHSA-jp2q-39xq-3w4g applies

Minor caution · medium confidence

A dependency has a known medium-severity issue. The extension ships only a bundled file to users, so build-time tools do not reach end users and the practical risk is limited.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-jp2q-39xq-3w4g to a dependency declared by this repository.

Contextual assessment: The advisory is matched against a dependency in package-lock.json. The extension ships a webpack bundle; devDependencies and their transitive trees are not included in the shipped artifact. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the browser-extension context, concrete user harm is unlikely.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-jp2q-39xq-3w4g
File role
production
Source
package-lock.json

Dependency advisory GHSA-7rx3-28cr-v5wh applies

Minor caution · medium confidence

A dependency has a known medium-severity issue. The extension ships only a bundled file to users, so build-time tools do not reach end users and the practical risk is limited.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7rx3-28cr-v5wh to a dependency declared by this repository.

Contextual assessment: The advisory is matched against a dependency in package-lock.json. The extension ships a webpack bundle; devDependencies and their transitive trees are not included in the shipped artifact. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the browser-extension context, concrete user harm is unlikely.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-7rx3-28cr-v5wh
File role
production
Source
package-lock.json

Dependency advisory GHSA-qj8w-gfj5-8c6v applies

Minor caution · medium confidence

A dependency has a known medium-severity issue. The extension ships only a bundled file to users, so build-time tools do not reach end users and the practical risk is limited.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-qj8w-gfj5-8c6v to a dependency declared by this repository.

Contextual assessment: The advisory is matched against a dependency in package-lock.json. The extension ships a webpack bundle; devDependencies and their transitive trees are not included in the shipped artifact. Without a confirmed mapping to a production dependency with runtime-reachable vulnerable code, and given the browser-extension context, concrete user harm is unlikely.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-qj8w-gfj5-8c6v
File role
production
Source
package-lock.json

Dependency advisory GHSA-jmr7-xgp7-cmfj applies

Minor caution · medium confidence

A dependency has a high-severity advisory, but the extension only ships a bundled JavaScript file to users. Build-time and test-time tools are not included in what users run, so the practical danger is low unless the vulnerable package is a production dependency with reachable code.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-jmr7-xgp7-cmfj to a dependency declared by this repository.

Contextual assessment: The scanner reports a high-severity advisory for a dependency in the lockfile. The project has only three production dependencies and numerous devDependencies. The shipped artifact is a webpack bundle; devDependencies and their transitive dependencies do not ship to end users. Without a confirmed package mapping showing the advisory affects a production dependency with runtime-reachable vulnerable code, and given the browser-extension context with limited attack surface, the practical impact is low. The high scanner severity alone does not establish immediate danger.

Impact: low · Exploitability: unlikely

Developer action: Identify which package this advisory maps to. If it is a production dependency, verify whether the vulnerable code path is reachable in the extension's bundled output and update to a patched version. If it is a devDependency, update during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-jmr7-xgp7-cmfj
File role
production
Source
package-lock.json

Dependency advisory GHSA-8gc5-j5rx-235r applies

Minor caution · medium confidence

A dependency has a high-severity advisory, but the extension only ships a bundled JavaScript file to users. Build-time and test-time tools are not included in what users run, so the practical danger is low unless the vulnerable package is a production dependency with reachable code.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8gc5-j5rx-235r to a dependency declared by this repository.

Contextual assessment: The scanner reports a high-severity advisory for a dependency in the lockfile. The project has only three production dependencies and numerous devDependencies. The shipped artifact is a webpack bundle; devDependencies and their transitive dependencies do not ship to end users. Without a confirmed package mapping showing the advisory affects a production dependency with runtime-reachable vulnerable code, and given the browser-extension context with limited attack surface, the practical impact is low. The high scanner severity alone does not establish immediate danger.

Impact: low · Exploitability: unlikely

Developer action: Identify which package this advisory maps to. If it is a production dependency, verify whether the vulnerable code path is reachable in the extension's bundled output and update to a patched version. If it is a devDependency, update during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8gc5-j5rx-235r
File role
production
Source
package-lock.json

Dependency advisory GHSA-5c6j-r48x-rmvq applies

Minor caution · medium confidence

A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5c6j-r48x-rmvq to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.

Impact: low · Exploitability: unlikely

Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.

Scanner
osv-scanner 2.4.0
Rule
GHSA-5c6j-r48x-rmvq
File role
production
Source
package-lock.json

Dependency advisory GHSA-9cx6-37pm-9jff applies

Minor caution · medium confidence

A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-9cx6-37pm-9jff to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.

Impact: low · Exploitability: unlikely

Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.

Scanner
osv-scanner 2.4.0
Rule
GHSA-9cx6-37pm-9jff
File role
production
Source
package-lock.json

Dependency advisory GHSA-37qj-frw5-hhjh applies

Minor caution · medium confidence

A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-37qj-frw5-hhjh to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.

Impact: low · Exploitability: unlikely

Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.

Scanner
osv-scanner 2.4.0
Rule
GHSA-37qj-frw5-hhjh
File role
production
Source
package-lock.json

Dependency advisory GHSA-v2hh-gcrm-f6hx applies

Minor caution · medium confidence

A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.

Impact: low · Exploitability: unlikely

Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v2hh-gcrm-f6hx
File role
production
Source
package-lock.json

Dependency advisory GHSA-m7jm-9gc2-mpf2 applies

Minor caution · medium confidence

A serious known security issue was found in one of the tools used to build this extension. Even though the issue is rated critical, the extension only ships the finished build output and not the building tools, so this most likely does not affect people who install and use the extension. The developer should still update the affected tool to be safe.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-m7jm-9gc2-mpf2 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a critical-severity advisory in the lockfile. Despite the critical scanner rating, the lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users. The critical rating reflects the advisory's worst-case severity, not the actual exposure in this project's deployment model.

Impact: low · Exploitability: unlikely

Developer action: Update dev dependencies to their latest versions to clear the advisory. Even though it likely does not affect the shipped extension, resolving a critical advisory in the development environment is good practice.

Scanner
osv-scanner 2.4.0
Rule
GHSA-m7jm-9gc2-mpf2
File role
production
Source
package-lock.json

Dependency advisory GHSA-2g4f-4pwh-qvx6 applies

Minor caution · medium confidence

A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2g4f-4pwh-qvx6 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.

Impact: low · Exploitability: unlikely

Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.

Scanner
osv-scanner 2.4.0
Rule
GHSA-2g4f-4pwh-qvx6
File role
production
Source
package-lock.json

Dependency advisory GHSA-v39h-62p7-jpjc applies

Minor caution · medium confidence

A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v39h-62p7-jpjc to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.

Impact: low · Exploitability: unlikely

Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v39h-62p7-jpjc
File role
production
Source
package-lock.json

Dependency advisory GHSA-h67p-54hq-rp68 applies

Minor caution · medium confidence

A known security issue was found in one of the tools used to build this extension. Since the extension only ships the finished build output and not the building tools themselves, this issue most likely does not affect people who install and use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-h67p-54hq-rp68 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory in the lockfile. The lockfile is dominated by devDependencies (babel, jest, webpack, sass, typescript) used only for building the extension. The shipped extension consists of built artifacts (dist/index.js, dist/style.css per manifest.json), not the full dependency tree. Production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. Without the specific package name from the scanner, exact runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a build-time dependency that does not ship to end users.

Impact: low · Exploitability: unlikely

Developer action: Update dev dependencies to their latest versions to clear the advisory and keep the development environment current.

Scanner
osv-scanner 2.4.0
Rule
GHSA-h67p-54hq-rp68
File role
production
Source
package-lock.json

Dependency advisory GHSA-q3j6-qgpj-74h6 applies

Minor caution · low confidence

A security scanner flagged an outdated package in the project's dependency list. However, the extension ships a pre-built file and the flagged package is most likely a development tool that never runs on users' machines.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-q3j6-qgpj-74h6 to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in the lockfile. The project has only three production dependencies (fast-xml-parser 5.2.5+, handlebars 4.7.8, sillytavern-utils-lib 1.0.64+), all at recent patched versions. The extensive devDependencies (babel, jest, webpack, sass, prettier, typescript, loaders) are build-time only and do not ship to end users. The extension loads pre-built dist/index.js per the manifest. Without the specific lockfile entry showing which package is affected, the advisory most likely targets a build-toolchain transitive dependency that never executes in the production extension runtime.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.

Scanner
osv-scanner 2.4.0
Rule
GHSA-q3j6-qgpj-74h6
File role
production
Source
package-lock.json

Dependency advisory GHSA-wf6x-7x77-mvgw applies

Minor caution · low confidence

A security scanner found a vulnerable package version in the project's dependencies. Since the extension is pre-built and the flagged dependency is likely a development-only tool, it probably does not affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-wf6x-7x77-mvgw to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in the lockfile. The project's production dependencies are minimal and at current versions. The large devDependency tree (webpack, babel, jest, sass, typescript ecosystem) is used only for building dist/index.js. The extension manifest references pre-built artifacts, so build-toolchain dependencies and their transitive advisories do not reach end-user runtime.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.

Scanner
osv-scanner 2.4.0
Rule
GHSA-wf6x-7x77-mvgw
File role
production
Source
package-lock.json

Dependency advisory GHSA-gh4j-gqv2-49f6 applies

Minor caution · low confidence

A scanner flagged a moderately vulnerable package. It is most likely a development tool that does not run when the extension is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-gh4j-gqv2-49f6 to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory matches a dependency in the lockfile. Given the project's architecture—three recent production dependencies bundled via webpack into dist/index.js, with all build tooling as devDependencies—the affected package is most likely in the development toolchain and not shipped to end users. The scanner's medium severity reflects the advisory's theoretical impact, not runtime reachability in this extension.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.

Scanner
osv-scanner 2.4.0
Rule
GHSA-gh4j-gqv2-49f6
File role
production
Source
package-lock.json

Dependency advisory GHSA-23c5-xmqv-rm74 applies

Minor caution · low confidence

A scanner found a vulnerable package version. The flagged package is probably a development tool that never runs for end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74 to a dependency declared by this repository.

Contextual assessment: This advisory matches a lockfile dependency. The project ships pre-built dist/index.js; the development dependencies used to build it (babel, webpack, jest, sass, etc.) are not loaded at runtime by SillyTavern. Production dependencies (fast-xml-parser, handlebars, sillytavern-utils-lib) are at recent patched versions, making it likely this advisory targets a build-tool transitive dependency.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.

Scanner
osv-scanner 2.4.0
Rule
GHSA-23c5-xmqv-rm74
File role
production
Source
package-lock.json

Dependency advisory GHSA-3jxr-9vmj-r5cp applies

Minor caution · low confidence

A scanner flagged a vulnerable package. Since the extension uses pre-built files, this dependency likely only runs during development and does not affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.

Contextual assessment: This advisory matches a lockfile dependency. The extension manifest loads dist/index.js and dist/style.css, which are pre-built artifacts. The substantial devDependency tree is only used during the build process and does not execute on end-user machines. The three production dependencies are at current versions. Without the specific lockfile entry, the advisory most likely targets a build-time transitive dependency with no production runtime reach.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3jxr-9vmj-r5cp
File role
production
Source
package-lock.json

Dependency advisory GHSA-2w6w-674q-4c4q applies

Minor caution · low confidence

A scanner found a critically-rated vulnerable package. However, the extension ships pre-built files, and this package is most likely a development tool that never runs for users. The critical rating reflects the package's theoretical risk, not actual exposure in this extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2w6w-674q-4c4q to a dependency declared by this repository.

Contextual assessment: This critical-severity advisory matches a lockfile dependency. Despite the critical advisory rating, the specific affected package and its locked version are not shown. The project's production dependencies are minimal and recent. The extension ships pre-built dist/index.js, meaning the extensive build toolchain (babel, jest, webpack, sass, typescript ecosystem) does not execute on end-user machines. Critical advisories in npm ecosystems frequently target build-time or dev-time packages (e.g., arbitrary file operations during install or ReDoS in development servers) that are not reachable in a bundled browser extension. Without the specific package identity and its production reachability, the advisory's theoretical severity does not translate to demonstrated user harm in this extension context.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific package from this advisory, confirm whether it is a dev or production dependency, and update it. If it is a production dependency bundled into dist/index.js, verify that the vulnerable code path is reachable and patch immediately.

Scanner
osv-scanner 2.4.0
Rule
GHSA-2w6w-674q-4c4q
File role
production
Source
package-lock.json

Dependency advisory GHSA-xjpj-3mr7-gcpf applies

Minor caution · low confidence

A scanner flagged a vulnerable package version. The flagged package is probably a development tool that does not run when users use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xjpj-3mr7-gcpf to a dependency declared by this repository.

Contextual assessment: This advisory matches a lockfile dependency. The project's architecture bundles production code into dist/index.js via webpack, and the manifest references that pre-built artifact. Development dependencies do not ship to users. The three production dependencies are at current patched versions, so this advisory most likely targets a transitive build-time dependency.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.

Scanner
osv-scanner 2.4.0
Rule
GHSA-xjpj-3mr7-gcpf
File role
production
Source
package-lock.json

Dependency advisory GHSA-v56q-mh7h-f735 applies

Minor caution · low confidence

A scanner found a vulnerable package version in the dependency list. Since the extension ships pre-built files, this is likely a development-only dependency that does not affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v56q-mh7h-f735 to a dependency declared by this repository.

Contextual assessment: This advisory matches a lockfile dependency. The extension loads pre-built dist/index.js per its manifest. The development toolchain (babel, jest, webpack, sass, typescript, loaders) is used only during the build process and does not execute at runtime for end users. Production dependencies are minimal and at recent versions. Without the specific lockfile entry, this advisory most likely targets a build-time dependency.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit and update flagged dependencies to patched versions as routine hygiene.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v56q-mh7h-f735
File role
production
Source
package-lock.json

Dependency advisory GHSA-7p8r-x3mc-p8w7 applies

Minor caution · medium confidence

A scanner flagged an outdated development tool package. Because this is a browser extension, the flagged tool is used only to build the code on the developer's machine and is not included in what users install, so it does not create a direct danger for extension users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency declared in this lockfile. The project is a SillyTavern browser extension whose shipped artifact is a webpack bundle (dist/index.js). The root package declares only fast-xml-parser, handlebars, and sillytavern-utils-lib as production dependencies; all babel, jest, webpack, sass, and typescript packages are devDependencies used during build. The advisory most likely targets a dev-only or transitive build-tool package that does not ship to end users and has no runtime reachability in the deployed extension. No attacker-controlled input reaches build-time tooling during normal use.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version when convenient to keep the build environment current.

Scanner
osv-scanner 2.4.0
Rule
GHSA-7p8r-x3mc-p8w7
File role
production
Source
package-lock.json

Dependency advisory GHSA-7r86-cg39-jmmj applies

Minor caution · medium confidence

A scanner flagged an outdated development or build tool. Since it is not part of the installed extension, it does not directly endanger users of the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The project ships a webpack bundle to SillyTavern users; build and test tooling (babel, jest, webpack, sass, typescript) are devDependencies that are not bundled into the runtime extension. The advisory likely targets a build-tool or transitive dev package without runtime reachability in the deployed artifact. No untrusted user input flows into these tools at runtime.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-7r86-cg39-jmmj
File role
production
Source
package-lock.json

Dependency advisory GHSA-6g55-p6wh-862q applies

Minor caution · medium confidence

A scanner flagged an outdated development tool. It is used only during the build process and is not included in the extension users install, so it poses no direct risk to them.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-6g55-p6wh-862q to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The extension's production dependencies are limited to fast-xml-parser, handlebars, and sillytavern-utils-lib; the remaining packages visible in the lockfile are devDependencies for building and testing. The advisory most likely corresponds to a dev-only package that is not shipped to end users and has no runtime path in the deployed browser extension.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-6g55-p6wh-862q
File role
production
Source
package-lock.json

Dependency advisory GHSA-8fgc-7cc6-rx7x applies

Minor caution · medium confidence

A scanner flagged a minor issue in a development tool. It is not part of the installed extension and the severity is low, so it does not create a meaningful risk for users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8fgc-7cc6-rx7x to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in this lockfile. Given the project structure, the flagged package is most likely a dev or build dependency not present in the shipped webpack bundle. Low advisory severity and the absence of runtime reachability in the deployed extension limit user impact.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8fgc-7cc6-rx7x
File role
production
Source
package-lock.json

Dependency advisory GHSA-r28c-9q8g-f849 applies

Minor caution · medium confidence

A scanner flagged an outdated build or test tool. Because it is not included in the extension that users install, it does not directly threaten them.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The project is a browser extension that ships a webpack bundle; the lockfile shows extensive babel, jest, and webpack devDependencies that do not ship to end users. The advisory most likely targets a build-tool or transitive dev package without runtime reachability in the deployed extension.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r28c-9q8g-f849
File role
production
Source
package-lock.json

Dependency advisory GHSA-xhpv-hc6g-r9c6 applies

Minor caution · medium confidence

A scanner flagged an outdated development tool. It is used only to build the extension and is not shipped to users, so it does not create a direct risk.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xhpv-hc6g-r9c6 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The extension's runtime artifact is a webpack bundle built from a small set of production dependencies; the lockfile is dominated by devDependencies for babel, jest, webpack, sass, and typescript. The advisory most likely corresponds to a dev-only package that is not bundled into the shipped extension and has no runtime exposure to untrusted input.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-xhpv-hc6g-r9c6
File role
production
Source
package-lock.json

Dependency advisory GHSA-xvcm-6775-5m9r applies

Minor caution · medium confidence

A scanner flagged an outdated build or test tool. Since it is not part of the installed extension, it does not directly endanger users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xvcm-6775-5m9r to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lockfile. The project ships a webpack bundle to SillyTavern users; build and test tooling are devDependencies not included in the runtime extension. The advisory most likely targets a build-tool or transitive dev package without runtime reachability in the deployed artifact.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-xvcm-6775-5m9r
File role
production
Source
package-lock.json

Dependency advisory GHSA-3v7f-55p6-f55p applies

Minor caution · medium confidence

A scanner flagged a medium-severity issue in a development tool. It is not part of the extension users install, so it does not create a meaningful risk for them.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lockfile. Given the project structure, the flagged package is most likely a dev or build dependency not present in the shipped webpack bundle. The advisory has no runtime reachability in the deployed browser extension and no attacker-controlled input reaches the relevant code at runtime.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3v7f-55p6-f55p
File role
production
Source
package-lock.json

Dependency advisory GHSA-3mfm-83xf-c92r applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package listed in the project's dependency lockfile. This package is most likely a build tool used only during development, not something included in the extension that users actually run. The vulnerability does not appear to affect the shipped extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3mfm-83xf-c92r to a dependency declared by this repository.

Contextual assessment: This advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact to SillyTavern users; node_modules are not distributed. The visible lockfile portion shows the dependency tree is dominated by build-time devDependencies (babel, webpack, jest, sass, typescript). The three production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not correspond to a known advisory for any of those packages. The advisory most likely targets a transitive dev dependency used only during build. The vulnerable code would not be present in the shipped browser extension bundle, and no attacker-controlled input reaches build-time tooling at runtime.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a fixed version as dependency hygiene, but no urgent action is needed for the shipped extension.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3mfm-83xf-c92r
File role
production
Source
package-lock.json

Dependency advisory GHSA-4c8g-83qw-93j6 applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool that is not included in the extension users run, so the vulnerability does not affect the shipped product.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6 to a dependency declared by this repository.

Contextual assessment: This advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact; node_modules are not distributed to end users. The visible lockfile shows the tree is dominated by devDependencies for build tooling. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not match a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency. The vulnerable code path would not be included in the browser extension bundle, and no runtime attacker input reaches build-time tooling.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4c8g-83qw-93j6
File role
production
Source
package-lock.json

Dependency advisory GHSA-f886-m6hf-6m8v applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool not included in the extension users run, so the vulnerability does not affect the shipped product.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js to SillyTavern users; node_modules are not distributed. The visible lockfile shows the tree is dominated by build-time devDependencies. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not correspond to a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency whose vulnerable code is not present in the shipped browser extension bundle.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.

Scanner
osv-scanner 2.4.0
Rule
GHSA-f886-m6hf-6m8v
File role
production
Source
package-lock.json

Dependency advisory GHSA-fj3w-jwp8-x2g3 applies

Minor caution · medium confidence

A security scanner found a low-severity vulnerability in a package in the project's dependency list. This package is most likely a development-only tool not included in the extension users run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fj3w-jwp8-x2g3 to a dependency declared by this repository.

Contextual assessment: This low-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact; node_modules are not distributed. The visible lockfile shows the tree is dominated by build-time devDependencies. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not match a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency not present in the shipped browser extension bundle.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fj3w-jwp8-x2g3
File role
production
Source
package-lock.json

Dependency advisory GHSA-qx2v-qp2m-jg93 applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool not included in the extension users run, so the vulnerability does not affect the shipped product.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-qx2v-qp2m-jg93 to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js to SillyTavern users; node_modules are not distributed. The visible lockfile shows the tree is dominated by build-time devDependencies. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not correspond to a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency whose vulnerable code is not present in the shipped browser extension bundle.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.

Scanner
osv-scanner 2.4.0
Rule
GHSA-qx2v-qp2m-jg93
File role
production
Source
package-lock.json

Dependency advisory GHSA-52cp-r559-cp3m applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool that is not included in the extension users run, so the vulnerability does not affect the shipped product.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m to a dependency declared by this repository.

Contextual assessment: This high-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact; node_modules are not distributed to end users. The visible lockfile shows the tree is dominated by devDependencies for build tooling. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not match a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency. The vulnerable code path would not be included in the browser extension bundle, and no runtime attacker input reaches build-time tooling.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.

Scanner
osv-scanner 2.4.0
Rule
GHSA-52cp-r559-cp3m
File role
production
Source
package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool not included in the extension users run, so the vulnerability does not affect the shipped product.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js to SillyTavern users; node_modules are not distributed. The visible lockfile shows the tree is dominated by build-time devDependencies. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not correspond to a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency whose vulnerable code is not present in the shipped browser extension bundle.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
package-lock.json

Dependency advisory GHSA-3ppc-4f35-3m26 applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package in the project's dependency list. This package is most likely a development-only tool that is not included in the extension users run, so the vulnerability does not affect the shipped product.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26 to a dependency declared by this repository.

Contextual assessment: This high-severity advisory is matched against a dependency in the package-lock.json. The project ships a webpack-bundled dist/index.js artifact; node_modules are not distributed to end users. The visible lockfile shows the tree is dominated by devDependencies for build tooling. The production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib, and this advisory ID does not match a known advisory for those packages. The flagged dependency is most likely a transitive dev dependency. The vulnerable code path would not be included in the browser extension bundle, and no runtime attacker input reaches build-time tooling.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it as dependency hygiene, but no urgent action is needed for the shipped extension.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3ppc-4f35-3m26
File role
production
Source
package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg applies

Minor caution · medium confidence

This flagged dependency is part of the development tooling used to build the extension, not something included in the extension that users install. The vulnerable code never runs when the extension is used in SillyTavern. Updating the dependency is good hygiene for the developer but poses no direct risk to users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: This advisory corresponds to a transitive dependency resolved in the lockfile. The project's three production dependencies (fast-xml-parser 5.x, handlebars 4.7.8, sillytavern-utils-lib 1.x) are at current versions with no known matching advisories. The advisory is therefore almost certainly for a dev/build tool dependency (babel, webpack, jest, sass, or their transitive packages). The extension ships a bundled dist/index.js; dev dependencies are not included in the shipped artifact and have no runtime reachability for end users. Attacker-controlled input cannot reach the vulnerable code during extension execution. The only theoretical concern is build-time supply-chain risk to the developer, which requires a separate compromise vector.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient to keep the build environment current.

Scanner
osv-scanner 2.4.0
Rule
GHSA-mh99-v99m-4gvg
File role
production
Source
package-lock.json

Dependency advisory GHSA-442j-39wm-28r2 applies

Minor caution · medium confidence

This is a low-severity issue in a development-only dependency that is not included in the extension users install. It does not affect the running extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-442j-39wm-28r2 to a dependency declared by this repository.

Contextual assessment: This low-severity advisory matches a dependency in the lockfile. The project's production dependencies are at versions with no known advisories, so this match is for a dev or build transitive dependency. The extension is distributed as a bundled artifact, meaning dev dependencies do not ship to end users and the vulnerable code has no runtime reachability in the installed extension. No attacker-controlled input reaches the vulnerable code during extension operation.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-442j-39wm-28r2
File role
production
Source
package-lock.json

Dependency advisory GHSA-c2c7-rcm5-vvqj applies

Minor caution · medium confidence

Although this advisory is rated high severity, the vulnerable package is part of the development tooling and is not included in the extension that users install. The vulnerable code never runs during normal use of the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj to a dependency declared by this repository.

Contextual assessment: This high-severity advisory is matched against a lockfile dependency. The project's production dependencies (fast-xml-parser, handlebars, sillytavern-utils-lib) are at current patched versions with no matching advisories. The advisory therefore targets a dev/build transitive dependency. The shipped extension is a webpack bundle that excludes dev dependencies, so the vulnerable code has no runtime reachability for end users. Build-time exploitation would require a separate attacker capability to inject malicious input into the developer's build process.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version to maintain a clean build environment.

Scanner
osv-scanner 2.4.0
Rule
GHSA-c2c7-rcm5-vvqj
File role
production
Source
package-lock.json

Dependency advisory GHSA-2qvq-rjwj-gvw9 applies

Minor caution · medium confidence

This is a medium-severity issue in a development-only dependency that does not ship with the extension. It does not affect users of the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2qvq-rjwj-gvw9 to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory matches a lockfile dependency. The production dependencies are at safe current versions, so this advisory is for a dev or build transitive dependency. The extension ships as a bundle without dev dependencies, giving the vulnerable code no runtime reachability in the installed extension. No attacker-controlled input reaches the vulnerable code during extension execution.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-2qvq-rjwj-gvw9
File role
production
Source
package-lock.json

Dependency advisory GHSA-38r7-794h-5758 applies

Minor caution · medium confidence

This is a low-severity issue in a development-only dependency that is not included in the extension users install.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-38r7-794h-5758 to a dependency declared by this repository.

Contextual assessment: This low-severity advisory matches a lockfile dependency. The project's production dependencies are at current versions with no matching advisories, so this is a dev or build transitive dependency. The shipped bundle excludes dev dependencies, so the vulnerable code has no runtime reachability for end users.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-38r7-794h-5758
File role
production
Source
package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895 applies

Minor caution · medium confidence

Although rated high severity, the vulnerable package is part of the development tooling and is not shipped with the extension. The vulnerable code does not run when the extension is used in SillyTavern.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: This high-severity advisory is matched against a lockfile dependency. The production dependencies (fast-xml-parser 5.x, handlebars 4.7.8, sillytavern-utils-lib 1.x) are at current versions with no known matching advisories, so this advisory targets a dev or build transitive dependency. The extension is distributed as a webpack bundle that does not include dev dependencies, so the vulnerable code has no runtime reachability for end users. Exploitation would require attacker control over the developer's build environment.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version to keep the build environment secure.

Scanner
osv-scanner 2.4.0
Rule
GHSA-rgw5-rvv9-x895
File role
production
Source
package-lock.json
Expected scanner matches (0)

None.

Related contextual observations

Advisory-to-package mapping is unavailable, limiting runtime reachability assessment

low risk · medium confidence

All eight advisories were found in the lockfile, but the scanner output removed the affected package names. The extension ships only a bundled file, so many advisories likely affect build-time tools that never reach users. Confirming which advisories map to production dependencies would improve confidence.

Technical assessment

The scanner candidates do not include the affected package names, preventing definitive mapping of each advisory to a production or dev dependency. The project has three production dependencies (fast-xml-parser, handlebars, sillytavern-utils-lib) and many devDependencies (babel, jest, webpack, sass, etc.). The shipped artifact is a webpack bundle, so devDependencies do not reach end users. Running an audit with package names visible would clarify which advisories require urgent attention versus routine updates.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit with package names visible to distinguish production-path advisories from dev-only advisories, then prioritize updates accordingly.

Sources:

All eight dependency advisories likely target build-time dev dependencies not shipped to users

low risk · medium confidence

All eight scanner findings appear to be vulnerabilities in development tools used to build the extension, not in the extension code that users actually run. The extension is compiled into a single bundled file before distribution, so these development dependencies are not included when users install the extension. Updating them is good practice but not urgent for user safety.

Technical assessment

The project is a SillyTavern extension that ships a webpack-bundled dist/index.js and dist/style.css. The file includes both production and dev dependencies, but the visible portion shows the tree is dominated by build-time devDependencies (babel, webpack, jest, sass, typescript) all marked dev true. The three production dependencies are fast-xml-parser, handlebars, and sillytavern-utils-lib. None of the eight advisory IDs correspond to known advisories for those three production packages. The advisories most likely target transitive dev dependencies such as tar, cross-spawn, tough-cookie, or word-wrap that are commonly flagged in Node.js build tool trees. These packages perform Node.js-specific operations (file system manipulation, process spawning) that are not reachable in a browser extension context, and the code is not included in the webpack bundle shipped to users. The scanner removed package details, so exact package identification is not possible from the supplied evidence, but the overall project structure strongly indicates these are build-time hygiene issues rather than runtime exploitable vulnerabilities.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to confirm which packages are flagged and update them to fixed versions as dependency hygiene. Consider running npm audit --omit=dev to focus on production dependency issues that could affect the shipped extension.

Sources:

All six advisories appear to target dev or build transitive dependencies, not shipped production code

low risk · medium confidence

All six flagged dependencies appear to be development tools used to build the extension, not parts of the extension itself. Since the extension is distributed as a pre-built bundle, these development dependencies are not installed or run by users. Updating them is good practice for the developer but does not change the security of the installed extension.

Technical assessment

The project declares three production dependencies (fast-xml-parser 5.2.5, handlebars 4.7.8, sillytavern-utils-lib 1.0.64), all at current versions with no known matching advisories. The dev dependency tree includes babel, webpack, jest, sass, and their transitive packages, which are common sources of advisory matches. The manifest confirms the extension ships dist/index.js and dist/style.css as bundled artifacts, meaning dev dependencies are excluded from the installed extension. None of the six advisories can be confidently mapped to a production dependency, and the vulnerable code in dev dependencies has no runtime reachability for end users. A periodic dev dependency refresh would reduce build-time supply-chain surface.

Impact: low · Exploitability: unlikely

Developer action: Run a periodic dev dependency audit and update outdated build packages to reduce build-time supply-chain risk.

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity