TavernKeeper Scan Report

prolix-oc/Lumiverse-SimTracker

Commit 53fdb4d Reviewed Oct 10, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 22 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Minor caution · medium confidence

The scanner flagged the extension running template code on demand. That fits the project's purpose: templates are custom mini-programs users can author or import, and this feature runs a template's data-processing snippet when the template is active. The real concern is only that an imported template shared by someone else could contain unwanted code — but importing someone else's template already runs its script in the page when displayed, so this is a known consequence of the feature, not a hidden one. Nothing in the supplied evidence shows the developer using this to do anything beyond the

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: medium · Exploitability: plausible

Developer action: Document that imported preset JSON can contain executable template logic, and consider gating first execution of a newly imported preset behind an explicit user confirmation and surfacing a visible indicator when a preset's logic block runs. Restricting the sandboxing illusion (for example, removing the Function constructor in favor of a declarative transform, or exposing the logic block in the preset editor for review before activation) would reduce the chance that a user imports executable code unknowingly.

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: production
Source: src/frontend.ts:1107

Deterministic technical evidence (12)

Dependency advisory GHSA-xhpv-hc6g-r9c6:pkg:4114756074b3c1883ca427a6 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-xjpj-3mr7-gcpf:pkg:2c93c7ce30edf86304d17bbe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-3mfm-83xf-c92r:pkg:146840b9eb3231ae1d463c20 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-2qvq-rjwj-gvw9:pkg:bde04755dd174b8acbe6de92 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-442j-39wm-28r2:pkg:c54738cea96a333e19b8bd79 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-7rx3-28cr-v5wh:pkg:2d05cf734c06fd6d1e77b848 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-xw65-4hp5-5hc7:pkg:f574f967f3584da2dad6ab90 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-9cx6-37pm-9jff:pkg:ca52f57e7f6518348696e910 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-p8wg-vrv2-v86f:pkg:e1c63bbd2ad4c640ea4cae8b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-8r5x-fm3f-whwj:pkg:2bd1afff27c734d16cfca64c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-48c2-rrv3-qjmp:pkg:15fc6ff22ccf7f2f103da797 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-2w6w-674q-4c4q:pkg:d25708df68737694eb8e6977 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock

Contextual expected matches (8)

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The scanner flagged some pattern-matching code as potentially slow. Looking at the actual code, these are the standard text-matching rules the bundled YAML library uses to recognize numbers, dates, and strings. They are simple one-pass checks, not the kind of pattern known to hang, and they only process the small tracker snippets the extension reads from chat messages. No actual slowdown or harm is shown.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The unsafe-regex signal flagged regular expressions in the bundled yaml library's stringifier and schema definitions. The supplied source shows the matched patterns are flat character-class tests and fixed-structure alternations for scalar type detection (plain-string safety check, timestamp, float, int, sexagesimal forms). None of the shown patterns contain nested unbounded quantifiers or ambiguous repetition that could produce catastrophic backtracking, and the inputs they run against are short tracker payloads embedded in chat messages. No demonstrated denial-of-service path or other concrete harm appears in the evidence; at worst this is a code-quality note inside a widely used parsing library that the project's documented YAML support requires.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/backend.js:8171

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

The flagged code is the bundled template library's safety check that blocks a known JavaScript attack technique, not an instance of that technique.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: The matched code is the Handlebars template library's own prototype-pollution defense: it builds null-prototype lookup objects and explicitly marks dangerous members such as __proto__ and __defineSetter__ as disallowed in its method and property whitelists. This is a mitigation, not a pollution sink, and no attacker-controlled object-merge into prototypes is shown in the supplied windows.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.prototype-pollution
File role: generated
Source: dist/frontend.js:567

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The bundle contains both networking code and template-compilation code because it packages several libraries together. The evidence does not show downloaded content being executed, which is what would make this dangerous.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: This is a same-file correlation across an entire ~18,900-line generated bundle. The execution sinks visible in the supplied context are the Handlebars template compiler and its lexer, which the project's stated purpose (rendering Handlebars tracker-card templates) requires. No supplied window shows network-retrieved content being fed into a dynamic evaluation sink; the network primitives and code-generation primitives belong to unrelated bundled libraries in the same artifact.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: generated
Source: dist/frontend.js:36-18882

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner saw many web-address-looking strings and raised a flag. In the supplied code, those strings are just the official naming scheme the YAML format uses internally for its data types, coming from a standard bundled YAML parsing library. They are never used to contact anything over the network; they are only compared against labels inside chat-tracker text the extension already parses.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner's shady-link signal fired on repeated URL-shaped string literals in the bundled output. The supplied source window shows these literals are the standard YAML namespace prefix used by the bundled yaml library's schema tag registry (map, seq, int, float, bool, timestamp, etc.). These are inert identifiers compared against parsed document tags; the evidence shows no fetch, network destination, or outbound data flow anywhere in the window. The flagged values match the stated project purpose, which documents accepting YAML tracker payloads, requiring a YAML parser.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: generated
Source: dist/backend.js:7363

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The file looks 'obfuscated' to a scanner only because it is a build-tool-generated bundle with abbreviated helper names. Nothing in the visible code is actually hidden or disguised.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The matched region is the esbuild-generated bundle prelude: short internal helper names and module-caching shims at the top of a machine-generated file. This pattern is typical of any bundled browser artifact and does not conceal behavior; the file plainly retains readable library module comments and source structure throughout. Scanner confidence is low, and no hidden payload, encoded blob, or evasive control flow appears in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: generated
Source: dist/frontend.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The 'links' the scanner found are standardized YAML type labels embedded in the YAML parsing library, not websites the code contacts.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The 51 matched links are overwhelmingly the YAML specification's standard tag URIs (tag:yaml.org,2002:...) used by the bundled yaml library to identify scalar types, plus source-map URL-parsing patterns in Handlebars' source-map support. These are identifier strings and protocol-matching regexes, not outbound network destinations, and no fetch or transmission to them occurs.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: generated
Source: dist/frontend.js:12746

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · medium confidence

Some regular expressions in the bundled parsing libraries could theoretically be slow on crafted input, but the worst realistic outcome is the extension's own card rendering slowing down briefly, not data loss or exposure.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The flagged regexes are the stock type-matching patterns from the bundled yaml library (number, timestamp, bool, float forms) and the Handlebars lexer tokenizer, plus a small project helper that strips plus signs before YAML parsing. These are standard library patterns operating on short chat-message tracker blocks. Even in a worst-case pathological input, the demonstrated harm would at most be a slowed or hung render of the extension's own UI, which is a self-inflicted local slowdown with low impact. No attacker-controlled remote path or persistent harm is shown.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/frontend.js:1848

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The scanner saw a network call near template-rendering code and flagged it as suspicious. In reality, the network call only asks the local app for its version number, and the template rendering is the extension's advertised feature. Nothing is downloaded from the internet and executed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlated a network retrieval primitive with a dynamic code sink in the same file, but the supplied source shows no data flow between them. The only network call is a same-origin fetch to the host's local system-info endpoint, used solely to read a backend version string for a version comparison; the response body is never executed or passed to a code sink. The apparent execution sink is Handlebars template compilation, which matches the project's documented purpose of rendering tracker cards from built-in or user-imported preset templates compiled locally and cached. No remotely retrieved content is compiled or executed. Attacker-controlled LLM output enters only as template data, not as template source, and no exfiltration destination or obfuscation is present in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: production
Source: src/frontend.ts:121-1107

Related contextual observations

Handlebars template compilation of local and user-imported presets

low risk · high confidence

Detailed wording was omitted by the public report safety filter.

Technical assessment

The file compiles Handlebars template sources into executable template functions with a cache. Compilation of template markup is inherent to the project's stated purpose, and template sources come from bundled presets or presets the user deliberately imports. This is disclosed in the project documentation. The behavior only becomes a concern if untrusted template source could be compiled without user action; the supplied evidence does not show such a path.

Impact: low · Exploitability: unlikely

Developer action: Review the cited evidence and confirm the intended behavior.

Sources:

src/frontend.ts:1

Coverage and limitations

Inventory: 62 files · 4661635 bytes
Contextual coverage: 21 of 21 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 10 files · 1709506 bytes
X-Ray review families: 128 warning occurrences compacted to 6 evidence-preserving review families
Representations: 10 raw · 44 decoded · 0 normalized · 0 bundle modules
Stage scans: 10 raw signatures · 4 raw AST · 7 raw OpenGrep · 44 derived signatures · 0 derived AST · 44 derived OpenGrep

Unresolved JavaScript stages

dist/backend.js — derived-ast / parse
dist/backend.js — normalize / parse
dist/frontend.js — derived-ast / parse
dist/frontend.js — normalize / parse
dist/frontend.js — raw-opengrep / parse
src/backend.ts — raw-ast / parse
src/backend.ts — raw-opengrep / parse
src/frontend.ts — raw-ast / parse
src/frontend.ts — raw-opengrep / parse
src/inlineTemplates.ts — raw-ast / parse
src/templatePresets.ts — raw-ast / parse
src/trackerData.ts — raw-ast / parse
src/typesafe.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
OpenGrep could not parse some source files; findings from successfully analyzed files are included.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 53fdb4d37508317334a6b1ba44b026910b7bd8ad
Completed: Oct 10, 2026
History depth: 3 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 3 fresh / 2 reused groups · 7 fresh / 2 reused candidates
Review source reports: 37dc15f7ca6150bda68dfb233a96239bacb9a574eff8c3781789331de151d9cc
Evidence triage: 12 deterministic / 9 contextual candidates · 5 contextual / 7 total behavior cases
Model budget: 2 model calls · 3 / 12 fresh cases · 95772 / 200000 estimated input · 87840 / 250000 actual input · 2713 / 40000 output tokens
Review batching: 2 model calls · up to 2 groups and 5 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 87840 input · 2713 output · 0 cache read · 528 reasoning tokens
Report: 1f0ececb2820fbb63bfdbe161648087f835a38de839ce68d0d78e4f005319545