TavernKeeper Scan Report

mechamarmot/SillyTavern-MazeMaster

Commit ef8e1f8 Reviewed Aug 4, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 43 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Minor caution · high confidence

A test helper uses an unsafe parsing method, but only on the project's own committed code file. There is no real security risk because no external or user data is involved.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: This candidate follows the identical pattern as the others in this test utility: regex extraction of an object literal from the project's own source file followed by eval to reconstruct it. The eval argument is derived solely from committed project source with no external or user-controlled input. No credential, network, or persistence flows exist. The eval usage is a minor code-quality weakness with no practical exploitability here.

Impact: none · Exploitability: unlikely

Developer action: Replace eval with a safer parsing method such as JSON.parse or a dedicated parser.

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: test
Source: tests/mocks/gameExtractor.js:32

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Minor caution · high confidence

A test helper uses an unsafe parsing method on the project's own code file contents. Because it only handles the project's own committed data, there is no real security risk, though a safer method would be cleaner.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: Same pattern as the other candidates in this file: a regex captures an object literal from the project's own source file and eval reconstructs it. The input to eval is a substring of committed project source, not external or user-supplied data. No network, credential, or persistence flows are present. The use of eval is a code-quality weakness rather than an exploitable vulnerability in this test context.

Impact: none · Exploitability: unlikely

Developer action: Replace eval with a safer parsing approach such as JSON.parse or a dedicated parser for the extracted object literals.

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: test
Source: tests/mocks/gameExtractor.js:28

Dependency advisory GHSA-v6h2-p8h4-qcjw applies

Minor caution · medium confidence

A scan found a known security issue in one of the packages used to build or test this extension. Since it is likely a development-only tool, it probably does not affect people who install and use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v6h2-p8h4-qcjw to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in the lockfile. The project declares only react and react-dom as production dependencies; all other declared packages are devDependencies for building and testing. Vulnerabilities in dev tooling do not ship to end users in the webpack bundle. Without the specific package name, the most likely scenario is a build-time or test-time dependency with no runtime exposure to SillyTavern users.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient. Run npm audit to identify the specific package and resolve it.

Scanner: osv-scanner 2.4.0
Rule: GHSA-v6h2-p8h4-qcjw
File role: production
Source: package-lock.json

Dependency advisory GHSA-4x5r-pxfx-6jf8 applies

Minor caution · medium confidence

A scan found a minor known security issue in a package used during development. This likely does not affect users who install the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4x5r-pxfx-6jf8 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in the lockfile. The project's production dependencies are limited to react and react-dom. The remaining packages are devDependencies for the build and test toolchain. A low-severity advisory in a development dependency has no direct path to end-user runtime exposure in this browser-based SillyTavern extension.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient. Run npm audit to identify the specific package and resolve it.

Scanner: osv-scanner 2.4.0
Rule: GHSA-4x5r-pxfx-6jf8
File role: production
Source: package-lock.json

Dependency advisory GHSA-vpq2-c234-7xj6 applies

Minor caution · medium confidence

A scan found a minor known security issue in a development package. This probably does not affect people using the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-vpq2-c234-7xj6 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in the lockfile. The project ships a webpack bundle to SillyTavern users with only react and react-dom as production dependencies. Development and test dependencies are not included in the shipped artifact. A low-severity finding in a build-time dependency presents minimal runtime risk.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient. Run npm audit to identify the specific package and resolve it.

Scanner: osv-scanner 2.4.0
Rule: GHSA-vpq2-c234-7xj6
File role: production
Source: package-lock.json

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Minor caution · high confidence

A test helper uses an unsafe parsing method on the project's own code file. Since only the project's committed data is processed, there is no real security risk, but a safer approach would be better practice.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: This candidate is the fourth instance of the same pattern in this test utility file. A regex captures an object literal from the project's own source file and eval reconstructs the JavaScript object. The eval input is a substring of committed project source only; there is no external, user-supplied, or network-derived data. No credentials, persistence, or network access are involved. The eval usage is a code-quality weakness with no practical exploitability in this context.

Impact: none · Exploitability: unlikely

Developer action: Replace eval with a safer parsing method such as JSON.parse or a dedicated parser for the extracted object literals.

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: test
Source: tests/mocks/gameExtractor.js:36

Dependency advisory GHSA-fv7c-fp4j-7gwp applies

Minor caution · medium confidence

A scan found a serious known security issue in a package, but it is most likely in a development tool that does not get included when users install the extension. If it turns out to be in a package that ships to users, it would need urgent attention.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fv7c-fp4j-7gwp to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in the lockfile. Despite the high scanner severity, the project's production dependencies are only react and react-dom. All other packages are devDependencies for building, linting, and testing. If the vulnerable package is a development tool, it does not ship in the webpack bundle and has no runtime exposure to SillyTavern users. Without the specific package name, a definitive production-vs-dev classification cannot be made, but the project structure strongly suggests a development dependency.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package. If it is a devDependency, update it at the next convenience. If it is a production dependency or a transitive dependency of react or react-dom, update immediately.

Scanner: osv-scanner 2.4.0
Rule: GHSA-fv7c-fp4j-7gwp
File role: production
Source: package-lock.json

Dependency advisory GHSA-qj8w-gfj5-8c6v applies

Minor caution · medium confidence

A scan found a known security issue in a package used during development. This likely does not affect users who install the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-qj8w-gfj5-8c6v to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in the lockfile. The project declares only react and react-dom as production dependencies. The remaining packages are devDependencies for the build and test toolchain. A medium-severity advisory in a development dependency does not create a runtime exposure path for SillyTavern end users.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient. Run npm audit to identify the specific package and resolve it.

Scanner: osv-scanner 2.4.0
Rule: GHSA-qj8w-gfj5-8c6v
File role: production
Source: package-lock.json

Dependency advisory GHSA-5c6j-r48x-rmvq applies

Minor caution · medium confidence

A scan found a serious known security issue in a package, but it is most likely in a development tool that does not get included when users install the extension. If it is in a production package, it would need urgent attention.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5c6j-r48x-rmvq to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in the lockfile. The project's production dependencies are limited to react and react-dom. All other declared packages are devDependencies for building, testing, and serving during development. If the vulnerable package is a development tool, it does not ship in the webpack bundle and has no runtime exposure to SillyTavern users. The specific package name was not provided, so a definitive classification cannot be made, but the project structure strongly suggests a development dependency.

Impact: low · Exploitability: unlikely

Scanner: osv-scanner 2.4.0
Rule: GHSA-5c6j-r48x-rmvq
File role: production
Source: package-lock.json

Dependency advisory GHSA-xxjr-mmjv-4gpg applies

Minor caution · medium confidence

A scan found a known security issue in a development package. This probably does not affect people using the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xxjr-mmjv-4gpg to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in the lockfile. The project ships a webpack bundle to SillyTavern users with only react and react-dom as production dependencies. Development and test dependencies are not included in the shipped artifact. A medium-severity finding in a build-time dependency presents minimal runtime risk to end users.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient. Run npm audit to identify the specific package and resolve it.

Scanner: osv-scanner 2.4.0
Rule: GHSA-xxjr-mmjv-4gpg
File role: production
Source: package-lock.json

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Minor caution · high confidence

A test helper uses a potentially unsafe JavaScript feature to read game settings from the project's own code file. Since it only processes the project's own committed source and never touches user input or network data, there is no real danger, but a safer parsing approach would be better practice.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: This is a test utility file that reads the project's own committed source file via fs.readFileSync, extracts an object literal using a regex, and passes the captured text to eval to reconstruct the JavaScript object. The eval input is not user-controlled or network-derived; it is a substring of the project's own source code. There is no external data flow, credential access, or persistence. The weakness is the use of eval for parsing where a safer method such as JSON.parse or a dedicated parser would be preferable, but the practical risk in this test context is negligible.

Impact: none · Exploitability: unlikely

Developer action: Replace eval-based object parsing with JSON.parse where the source objects are JSON-compatible, or use a sandboxed parser. This improves test robustness and removes the eval pattern.

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: test
Source: tests/mocks/gameExtractor.js:24

Dependency advisory GHSA-v2hh-gcrm-f6hx applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in the lockfile. The project's production dependencies are only react and react-dom. All other packages are devDependencies for building, linting, testing, and local serving. If the vulnerable package is a development tool, it does not ship in the webpack bundle and has no runtime exposure to SillyTavern users. Without the specific package name, a definitive production-vs-dev classification cannot be made, but the project structure strongly suggests a development dependency.

Impact: low · Exploitability: unlikely

Scanner: osv-scanner 2.4.0
Rule: GHSA-v2hh-gcrm-f6hx
File role: production
Source: package-lock.json

Dependency advisory GHSA-f23m-r3pf-42rh applies

Minor caution · medium confidence

A tool found that this project uses an outdated version of a software package with a known security issue. Since this is a browser extension and the issue is likely in a development-only tool, it probably does not affect people who use the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-f23m-r3pf-42rh to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known medium-severity advisory against a declared dependency in package-lock.json. The project's production dependencies are limited to react and react-dom; the remaining declared dependencies are devDependencies used for building and testing. In a browser-based SillyTavern extension, dev dependencies are not shipped to end users, limiting runtime exposure. The specific vulnerable package was not included in the evidence, so the exact placement in the dependency tree cannot be confirmed.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner locally to identify the specific package, then update it to a version that addresses the advisory.

Scanner: osv-scanner 2.4.0
Rule: GHSA-f23m-r3pf-42rh
File role: production
Source: package-lock.json

Dependency advisory GHSA-25h7-pfq9-p65f applies

Minor caution · medium confidence

A tool found that this project uses an outdated version of a software package with a known security issue rated as high severity. Because this is a browser extension and the issue is likely in a development-only tool, it probably does not affect people who use the extension, but the package should still be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-25h7-pfq9-p65f to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known high-severity advisory against a declared dependency. The project declares only react and react-dom as production dependencies; all other packages are devDependencies for build and test tooling. In a browser-based SillyTavern extension, dev dependencies do not ship to end users. The specific package name was removed from the scanner output, preventing confirmation of whether it falls in the production or development tree.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner locally to identify the specific package, then update it to a version that addresses the advisory.

Scanner: osv-scanner 2.4.0
Rule: GHSA-25h7-pfq9-p65f
File role: production
Source: package-lock.json

Dependency advisory GHSA-2g4f-4pwh-qvx6 applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2g4f-4pwh-qvx6 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known medium-severity advisory against a declared dependency in package-lock.json. The project's production dependencies are react and react-dom; the rest are devDependencies. Browser-based SillyTavern extensions ship compiled bundles, so dev dependencies do not reach end users. The specific vulnerable package was not included in the evidence.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner locally to identify the specific package, then update it to a version that addresses the advisory.

Scanner: osv-scanner 2.4.0
Rule: GHSA-2g4f-4pwh-qvx6
File role: production
Source: package-lock.json

Dependency advisory GHSA-v39h-62p7-jpjc applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v39h-62p7-jpjc to a dependency declared by this repository.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner locally to identify the specific package, then update it to a version that addresses the advisory.

Scanner: osv-scanner 2.4.0
Rule: GHSA-v39h-62p7-jpjc
File role: production
Source: package-lock.json

Dependency advisory GHSA-h67p-54hq-rp68 applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-h67p-54hq-rp68 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known medium-severity advisory against a declared dependency in package-lock.json. The project's production dependencies are react and react-dom; the remaining declared dependencies are devDependencies used for building and testing. In a browser-based SillyTavern extension, dev dependencies are not shipped to end users, limiting runtime exposure. The specific vulnerable package was not included in the evidence.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner locally to identify the specific package, then update it to a version that addresses the advisory.

Scanner: osv-scanner 2.4.0
Rule: GHSA-h67p-54hq-rp68
File role: production
Source: package-lock.json

Dependency advisory GHSA-hmw2-7cc7-3qxx applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-hmw2-7cc7-3qxx to a dependency declared by this repository.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner locally to identify the specific package, then update it to a version that addresses the advisory.

Scanner: osv-scanner 2.4.0
Rule: GHSA-hmw2-7cc7-3qxx
File role: production
Source: package-lock.json

Dependency advisory GHSA-q3j6-qgpj-74h6 applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-q3j6-qgpj-74h6 to a dependency declared by this repository.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner locally to identify the specific package, then update it to a version that addresses the advisory.

Scanner: osv-scanner 2.4.0
Rule: GHSA-q3j6-qgpj-74h6
File role: production
Source: package-lock.json

Dependency advisory GHSA-23c5-xmqv-rm74 applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74 to a dependency declared by this repository.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner locally to identify the specific package, then update it to a version that addresses the advisory.

Scanner: osv-scanner 2.4.0
Rule: GHSA-23c5-xmqv-rm74
File role: production
Source: package-lock.json

Dependency advisory GHSA-3jxr-9vmj-r5cp applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package listed in the project's dependency lock file. This extension runs inside a web browser, and most of its dependencies are build tools that never end up in the final product users install. The vulnerability is unlikely to affect people using the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory against a dependency in this package-lock.json. The project is a client-side SillyTavern browser extension whose production dependencies are limited to react and react-dom. The remaining dependencies are dev/build tooling (babel, webpack, jest, playwright, eslint) that are not bundled into the shipped extension. Vulnerabilities in dev-only dependency trees do not reach end users at runtime in a webpack-built browser extension. Without the specific package identity (removed by the scanner), the exact exploitability cannot be confirmed, but the project structure strongly suggests these are build-tool transitive dependencies.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version. Keep dev dependencies current to avoid supply-chain noise.

Scanner: osv-scanner 2.4.0
Rule: GHSA-3jxr-9vmj-r5cp
File role: production
Source: package-lock.json

Dependency advisory GHSA-7p8r-x3mc-p8w7 applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package in the project's dependency list. Since this is a browser extension and the vulnerable package is most likely a build tool that doesn't get included in the final installed extension, the risk to users is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory against a dependency in this package-lock.json. The project ships only react and react-dom as production dependencies; all other declared dependencies are dev/build tooling not included in the webpack bundle. A vulnerable transitive dependency in the dev tree does not execute in the browser extension at runtime. The specific package identity was removed from scanner output, preventing precise impact analysis, but the dependency profile indicates a build-tool context.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-7p8r-x3mc-p8w7
File role: production
Source: package-lock.json

Dependency advisory GHSA-7r86-cg39-jmmj applies

Minor caution · medium confidence

A security scanner flagged a vulnerable package in the dependency lock file. This browser extension's final product likely does not include the vulnerable package, as it appears to be a development build tool.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory against a dependency in this package-lock.json. The extension's production dependency surface is react and react-dom only. The large dev dependency tree (babel, webpack, jest, playwright) is where most transitive vulnerabilities reside, and those packages are not bundled into the client-side extension output. The removed package identity prevents confirming whether this is a production or dev tree vulnerability.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-7r86-cg39-jmmj
File role: production
Source: package-lock.json

Dependency advisory GHSA-rf6f-7fwh-wjgh applies

Minor caution · medium confidence

A security scanner found a known-vulnerable package in the project's dependency list. The vulnerable package is most likely a development tool that does not get included in the extension users install, so the practical risk is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rf6f-7fwh-wjgh to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory against a dependency in this package-lock.json. The project is a webpack-built browser extension with production dependencies limited to react and react-dom. The extensive dev dependency tree contains build and test tooling that is excluded from the shipped bundle. Without the specific package name, precise classification is not possible, but the project structure indicates a dev-tooling context with no runtime exposure to end users.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-rf6f-7fwh-wjgh
File role: production
Source: package-lock.json

Dependency advisory GHSA-8fgc-7cc6-rx7x applies

Minor caution · medium confidence

A security scanner found a low-severity vulnerable package in the dependency list. This is likely a development build tool that does not reach the final extension users install.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8fgc-7cc6-rx7x to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a low-severity known advisory against a dependency in this package-lock.json. The extension's production dependencies are react and react-dom; all other declared packages are dev/build tooling not included in the webpack output bundle. A low-severity vulnerability in a dev-only transitive dependency has no runtime exposure in the shipped browser extension.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-8fgc-7cc6-rx7x
File role: production
Source: package-lock.json

Dependency advisory GHSA-r5fr-rjxr-66jc applies

Minor caution · medium confidence

A security scanner flagged a vulnerable package in the dependency lock file. Since this is a browser extension and the vulnerable package is most likely a build tool not included in the final product, the risk to users is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r5fr-rjxr-66jc to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory against a dependency in this package-lock.json. The project ships only react and react-dom as production dependencies for a client-side SillyTavern extension. The remaining dependencies are build and test tooling excluded from the webpack bundle. The scanner removed the specific package identity, but the dependency profile strongly suggests a dev-tree vulnerability with no end-user runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-r5fr-rjxr-66jc
File role: production
Source: package-lock.json

Dependency advisory GHSA-3v7f-55p6-f55p applies

Minor caution · medium confidence

A security scanner found a medium-severity vulnerable package in the dependency list. This browser extension likely does not include the vulnerable package in its final product, as it appears to be a development tool.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity known advisory against a dependency in this package-lock.json. The extension's production dependency surface is limited to react and react-dom. The large dev dependency tree (babel, webpack, jest, playwright, eslint) is where transitive vulnerabilities typically reside, and those packages are not bundled into the client-side extension. The removed package identity prevents precise impact analysis.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-3v7f-55p6-f55p
File role: production
Source: package-lock.json

Dependency advisory GHSA-4c8g-83qw-93j6 applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known advisory against a dependency in this package-lock.json. The project is a webpack-built client-side browser extension with production dependencies limited to react and react-dom. The extensive dev dependency tree contains build and test tooling that is excluded from the shipped bundle. Without the specific package name, precise classification is not possible, but the project structure indicates a dev-tooling context with no runtime exposure to end users.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-4c8g-83qw-93j6
File role: production
Source: package-lock.json

Dependency advisory GHSA-f886-m6hf-6m8v applies

Minor caution · medium confidence

A known security flaw was found in a package used by this browser extension. Since the extension only ships a small set of libraries to users and the affected package is likely a development or testing tool, the actual risk to people using the extension is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity known advisory against a declared dependency in the lockfile. The project's only production dependencies are react and react-dom; all other declared dependencies are dev-only build and test tools. In a client-side browser extension context, vulnerable code paths in dev dependencies are not shipped to or executed by end users. The advisory represents a real but contextually low-risk issue.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient to keep the dependency tree current.

Scanner: osv-scanner 2.4.0
Rule: GHSA-f886-m6hf-6m8v
File role: production
Source: package-lock.json

Dependency advisory GHSA-52cp-r559-cp3m applies

Minor caution · medium confidence

A known high-severity security flaw was found in a package listed in this extension's dependency file. Because the extension is a browser-based game toolkit and most dependencies are development tools that do not run for end users, the practical risk is likely low, though the dependency should still be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity known advisory against a declared dependency in the lockfile. The project is a client-side SillyTavern browser extension whose production dependencies are limited to react and react-dom. The remaining declared dependencies are dev-only tooling. Without the specific package name it is not possible to confirm whether the vulnerable package is a transitive production dependency, but the project structure strongly suggests most advisories relate to dev tooling that does not execute in the end-user browser runtime.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific package from the advisory, determine whether it is a production or dev dependency, and update to a patched version. Prioritize updates if the package is reachable in the browser runtime.

Scanner: osv-scanner 2.4.0
Rule: GHSA-52cp-r559-cp3m
File role: production
Source: package-lock.json

Dependency advisory GHSA-96hv-2xvq-fx4p applies

Minor caution · medium confidence

A known high-severity security issue was found in a package used by this browser extension. Since the extension is a client-side game toolkit and most affected packages are likely development tools, the real-world risk to users is probably low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-96hv-2xvq-fx4p to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity known advisory against a declared dependency in the lockfile. The project ships only react and react-dom as production dependencies; all other top-level dependencies are dev tooling. In a browser extension context, vulnerable code paths in dev-only packages are not exposed to end users at runtime.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific package from the advisory, determine whether it is a production or dev dependency, and update to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-96hv-2xvq-fx4p
File role: production
Source: package-lock.json

Dependency advisory GHSA-3ppc-4f35-3m26 applies

Minor caution · medium confidence

A known high-severity security flaw was found in a package listed in this extension's dependency file. Because the extension runs in a browser and most dependencies are development tools, the actual danger to users is likely low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity known advisory against a declared dependency in the lockfile. The project is a client-side browser extension with production dependencies limited to react and react-dom. Dev-only dependencies do not execute in the end-user browser environment, reducing the practical exploitability of advisories in those packages.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific package from the advisory, determine whether it is a production or dev dependency, and update to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-3ppc-4f35-3m26
File role: production
Source: package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity known advisory against a declared dependency in the lockfile. The project's production dependencies are limited to react and react-dom, with all other declared dependencies being dev-only build and test tooling. Browser extension runtime does not execute dev dependency code paths.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific package from the advisory, determine whether it is a production or dev dependency, and update to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-mh99-v99m-4gvg
File role: production
Source: package-lock.json

Dependency advisory GHSA-58qx-3vcg-4xpx applies

Minor caution · medium confidence

A known medium-severity security flaw was found in a package used by this browser extension. Since the extension only ships a small set of libraries to users and the affected package is likely a development tool, the actual risk is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-58qx-3vcg-4xpx to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity known advisory against a declared dependency in the lockfile. The project ships only react and react-dom as production dependencies; all other top-level dependencies are dev tooling. Vulnerable code paths in dev-only packages are not reachable in the end-user browser runtime.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient to keep the dependency tree current.

Scanner: osv-scanner 2.4.0
Rule: GHSA-58qx-3vcg-4xpx
File role: production
Source: package-lock.json

Dependency advisory GHSA-c2c7-rcm5-vvqj applies

Minor caution · medium confidence

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj to a dependency declared by this repository.

Impact: low · Exploitability: unlikely

Developer action: Identify the specific package from the advisory, determine whether it is a production or dev dependency, and update to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-c2c7-rcm5-vvqj
File role: production
Source: package-lock.json

Dependency advisory GHSA-48c2-rrv3-qjmp applies

Minor caution · medium confidence

A known medium-severity security issue was found in a package used by this browser extension. Since the extension is a client-side game toolkit and the affected package is likely a development tool, the real-world risk to users is low.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-48c2-rrv3-qjmp to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity known advisory against a declared dependency in the lockfile. The project's production dependencies are limited to react and react-dom; all other declared dependencies are dev-only build and test tooling. In a browser extension context, dev dependency code paths are not executed by end users.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version when convenient to keep the dependency tree current.

Scanner: osv-scanner 2.4.0
Rule: GHSA-48c2-rrv3-qjmp
File role: production
Source: package-lock.json

Dependency advisory GHSA-38r7-794h-5758 applies

Minor caution · medium confidence

A known security issue was found in a tool used to build or test the extension. Because this tool is not included in the final extension that users run, it does not pose a direct risk to users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-38r7-794h-5758 to a dependency declared by this repository.

Contextual assessment: The OSV scanner matched a low-severity advisory against a declared dependency in the lockfile. The provided source context shows the root project declares only React as a production dependency, while all other listed packages are devDependencies used for building and testing. Vulnerabilities in development dependencies do not affect the runtime behavior of the bundled extension and pose minimal risk to end users.

Impact: low · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version when convenient to maintain a secure build environment.

Scanner: osv-scanner 2.4.0
Rule: GHSA-38r7-794h-5758
File role: production
Source: package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895 applies

Minor caution · medium confidence

A serious security issue was found in a tool used to build or test the extension. Because this tool is not part of the final extension that users run, it does not pose a direct risk to users, though it should still be fixed.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: The OSV scanner matched a high-severity advisory against a declared dependency in the lockfile. However, the provided source context indicates the root project's production dependencies are limited to React, with all other packages being devDependencies. A high-severity vulnerability in a development dependency affects the build environment rather than the runtime extension, significantly reducing the practical impact and exploitability for end users.

Impact: low · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version to ensure the build environment remains secure.

Scanner: osv-scanner 2.4.0
Rule: GHSA-rgw5-rvv9-x895
File role: production
Source: package-lock.json

Expected scanner matches (0)

None.

Related contextual observations

Dependency vulnerability findings are predominantly in the development toolchain

low risk · medium confidence

The extension only uses two packages in its final shipped product. The rest are tools for building and testing. The security issues found by the scanner are most likely in those build and test tools, which do not affect people who install and use the extension.

Technical assessment

The package-lock.json declares only react and react-dom as production dependencies. All other packages including babel, jest, webpack, playwright, serve, and eslint are devDependencies. The extension ships a webpack bundle to SillyTavern users, meaning development dependencies are not included in the runtime artifact. The eight OSV-scanner findings span low, medium, and high scanner severities, but without specific package names it is not possible to confirm whether any are transitive dependencies of the production packages. The project structure strongly suggests the majority or all are in the development toolchain.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to map each advisory to its specific package. Update all affected packages. For any advisory that maps to a transitive dependency of react or react-dom, prioritize the update as it could affect the shipped bundle.

Sources:

package-lock.json:10-28

Dependency tree is dominated by devDependencies limiting runtime exposure

low risk · medium confidence

The project uses many tools for building and testing that are not included in the final extension. Most of the security issues found are probably in those build-only tools, so they likely do not affect people who install and use the extension. The developer should still update the outdated packages.

Technical assessment

The package-lock.json declares only react and react-dom as production dependencies. All other declared packages including babel, jest, playwright, webpack, serve, and terser are devDependencies used for building and testing. The shipped extension is a compiled webpack bundle, so dev dependencies and their transitive vulnerabilities do not reach end users. The eight OSV-Scanner findings span medium and high severity advisories, but the scanner output removed specific package names, preventing per-candidate confirmation of whether each vulnerable package is in the production or development subtree. Running npm audit locally would clarify which packages need updating and whether any are production dependencies.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit locally to identify each vulnerable package, update to fixed versions, and verify that no production dependencies are affected. If any production dependency is affected, prioritize that update.

Sources:

package-lock.json:10-28

All eight OSV-Scanner candidates are dependency advisories in a client-side extension with minimal production dependency surface

low risk · medium confidence

All eight scanner findings are about vulnerable packages listed in the project's dependency file. This extension runs in a web browser and its only real production dependencies are React. The rest are build and test tools that don't get included in what users actually install. The scanner did not include which specific packages are vulnerable, so the developer should check with npm audit and update any affected packages.

Technical assessment

All eight candidates are OSV-Scanner matches against the package-lock.json of a SillyTavern browser extension. The project declares only react and react-dom as production dependencies. The remaining dependencies are dev/build tooling (babel, webpack, jest, playwright, eslint, serve, terser-webpack-plugin) that are not bundled into the shipped extension by webpack. Vulnerabilities in dev-only transitive dependencies do not execute at runtime in the browser extension. The scanner removed specific package identities, preventing per-candidate confirmation of whether each is in the production or dev tree, but the dependency profile strongly indicates a dev-tooling context. Running npm audit would clarify which packages are affected and whether any are in the production tree.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify all eight specific packages and their advisory details. Update affected packages to patched versions. If any vulnerability is in the react or react-dom production tree, prioritize that update. Consider adding npm audit to CI to catch future advisories.

Sources:

package-lock.json:10-28

Dependency advisories concentrated in dev tooling of a client-side extension

low risk · medium confidence

This browser extension game toolkit has several known security flaws in its dependency packages. Most of these packages are development and testing tools that do not run when people use the extension, so the practical risk is low. Updating the dependencies will clear these warnings.

Technical assessment

All eight OSV-scanner candidates are known-advisory matches against the lockfile of a SillyTavern browser extension. The lockfile shows only react and react-dom as production dependencies, while all other declared dependencies are dev-only build, lint, and test tooling. The scanner removed specific package names from the advisory explanations, so individual package-level reachability cannot be confirmed. However, the project structure indicates that most or all advisories relate to dev dependencies whose vulnerable code paths do not execute in the end-user browser runtime. A periodic dependency refresh would resolve all advisories.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit with package names visible to confirm which advisories affect production versus dev dependencies. Update all flagged packages to patched versions. If any advisory affects a production transitive dependency of react or react-dom, prioritize that update.

Sources:

package-lock.json:10-28

Repeated eval-based parsing of project source constants in test utility

low risk · high confidence

The test file repeatedly uses an unsafe parsing method, but only on the project's own committed code. There is no real security danger, though replacing eval with a safer parser would improve the code.

Technical assessment

All four candidates are instances of the same pattern in a single test helper function. The file reads the project's own source file, extracts object literals via regex, and uses eval to reconstruct them as JavaScript objects. The data flow is entirely internal to the committed project source with no external input. The shared weakness is the reliance on eval for parsing, which is fragile and a code-quality concern, but not exploitable in this test-only context.

Impact: none · Exploitability: unlikely

Developer action: Refactor the extraction logic to avoid eval entirely, for example by exporting the constants directly from the source module or using JSON.parse with compatible object definitions.

Sources:

Coverage and limitations

Inventory: 240 files · 13702866 bytes
Contextual coverage: 38 of 38 candidates assessed

Tools

inventory 0.1.0 — completed
tavernkeeper-static 3 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.

Technical scan identity

Full commit: ef8e1f899d9977cd4a814ac248a03f298391bc8e
Completed: Aug 4, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-5.2:thinking
Scanner: 0.1.0
Scanner policy: 3
Rule catalog: 1
Contextual policy: 1
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v1
Assessment schema: contextual-assessment-v1
Review usage: 32909 input · 25247 output · 4022 cache read · 0 reasoning tokens
Report: 9616b0e68b3e375ed632840a7f9886d41b018be93b888b9b0b6fc911dc3579bb