TavernKeeper Scan Report

kangjoseph90/Risu-Antigravity

Commit 3f77962 Reviewed Aug 11, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 31 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

Gitleaks reported generic-api-key

Minor caution · high confidence

A Google client secret is written in the code. While not a major risk, it's not ideal. An attacker who sees the code could get it.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: Another version of the OAuth client secret is hardcoded at line 18. Same weakness as in the other auth file: for a public client this secret is not a strong credential, but embedding it reduces security hygiene.

Impact: low · Exploitability: plausible

Developer action: Consider using PKCE flow without client secret or making it configurable.

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: production
Source: src/auth/index.ts:18

Gitleaks reported generic-api-key

Minor caution · high confidence

The plugin has a 'client secret' written directly in its code. This is normal for this type of app, but it's not the most secure practice. An attacker could see it if they read the source.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The Google OAuth client secret is hardcoded in the source file at line 17. For public clients like this plugin, the secret is considered inherent to the application and is not a traditional secret, but embedding it still reduces the ability to rotate or manage it securely. An attacker with source code access can obtain it; however, its disclosure alone does not enable token theft without additional user interaction.

Impact: low · Exploitability: plausible

Developer action: Consider using PKCE flow without a client secret (recommended for public clients) or making the secret configurable via environment or user input.

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: production
Source: src/auth/index.ts:17

Gitleaks reported generic-api-key

Minor caution · high confidence

The plugin includes a secret key that should be kept private, but it is visible to anyone who uses the plugin. This secret could be abused to pretend to be the plugin in Google's authentication system.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The file file contains a hardcoded Google OAuth2 client secret (CLIENT_SECRET). In a client-side plugin distributed to users, any consumer can extract this secret from the shipped code. While OAuth2 with PKCE is used, exposing the client secret violates the OAuth2 security model for confidential clients and could enable impersonation of the application if combined with a valid authorization code or refresh token. The secret should never be embedded in client-side code.

Impact: low · Exploitability: plausible

Developer action: Remove the hardcoded client secret and use a backend proxy or a different authentication flow where the secret is not exposed to users. Consider using Google's OAuth2 for installed apps with PKCE without a client secret.

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: production
Source: src/auth/index.ts:17

Contextual expected matches (28)

Dependency advisory GHSA-qx2v-qp2m-jg93:pkg:d0433ccd51b55fc561da06bf applies

Expected behavior · high confidence

This is a development tool vulnerability that does not affect the plugin when it runs.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-qx2v-qp2m-jg93:pkg:d0433ccd51b55fc561da06bf to a dependency declared by this repository.

Contextual assessment: The vulnerable package postcss@8.5.6 is a development dependency used only during build. It is not included in the shipped plugin bundle, so the advisory has no runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-qx2v-qp2m-jg93:pkg:d0433ccd51b55fc561da06bf
File role: production
Source: package-lock.json

Dependency advisory GHSA-v6wh-96g9-6wx3:pkg:c56121eae41b737e771f5dfe applies

Expected behavior · high confidence

This is a build tool vulnerability that does not affect the plugin when it runs.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3:pkg:c56121eae41b737e771f5dfe to a dependency declared by this repository.

Contextual assessment: The vulnerable package vite@5.4.21 is a development dependency used only during build. It is not part of the shipped plugin, so the advisory has no runtime exposure.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-v6wh-96g9-6wx3:pkg:c56121eae41b737e771f5dfe
File role: production
Source: package-lock.json

Dependency advisory GHSA-rcqx-6q8c-2c42:pkg:4924d19c912a418685c50f04 applies

Expected behavior · high confidence

A potential vulnerability exists in a library the plugin uses, but there is no evidence it can be exploited here.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rcqx-6q8c-2c42:pkg:4924d19c912a418685c50f04 to a dependency declared by this repository.

Contextual assessment: The vulnerable package svelte@4.2.20 is a runtime dependency, but the supplied evidence does not demonstrate a reachable code path with attacker-controlled input to the vulnerable component. The advisory severity is medium and no concrete user harm is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-rcqx-6q8c-2c42:pkg:4924d19c912a418685c50f04
File role: production
Source: package-lock.json

Dependency advisory GHSA-phwv-c562-gvmh:pkg:6451c23f0d1c43292c602111 applies

Expected behavior · high confidence

A potential vulnerability exists in a library the plugin uses, but there is no evidence it can be exploited here.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-phwv-c562-gvmh:pkg:6451c23f0d1c43292c602111 to a dependency declared by this repository.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-phwv-c562-gvmh:pkg:6451c23f0d1c43292c602111
File role: production
Source: package-lock.json

Dependency advisory GHSA-23c5-xmqv-rm74:pkg:732c7481baa8e54386dfde00 applies

Expected behavior · high confidence

This is a development tool dependency that does not affect the plugin when it runs.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74:pkg:732c7481baa8e54386dfde00 to a dependency declared by this repository.

Contextual assessment: The vulnerable package minimatch@9.0.5 is a transitive dependency of devDependency tailwindcss. It is used only during build and is not present in the shipped plugin.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-23c5-xmqv-rm74:pkg:732c7481baa8e54386dfde00
File role: production
Source: package-lock.json

Dependency advisory GHSA-7r86-cg39-jmmj:pkg:1a39cca405ef708861dee501 applies

Expected behavior · high confidence

This is a development tool dependency that does not affect the plugin when it runs.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj:pkg:1a39cca405ef708861dee501 to a dependency declared by this repository.

Contextual assessment: The vulnerable package minimatch@9.0.5 is a transitive dependency of devDependency tailwindcss. It is used only during build and is not present in the shipped plugin.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-7r86-cg39-jmmj:pkg:1a39cca405ef708861dee501
File role: production
Source: package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg:pkg:a3638530d49c16954a754a83 applies

Expected behavior · high confidence

This is a development tool dependency that does not affect the plugin when it runs.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg:pkg:a3638530d49c16954a754a83 to a dependency declared by this repository.

Contextual assessment: The vulnerable package brace-expansion@2.0.2 is a transitive dependency of devDependency minimatch (which is itself a devDependency). It is not present in the shipped plugin.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-mh99-v99m-4gvg:pkg:a3638530d49c16954a754a83
File role: production
Source: package-lock.json

Dependency advisory GHSA-r28c-9q8g-f849:pkg:309438d8c981844c76003c01 applies

Expected behavior · high confidence

This is a development tool vulnerability that does not affect the plugin when it runs.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849:pkg:309438d8c981844c76003c01 to a dependency declared by this repository.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-r28c-9q8g-f849:pkg:309438d8c981844c76003c01
File role: production
Source: package-lock.json

Dependency advisory GHSA-f886-m6hf-6m8v:pkg:16af9086b5e4ae9e3d4dc665 applies

Expected behavior · high confidence

This software package vulnerability exists only in a development tool, not in the final plugin that users install, so it cannot be exploited.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v:pkg:16af9086b5e4ae9e3d4dc665 to a dependency declared by this repository.

Contextual assessment: Brace-expansion@2.0.2 is a transitive dependency of devDependencies (e.g., jackspeak) and is not bundled in the shipped dist/risu-antigravity.js build artifact. No runtime reachability is demonstrated from the supplied file evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-f886-m6hf-6m8v:pkg:16af9086b5e4ae9e3d4dc665
File role: production
Source: package-lock.json

Dependency advisory GHSA-pr6f-5x2q-rwfp:pkg:5d5fe58646d8594e79f18b24 applies

Expected behavior · medium confidence

This is a known issue in the Svelte library used to build the plugin's interface, but there is no evidence that an attacker can actually exploit it through this plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-pr6f-5x2q-rwfp:pkg:5d5fe58646d8594e79f18b24 to a dependency declared by this repository.

Contextual assessment: Svelte@4.2.20 is a runtime dependency used in the plugin UI. The advisory exists, but the supplied evidence does not show an attacker-controlled input path that triggers the vulnerable code. Without source code review, exploitable runtime reachability is not demonstrated.

Impact: none · Exploitability: unlikely

Developer action: Review the Svelte advisory and consider updating to a patched version if the vulnerable code path is reachable.

Scanner: osv-scanner 2.4.0
Rule: GHSA-pr6f-5x2q-rwfp:pkg:5d5fe58646d8594e79f18b24
File role: production
Source: package-lock.json

Dependency advisory GHSA-f7gr-6p89-r883:pkg:8fd81e148e1b27069412ff27 applies

Expected behavior · medium confidence

Another known issue in the Svelte library, but no evidence it can be exploited through this plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-f7gr-6p89-r883:pkg:8fd81e148e1b27069412ff27 to a dependency declared by this repository.

Contextual assessment: Svelte@4.2.20 is a runtime dependency. This is a duplicate advisory for the same package. No runtime reachability is demonstrated from the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: Same as above – update Svelte if needed.

Scanner: osv-scanner 2.4.0
Rule: GHSA-f7gr-6p89-r883:pkg:8fd81e148e1b27069412ff27
File role: production
Source: package-lock.json

Dependency advisory GHSA-4w7w-66w2-5vf9:pkg:b05cf1d2fd08e11489a53642 applies

Expected behavior · high confidence

This vulnerability is in Vite, a build tool, not in the final plugin that users run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4w7w-66w2-5vf9:pkg:b05cf1d2fd08e11489a53642 to a dependency declared by this repository.

Contextual assessment: Vite@5.4.21 is a devDependency used only during the build process. It is not included in the shipped plugin artifact. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-4w7w-66w2-5vf9:pkg:b05cf1d2fd08e11489a53642
File role: production
Source: package-lock.json

Dependency advisory GHSA-6g55-p6wh-862q:pkg:be20184562ed7ac60b9bb3c5 applies

Expected behavior · high confidence

This vulnerability is in PostCSS, a CSS processing tool used only when building the plugin, not at runtime.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-6g55-p6wh-862q:pkg:be20184562ed7ac60b9bb3c5 to a dependency declared by this repository.

Contextual assessment: PostCSS@8.5.6 is a devDependency used by Vite during build. It is not bundled in the shipped artifact. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-6g55-p6wh-862q:pkg:be20184562ed7ac60b9bb3c5
File role: production
Source: package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895:pkg:19b149914c26cb2c9c5de439 applies

Expected behavior · high confidence

Another vulnerability in a development-only dependency that is not present in the installed plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895:pkg:19b149914c26cb2c9c5de439 to a dependency declared by this repository.

Contextual assessment: Brace-expansion@2.0.2 is a transitive devDependency (via minimatch etc.) and is not included in the shipped build. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-rgw5-rvv9-x895:pkg:19b149914c26cb2c9c5de439
File role: production
Source: package-lock.json

Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679 applies

Expected behavior · high confidence

This vulnerability is in a small library used during build; it does not affect the running plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679 to a dependency declared by this repository.

Contextual assessment: Nanoid@3.3.11 is a transitive devDependency (used by Vite/PostCSS). Not included in the shipped artifact. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679
File role: production
Source: package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:80dc2988b9d15a40674cea67 applies

Expected behavior · high confidence

Another PostCSS advisory; still not present in the final plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp:pkg:80dc2988b9d15a40674cea67 to a dependency declared by this repository.

Contextual assessment: PostCSS@8.5.6 is a devDependency. Duplicate advisory for the same package. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-fxqj-rqcc-2cmp:pkg:80dc2988b9d15a40674cea67
File role: production
Source: package-lock.json

Dependency advisory GHSA-mw96-cpmx-2vgc:pkg:601747c3b749b3dd8c3c29f8 applies

Expected behavior · high confidence

This vulnerability is in Rollup, a bundling tool used only during development; it does not affect the installed plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mw96-cpmx-2vgc:pkg:601747c3b749b3dd8c3c29f8 to a dependency declared by this repository.

Contextual assessment: Rollup@4.52.5 is a devDependency used by Vite during build. Not included in the shipped plugin artifact. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-mw96-cpmx-2vgc:pkg:601747c3b749b3dd8c3c29f8
File role: production
Source: package-lock.json

Dependency advisory GHSA-67mh-4wv8-2f99:pkg:9f437f50cb9a95220530f4b0 applies

Expected behavior · high confidence

Vulnerability in esbuild, a build tool; not present in the final plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-67mh-4wv8-2f99:pkg:9f437f50cb9a95220530f4b0 to a dependency declared by this repository.

Contextual assessment: Esbuild@0.21.5 is a devDependency used by Vite during build. Not included in shipped artifact. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-67mh-4wv8-2f99:pkg:9f437f50cb9a95220530f4b0
File role: production
Source: package-lock.json

Dependency advisory GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b applies

Expected behavior · high confidence

Vulnerability in nanoid, a build-time dependency; not in the shipped plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b to a dependency declared by this repository.

Contextual assessment: Nanoid@3.3.11 is a transitive devDependency (via PostCSS). Not included in shipped artifact. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b
File role: production
Source: package-lock.json

Dependency advisory GHSA-crpf-4hrx-3jrp:pkg:1239c1d6fa27af8cd8cf42dc applies

Expected behavior · medium confidence

Known issue in Svelte used in the plugin, but no evidence it can be exploited here.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-crpf-4hrx-3jrp:pkg:1239c1d6fa27af8cd8cf42dc to a dependency declared by this repository.

Contextual assessment: Svelte@4.2.20 is a runtime dependency. Advisory exists but no demonstrated attacker-controlled input path to trigger the vulnerability. Not confirmed exploitable.

Impact: none · Exploitability: unlikely

Developer action: Review Svelte advisory and consider updating if the vulnerable code path is reachable.

Scanner: osv-scanner 2.4.0
Rule: GHSA-crpf-4hrx-3jrp:pkg:1239c1d6fa27af8cd8cf42dc
File role: production
Source: package-lock.json

Dependency advisory GHSA-m56q-vw4c-c2cp:pkg:cfabc2fb061db0b3aae2a069 applies

Expected behavior · medium confidence

Another Svelte advisory; same as above.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-m56q-vw4c-c2cp:pkg:cfabc2fb061db0b3aae2a069 to a dependency declared by this repository.

Contextual assessment: Svelte@4.2.20, duplicate advisory. No demonstrated runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: Same as above.

Scanner: osv-scanner 2.4.0
Rule: GHSA-m56q-vw4c-c2cp:pkg:cfabc2fb061db0b3aae2a069
File role: production
Source: package-lock.json

Credential access and network transmission in one file

Expected behavior · high confidence

The plugin uses your login token to fetch your profile from Google. That's expected for showing your account info.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The fetchUserProfile method retrieves the stored OAuth access token via getAccessToken and sends it to Google's userinfo endpoint. This is standard OAuth behavior to obtain the user's profile after authentication, not credential exfiltration. The destination is Google's official API and the token is only used for its intended purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: src/auth/index.ts:287

Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:0546a3b9043a41cf17d6475f applies

Expected behavior · high confidence

Build-time dependency vulnerability.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp:pkg:0546a3b9043a41cf17d6475f to a dependency declared by this repository.

Contextual assessment: Brace-expansion@2.0.2 is a transitive devDependency. Not included in shipped artifact. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-3jxr-9vmj-r5cp:pkg:0546a3b9043a41cf17d6475f
File role: production
Source: package-lock.json

Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a applies

Expected behavior · high confidence

Vulnerability in picomatch, a development dependency.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a to a dependency declared by this repository.

Contextual assessment: Picomatch@2.3.1 is a transitive devDependency (used by tailwindcss etc.). Not included in shipped artifact. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a
File role: production
Source: package-lock.json

Dependency advisory GHSA-3ppc-4f35-3m26:pkg:5b0d86b7147a191050fb118c applies

Expected behavior · high confidence

Vulnerability in minimatch, a development dependency.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26:pkg:5b0d86b7147a191050fb118c to a dependency declared by this repository.

Contextual assessment: Minimatch@9.0.5 is a transitive devDependency (used by jackspeak etc.). Not included in shipped artifact. No runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-3ppc-4f35-3m26:pkg:5b0d86b7147a191050fb118c
File role: production
Source: package-lock.json

Dependency advisory GHSA-fx2h-pf6j-xcff:pkg:4d43116c7f40e099d5763941 applies

Expected behavior · high confidence

This security warning is about a build tool, not the actual plugin. The plugin doesn't run Vite when you use it.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff:pkg:4d43116c7f40e099d5763941 to a dependency declared by this repository.

Contextual assessment: Vite is a devDependency used only during the build phase. The advisory (GHSA-fx2h-pf6j-xcff) applies to the Vite dev server and does not affect the runtime behavior of the shipped plugin bundle. No attacker-controlled path reaches the vulnerable code in production.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-fx2h-pf6j-xcff:pkg:4d43116c7f40e099d5763941
File role: production
Source: package-lock.json

Dependency advisory GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7 applies

Expected behavior · high confidence

This warning is about a file-matching library used while building the plugin. It isn't active when you use the plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7 to a dependency declared by this repository.

Contextual assessment: Picomatch is a transitive dev dependency used during the build process. The advisory (GHSA-3v7f-55p6-f55p) does not affect runtime execution of the distributed plugin since picomatch is not part of the shipped code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7
File role: production
Source: package-lock.json

Dependency advisory GHSA-5j98-mcp5-4vw2:pkg:2bc06ba112845300e5f58cd2 applies

Expected behavior · high confidence

This is a file-matching tool used during development. It doesn't run when you use the plugin.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5j98-mcp5-4vw2:pkg:2bc06ba112845300e5f58cd2 to a dependency declared by this repository.

Contextual assessment: Glob is a devDependency used during the build process. The advisory (GHSA-5j98-mcp5-4vw2) does not affect the runtime behavior of the shipped plugin as glob is not included in the distributed bundle.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-5j98-mcp5-4vw2:pkg:2bc06ba112845300e5f58cd2
File role: production
Source: package-lock.json

Coverage and limitations

Inventory: 42 files · 262687 bytes
Contextual coverage: 31 of 31 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 27 files · 67774 bytes
X-Ray review families: 0 warning occurrences compacted to 0 evidence-preserving review families
Representations: 27 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans: 27 raw signatures · 6 raw AST · 27 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Unresolved JavaScript stages

src/antigravity/index.ts — raw-ast / parse
src/api.ts — raw-ast / parse
src/auth/index.ts — raw-ast / parse
src/chat/config.ts — raw-ast / parse
src/chat/format.ts — raw-ast / parse
src/chat/index.ts — raw-ast / parse
src/chat/request.ts — raw-ast / parse
src/chat/response.ts — raw-ast / parse
src/chat/types.ts — raw-ast / parse
src/model/index.ts — raw-ast / parse
src/model/list.ts — raw-ast / parse
src/plugin.ts — raw-ast / parse
src/shared/backup.ts — raw-ast / parse
src/shared/events.ts — raw-ast / parse
src/shared/logger.ts — raw-ast / parse
src/shared/types.ts — raw-ast / parse
src/shared/util.ts — raw-ast / parse
src/ui/index.ts — raw-ast / parse
src/ui/popup/index.ts — raw-ast / parse
src/ui/popup/store.ts — raw-ast / parse
vite-plugin-risu-header.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — not-applicable

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 3f77962ab416253643d8f86344ea03cac9a47f3c
Completed: Aug 11, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · deepseek/deepseek-v4-flash:thinking
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 8 fresh / 0 reused groups · 31 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 0 deterministic / 31 contextual candidates · 8 contextual / 8 total behavior cases
Model budget: 3 model calls · 8 / 12 fresh cases · 117567 / 200000 estimated input · 120034 / 250000 actual input · 14662 / 40000 output tokens
Review batching: 3 model calls · up to 4 groups and 16 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 120034 input · 14662 output · 0 cache read · 0 reasoning tokens
Report: 0188ca296adc0a8a16bdaffbdf9cdd5399988c78961dee1f09fdd6070ba8ce38