No material or immediate-danger item was identified.
Expected scanner matches (19)
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a regular pattern used to recognize emoji while parsing generated story suggestions. It does not indicate harmful behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression is a fixed Unicode character-class regular expression used by the streaming suggestion parser to locate emoji in model output. The supplied context shows no attacker-controlled pattern construction, execution of matched content, external transmission, or persistence associated with it.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:974
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension sends generated story prompts to a user-selected OpenAI-compatible service, which matches its documented generation features. The shown default points to a local service, and the endpoint is configurable.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged literal is a configurable local-style base endpoint used to construct a chat-completions request. The request contains the extension's system and user prompts and optionally attaches the configured provider key. No hidden destination or unrelated collection is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:1383
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
The scanner flagged a possible suspicious link, but the supplied code window only shows normal profile and interface handling and does not identify a destination or harmful action.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The candidate is based on a retained scanner signal without matched literal values. The supplied context contains no demonstrated external destination, credential transmission, or concealed execution associated with the signal.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:330
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension connects to a locally configured Ollama server to generate suggestions, matching the documented Ollama backend. The displayed local address is a normal default for that service.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged literal is a fallback local Ollama base URL. It is used for a POST generation request containing the selected model and prompts, with streaming enabled. This is proportionate to the stated purpose and does not show external exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:1341
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a pattern used to recognize emoji characters while parsing generated story suggestions. It matches the extension's advertised role and does not show data theft, hidden execution, or harmful persistence.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression is a broad Unicode emoji-matching regular expression used by parseSuggestions to split model output into suggestion blocks. The supplied context shows no attacker-controlled construction of the expression, sensitive-data destination, execution sink, or persistence behavior. Its main potential concern would be parsing performance on unusually large input, but the expression is fixed and the surrounding parser yields to the UI thread; the evidence does not establish a practical denial-of-service condition.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:863
JavaScript analysis reported javascript.download-to-execution
Expected behavior · low confidence
The extension visibly retrieves prompts and model data for its story-suggestion features. The supplied excerpt does not show downloaded content being executed as code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The evidence shows fetch calls for Ollama model metadata and prompt files, but the bounded context does not establish data flow from those responses into an execution sink. The scanner correlation alone is insufficient to establish a vulnerability or malicious behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:4-331
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This preset points the extension to a local LM Studio service, matching the documented support for local OpenAI-compatible backends.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The evidence shows a fixed localhost endpoint assigned when the user selects the LM Studio preset. It is configuration for an advertised local model provider, not covert external communication or credential handling.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:4171
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged network handling parses streaming responses from the selected OpenAI-compatible model service. This is required to display suggestions as they are generated.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The code processes server-sent streaming data from the configured chat-completions endpoint and extracts generated content. The candidate is a response-parser location, not evidence of a suspicious link or concealed outbound connection.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:1417
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This signal points to normal parsing of streamed model responses, not a suspicious link or external destination.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The cited operation checks whether a streamed response line uses the standard data-prefixed format before parsing JSON and forwarding generated text to the extension's display callback. No URL construction, credential access, or outbound request is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:1164
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is also ordinary handling of the final piece of a streamed response, rather than a hidden web link.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The cited branch recognizes a trailing data-prefixed stream fragment, parses its JSON payload, and appends model-generated content. The supplied context shows no network destination or sensitive-data transfer.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:1187
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
The flagged code is a list of interface icons and extension settings, not an identified suspicious network operation.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The supplied line is within static category and icon definitions. No network destination, sensitive-data flow, or execution behavior is demonstrated by this evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:104
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code sends the story prompt to the user-selected OpenAI-compatible service to generate suggestions. That is a documented feature of the extension, and the address and optional key come from the user's settings.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The request is made only in the OpenAI generation branch, posts the constructed story context and category prompt to the configured base URL, and adds a bearer token only when the user supplied an OpenAI key. The supplied evidence shows no hidden destination or automatic execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3711
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
The flagged code defines normal visual options for the extension. The evidence does not show a harmful link or network action.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The candidate falls in static icon and configuration declarations. The supplied evidence does not identify a URL, external transmission, credential access, or execution sink at this location.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:106
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This preset selects a local Kobold-compatible service, which is part of the extension’s stated backend support.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The evidence shows a fixed localhost endpoint assigned by an explicit user-selected preset. The destination is local and consistent with documented OpenAI-compatible integration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:4172
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension sends prompts to a user-selected local Ollama service, which matches its documented support for local model backends.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The code derives the Ollama endpoint from an explicit setting, defaults to a loopback service, and posts the generated system and user prompts to its generation API. No credential access or unrelated destination is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:747
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This preset uses a local text-generation service and is consistent with the extension’s documented local backend options.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The code assigns a fixed localhost URL when the corresponding preset is selected. No evidence indicates hidden execution, data export, or an attacker-controlled destination.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:4174
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension sends prompts to a user-configured OpenAI-compatible model endpoint and includes the key the user configured for that endpoint.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The code uses the configured base URL, conditionally adds the configured bearer token, and posts only the generation request payload to the selected chat-completions endpoint. This is consistent with the documented OpenAI-compatible backend feature.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:769
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code contacts the user's local Ollama server when Ollama is selected. It sends the story context for local generation, matching the documented backend option.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The Ollama branch uses a configurable URL, defaults to a local endpoint, posts the selected model and prompts, and executes only when settings select that backend. The evidence does not indicate exfiltration to a fixed third party.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3692
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This preset selects a local vLLM service, matching the advertised support for local OpenAI-compatible endpoints.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The evidence shows a fixed localhost URL configured only after the user selects the vLLM preset. This is proportionate provider configuration rather than suspicious network access.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:4173