Landozo/Extension-SliderMacros

Scanner reason: OSV-Scanner matched advisory GHSA-qj8w-gfj5-8c6v to a dependency declared by this repository.

Contextual assessment: The lockfile declares only yaml as a runtime dependency; all other top-level packages are devDependencies for the webpack/eslint build toolchain. This advisory matches a transitive dependency of that dev-only tooling. The vulnerable code is not bundled into the shipped extension and has no runtime reachability for end users who install the built artifact. Attacker-controlled input does not reach the vulnerable code path during normal extension use.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during the next routine build-tooling refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-qj8w-gfj5-8c6v

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-5c6j-r48x-rmvq to a dependency declared by this repository.

Contextual assessment: The project ships only a webpack bundle plus the runtime yaml dependency. This advisory corresponds to a transitive package within the dev-only build toolchain. The vulnerable code is not included in the distributed extension artifact, so there is no runtime path from extension inputs to the vulnerable function.

Impact: low · Exploitability: unlikely

Developer action: Bump the affected build-tooling dependency to a fixed version when convenient.

Scanner

osv-scanner 2.4.0

Rule

GHSA-5c6j-r48x-rmvq

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-25h7-pfq9-p65f to a dependency declared by this repository.

Contextual assessment: The lockfile root shows yaml as the sole runtime dependency; remaining packages are devDependencies for linting and bundling. This advisory targets a transitive dependency of that dev toolchain. The shipped extension bundle does not contain the vulnerable code, and no extension runtime input reaches it.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during routine maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-25h7-pfq9-p65f

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-2g4f-4pwh-qvx6 to a dependency declared by this repository.

Contextual assessment: Only yaml is declared as a runtime dependency; all other top-level entries are build-time devDependencies. This advisory matches a transitive package pulled in by the webpack or eslint toolchain. The vulnerable code is not present in the distributed extension artifact and is not reachable at runtime.

Impact: low · Exploitability: unlikely

Developer action: Refresh the affected build-tooling dependency to a fixed version when convenient.

Scanner

osv-scanner 2.4.0

Rule

GHSA-2g4f-4pwh-qvx6

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-h67p-54hq-rp68 to a dependency declared by this repository.

Contextual assessment: The extension's runtime dependency surface is limited to yaml. This advisory corresponds to a transitive dependency of the dev-only build or lint toolchain. The vulnerable code does not ship in the extension bundle and has no runtime reachability from extension inputs.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during the next tooling update.

Scanner

osv-scanner 2.4.0

Rule

GHSA-h67p-54hq-rp68

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74 to a dependency declared by this repository.

Contextual assessment: The lockfile root declares yaml as the only runtime dependency; everything else is a devDependency for the build pipeline. This advisory targets a transitive package within that dev toolchain. The vulnerable code is not bundled into the shipped extension and is not reachable at runtime by extension inputs.

Impact: low · Exploitability: unlikely

Developer action: Bump the affected build-tooling dependency to a fixed version when convenient.

Scanner

osv-scanner 2.4.0

Rule

GHSA-23c5-xmqv-rm74

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.

Contextual assessment: The project's sole runtime dependency is yaml; all other top-level packages are devDependencies for webpack, TypeScript, and ESLint. This advisory matches a transitive dependency of that dev-only toolchain. The vulnerable code is not included in the distributed extension artifact, so no extension runtime input reaches it.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version during routine maintenance.

Scanner

osv-scanner 2.4.0

Rule

GHSA-3jxr-9vmj-r5cp

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj to a dependency declared by this repository.

Contextual assessment: The lockfile shows yaml as the only runtime dependency; remaining top-level entries are devDependencies for the build and lint pipeline. This advisory corresponds to a transitive package within that dev toolchain. The vulnerable code does not ship in the extension bundle and is not reachable at runtime.

Impact: low · Exploitability: unlikely

Developer action: Refresh the affected build-tooling dependency to a fixed version when convenient.

Scanner

osv-scanner 2.4.0

Rule

GHSA-7r86-cg39-jmmj

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-6g55-p6wh-862q to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lock file. The root package declares only yaml as a runtime dependency; all other declared packages are devDependencies for build and lint tooling (webpack, eslint, loaders, ts-loader). The shipped SillyTavern extension artifact is a webpack browser bundle, so build-time dev dependencies do not execute in the end-user runtime. Without the specific package name and version, runtime reachability cannot be confirmed, but the project structure strongly suggests this advisory affects a dev or transitive dev dependency with no path into the browser bundle.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version during the next build-tooling refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-6g55-p6wh-862q

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-rf6f-7fwh-wjgh to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lock file. The root package declares only yaml as a runtime dependency; all other declared packages are devDependencies for build and lint tooling. The shipped extension is a webpack browser bundle, so dev dependencies do not execute in the end-user runtime. The specific affected package is not identified in the scanner output, but the dependency structure indicates a dev or transitive dev dependency with no demonstrated runtime reachability.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version during the next build-tooling refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-rf6f-7fwh-wjgh

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-8fgc-7cc6-rx7x to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in this lock file. The root package declares only yaml as a runtime dependency; all other declared packages are devDependencies for build and lint tooling. The shipped extension is a webpack browser bundle, so dev dependencies do not execute in the end-user runtime. The specific affected package is not identified, but the project structure indicates a dev or transitive dev dependency with no demonstrated runtime reachability.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version during the next build-tooling refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-8fgc-7cc6-rx7x

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lock file. The root package declares only yaml as a runtime dependency; all other declared packages are devDependencies for build and lint tooling. The shipped extension is a webpack browser bundle, so dev dependencies do not execute in the end-user runtime. The specific affected package is not identified in the scanner output, but the dependency structure indicates a dev or transitive dev dependency with no demonstrated runtime reachability.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version during the next build-tooling refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-r28c-9q8g-f849

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lock file. The root package declares only yaml as a runtime dependency; all other declared packages are devDependencies for build and lint tooling. The shipped extension is a webpack browser bundle, so dev dependencies do not execute in the end-user runtime. The specific affected package is not identified, but the project structure indicates a dev or transitive dev dependency with no demonstrated runtime reachability.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version during the next build-tooling refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-3v7f-55p6-f55p

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lock file. The root package declares only yaml as a runtime dependency; all other declared packages are devDependencies for build and lint tooling. The shipped extension is a webpack browser bundle, so dev dependencies do not execute in the end-user runtime. The specific affected package is not identified, but the project structure indicates a dev or transitive dev dependency with no demonstrated runtime reachability.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version during the next build-tooling refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-f886-m6hf-6m8v

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-qx2v-qp2m-jg93 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lock file. The root package declares only yaml as a runtime dependency; all other declared packages are devDependencies for build and lint tooling. The shipped extension is a webpack browser bundle, so dev dependencies do not execute in the end-user runtime. The specific affected package is not identified, but the project structure indicates a dev or transitive dev dependency with no demonstrated runtime reachability.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version during the next build-tooling refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-qx2v-qp2m-jg93

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity advisory against a dependency in this lock file. The root package declares only yaml as a runtime dependency; all other declared packages are devDependencies for build and lint tooling. The shipped extension is a webpack browser bundle, so dev dependencies do not execute in the end-user runtime. The specific affected package is not identified in the scanner output, but the dependency structure indicates a dev or transitive dev dependency with no demonstrated runtime reachability.

Impact: low · Exploitability: unlikely

Developer action: Update the flagged dev dependency to a patched version during the next build-tooling refresh.

Scanner

osv-scanner 2.4.0

Rule

GHSA-52cp-r559-cp3m

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency declared in the lockfile of a SillyTavern extension. The project's only runtime dependency is yaml; all other declared dependencies are devDependencies for build tooling (webpack, eslint, ts-loader, loaders). Dev dependencies are not present in the shipped extension artifact that end users install, so the vulnerable code has no runtime reachability in the user's SillyTavern environment. No attacker-controlled input reaches build-time tooling during normal extension use.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient to keep the build environment current.

Scanner

osv-scanner 2.4.0

Rule

GHSA-fxqj-rqcc-2cmp

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26 to a dependency declared by this repository.

Contextual assessment: This high-severity advisory matches a dependency in the lockfile. The project declares only yaml as a runtime dependency; all other packages are devDependencies for the webpack and eslint build toolchain. These packages are not shipped to end users who install the extension, so the vulnerable code is not reachable at runtime and no attacker-controlled input flows to it during normal use.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version to maintain a clean build environment.

Scanner

osv-scanner 2.4.0

Rule

GHSA-3ppc-4f35-3m26

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: This high-severity advisory matches a lockfile dependency. The extension's sole runtime dependency is yaml; remaining packages are devDependencies for build tooling that does not ship with the installed extension. The vulnerable code has no runtime reachability for end users and no attacker input reaches it during extension operation.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner

osv-scanner 2.4.0

Rule

GHSA-mh99-v99m-4gvg

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj to a dependency declared by this repository.

Contextual assessment: This high-severity advisory matches a lockfile dependency. The project's runtime dependency is only yaml; all other packages are devDependencies for the webpack, eslint, and TypeScript build toolchain. These are not present in the shipped extension artifact, so the vulnerable code is not reachable at runtime and no attacker-controlled input flows to it during normal extension use.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version to keep the build toolchain current.

Scanner

osv-scanner 2.4.0

Rule

GHSA-c2c7-rcm5-vvqj

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-48c2-rrv3-qjmp to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory matches a lockfile dependency. The extension declares only yaml as a runtime dependency; all other packages are devDependencies for build tooling. The vulnerable code is not shipped to end users and has no runtime reachability in the installed extension.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner

osv-scanner 2.4.0

Rule

GHSA-48c2-rrv3-qjmp

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-38r7-794h-5758 to a dependency declared by this repository.

Contextual assessment: This low-severity advisory matches a lockfile dependency. The project's only runtime dependency is yaml; all other packages are devDependencies for build tooling that does not ship with the installed extension. The vulnerable code has no runtime reachability for end users.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner

osv-scanner 2.4.0

Rule

GHSA-38r7-794h-5758

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: This high-severity advisory matches a lockfile dependency. The extension's sole runtime dependency is yaml; all other packages are devDependencies for the webpack and eslint build toolchain. These packages are not present in the shipped extension artifact, so the vulnerable code is not reachable at runtime and no attacker-controlled input flows to it during extension operation.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version to maintain a clean build environment.

Scanner

osv-scanner 2.4.0

Rule

GHSA-rgw5-rvv9-x895

File role

production

Source

package-lock.json

Scanner reason: OSV-Scanner matched advisory GHSA-xffm-g5w8-qvg7 to a dependency declared by this repository.

Contextual assessment: This low-severity advisory matches a lockfile dependency. The project declares only yaml as a runtime dependency; all other packages are devDependencies for build tooling. The vulnerable code is not shipped to end users and has no runtime reachability in the installed extension.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner

osv-scanner 2.4.0

Rule

GHSA-xffm-g5w8-qvg7

File role

production

Source

package-lock.json

The root package in this lock file declares yaml as the sole runtime dependency. Every other declared dependency is a devDependency used for webpack bundling, linting, or type definitions. SillyTavern extensions are installed by cloning the repository and loading the bundled output in a browser context; node_modules and devDependencies are not part of the runtime attack surface. The scanner did not identify the specific package names for each advisory, so individual runtime reachability cannot be definitively ruled out, but the overall dependency structure provides no evidence of vulnerable code reaching end users.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency update pass on devDependencies to clear the advisories, and consider adding an automated dependency audit step to the build workflow.

Sources:

• package-lock.json:10-25

The lockfile shows the root project declares only yaml as a runtime dependency. All other packages (eslint, webpack, ts-loader, css-loader, html-loader, style-loader, typescript-eslint, and their transitive dependencies) are devDependencies used solely for building the extension bundle. SillyTavern extensions are installed by end users as built artifacts; the dev dependency tree is not present at runtime. Therefore none of the flagged advisories have runtime reachability or attacker-controlled input paths in the user-facing extension. Confidence is medium rather than high because the scanner removed specific package names and the supplied lockfile source is truncated, preventing exact mapping of each advisory to a specific package version.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency update pass on devDependencies to clear advisory flags and keep the build environment healthy. No urgent action is needed for the safety of extension users.

Sources:

• package-lock.json:10-25