TavernKeeper Scan Report

prolix-oc/Lumiverse-SimTracker

Commit f88b45e Reviewed Oct 3, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 19 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Minor caution · medium confidence

The scanner flagged the extension running template code on demand. That fits the project's purpose: templates are custom mini-programs users can author or import, and this feature runs a template's data-processing snippet when the template is active. The real concern is only that an imported template shared by someone else could contain unwanted code — but importing someone else's template already runs its script in the page when displayed, so this is a known consequence of the feature, not a hidden one. Nothing in the supplied evidence shows the developer using this to do anything beyond the

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: medium · Exploitability: plausible

Developer action: Document that imported preset JSON can contain executable template logic, and consider gating first execution of a newly imported preset behind an explicit user confirmation and surfacing a visible indicator when a preset's logic block runs. Restricting the sandboxing illusion (for example, removing the Function constructor in favor of a declarative transform, or exposing the logic block in the preset editor for review before activation) would reduce the chance that a user imports executable code unknowingly.

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: production
Source: src/frontend.ts:1107

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

Some pattern-matching expressions in the bundled libraries are written inefficiently. In the worst case a crafted chat message could make parsing slow on the user's own device, which is an annoyance rather than a security breach.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The flagged regexes come from the bundled YAML parser and template lexer: simple anchored alternations for recognizing booleans, numbers, floats, timestamps, and tokens. They operate on message content parsed locally by the extension. The shown patterns are bounded and lack the nested quantifier structure that typically causes catastrophic backtracking, and the worst plausible outcome from an inefficient regex over a chat message would be a temporary slowdown or a stalled tab on the user's own machine, which does not meet material harm.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/frontend.js:1848

Deterministic technical evidence (9)

Dependency advisory GHSA-xhpv-hc6g-r9c6:pkg:4114756074b3c1883ca427a6 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-xjpj-3mr7-gcpf:pkg:2c93c7ce30edf86304d17bbe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-3mfm-83xf-c92r:pkg:146840b9eb3231ae1d463c20 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-2qvq-rjwj-gvw9:pkg:bde04755dd174b8acbe6de92 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-442j-39wm-28r2:pkg:c54738cea96a333e19b8bd79 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-7rx3-28cr-v5wh:pkg:2d05cf734c06fd6d1e77b848 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-9cx6-37pm-9jff:pkg:ca52f57e7f6518348696e910 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-48c2-rrv3-qjmp:pkg:15fc6ff22ccf7f2f103da797 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-2w6w-674q-4c4q:pkg:d25708df68737694eb8e6977 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock

Contextual expected matches (7)

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

The scanner saw code that mentions a well-known dangerous JavaScript property name. In this file, that name appears only in code that blocks the dangerous property from being used. This is a safety feature, not a flaw.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: The flagged lines at line 567 are part of a bundled template library's defensive whitelist: they create a null-prototype lookup object and explicitly mark sensitive built-in names (such as the prototype accessor and legacy getter/setter hooks) as disallowed. This is prototype-pollution mitigation, not pollution. The other cited occurrence is a null-prototype feature check used to decide string encoding, again benign. No untrusted key reaches an object-assignment sink in the shown data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.prototype-pollution
File role: generated
Source: dist/frontend.js:567

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The scanner flagged some text patterns (regular expressions) as possibly slow to evaluate. Looking at the actual code, these are standard pattern checks from a widely used YAML parsing library that the extension bundles to read tracker data. They are simple one-pass checks without the risky repeated-wildcard structure that causes hangs, and the evidence shows no scenario where an attacker could make them freeze a user's session.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The flagged signal originates in the bundled 'yaml' library's stringify and schema code inside the generated backend bundle. Reviewing the actual patterns in the supplied evidence: the scalar-type and number-format tests are simple anchored alternations over short, bounded character classes; the plain-scalar safety check is a flat alternation with no nested quantifiers; the folded-value replace uses bounded literal groups with a negative lookahead; the timestamp pattern is a linear concatenation of digit groups. None of these exhibit nested quantifiers, overlapping alternations, or unbounded backtracking structure characteristic of regular-expression denial of service. No attacker-controlled input path producing catastrophic evaluation is demonstrated, and even a pathological slowdown would be a self-recoverable local condition with low impact under the ecosystem threat model.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/backend.js:8141

JavaScript analysis reported javascript.download-to-execution

Expected behavior · medium confidence

The scanner noticed the file contains both something that can download data and something that can run code. But this is one large file that merges many libraries: the code-running part is the template engine the extension advertises, and the URL handling shown belongs to unrelated bundled code. Nothing in the evidence shows downloaded data being executed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The candidate flags co-occurrence of a network-retrieval primitive and a dynamic code or template-execution sink anywhere within an 18,000-line generated bundle. The visible evidence shows the bundle concatenates many independent libraries (a template engine with its compiler, a YAML parser, source-map URL utilities, and the extension's own tracker parsing code). The template compiler sink matches the project's stated purpose of rendering user-selected Handlebars templates, and the URL-related code shown is regex-based parsing for source-map path resolution, not fetching and executing remote content. No data flow connects a fetched network payload to the execution sink in the supplied windows, so the correlation is a bundling artifact rather than demonstrated download-to-execution behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: generated
Source: dist/frontend.js:36-18852

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner mistook a standard YAML specification identifier for a suspicious web address. It is just a label the YAML parser uses to recognize official YAML data types; nothing is contacted or downloaded.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged occurrences around the cited line are the YAML library's standard tag namespace string (the official YAML tag URI prefix) used for tag declaration and lookup in the bundled parser. These are protocol identifiers required by the YAML specification, not outbound links or suspicious destinations. The project's stated purpose includes parsing YAML tracker blocks, making this library inclusion proportionate. No network request to these literals is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: generated
Source: dist/frontend.js:12716

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

The file is machine-generated output from a build tool, which uses abbreviated helper names that look odd to a scanner. This is the normal shape of a built extension file, not deliberately hidden code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The flagged location is the first line of a standard JavaScript bundler output: short generated helper names (prefixed with double underscores) and module-caching shims typical of esbuild or similar tooling. The README states the repository ships pre-built bundle files rebuilt with a build command, which matches this structure exactly. The visible code is transparent helper logic with no string encoding, packing, or control-flow hiding characteristic of genuine obfuscation. The scanner itself reports low confidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: generated
Source: dist/frontend.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner saw the same internet-looking text repeated many times and flagged it as a possible suspicious link. That text is actually part of the official YAML data format's built-in naming scheme, included because the extension parses YAML tracker data. It is just a label the parser compares against, like a serial number — nothing connects to the internet or sends data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged signal is a static-analysis match on the bundled 'yaml' library inside the generated backend bundle. The 51 repeated string occurrences are YAML specification tag URIs (the standard 'tag:yaml.org,2002:' namespace prefix used for type resolution in the YAML schema code). These are inert literal identifiers used for tag lookup and comparison in schema resolution logic; the supplied evidence window shows them only as keys in tag tables, regex tests, and error-message comparisons. No fetch, network request, URL construction, or outbound data flow is present in the supplied evidence, and the strings are neither resolved nor contacted at runtime.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: generated
Source: dist/backend.js:7333

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The scanner saw a network call near template-rendering code and flagged it as suspicious. In reality, the network call only asks the local app for its version number, and the template rendering is the extension's advertised feature. Nothing is downloaded from the internet and executed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlated a network retrieval primitive with a dynamic code sink in the same file, but the supplied source shows no data flow between them. The only network call is a same-origin fetch to the host's local system-info endpoint, used solely to read a backend version string for a version comparison; the response body is never executed or passed to a code sink. The apparent execution sink is Handlebars template compilation, which matches the project's documented purpose of rendering tracker cards from built-in or user-imported preset templates compiled locally and cached. No remotely retrieved content is compiled or executed. Attacker-controlled LLM output enters only as template data, not as template source, and no exfiltration destination or obfuscation is present in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: production
Source: src/frontend.ts:121-1107

Related contextual observations

Handlebars template compilation of local and user-imported presets

low risk · high confidence

Detailed wording was omitted by the public report safety filter.

Technical assessment

The file compiles Handlebars template sources into executable template functions with a cache. Compilation of template markup is inherent to the project's stated purpose, and template sources come from bundled presets or presets the user deliberately imports. This is disclosed in the project documentation. The behavior only becomes a concern if untrusted template source could be compiled without user action; the supplied evidence does not show such a path.

Impact: low · Exploitability: unlikely

Developer action: Review the cited evidence and confirm the intended behavior.

Sources:

src/frontend.ts:1

Coverage and limitations

Inventory: 61 files · 4651714 bytes
Contextual coverage: 18 of 18 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 10 files · 1702010 bytes
X-Ray review families: 128 warning occurrences compacted to 6 evidence-preserving review families
Representations: 10 raw · 40 decoded · 0 normalized · 0 bundle modules
Stage scans: 10 raw signatures · 4 raw AST · 7 raw OpenGrep · 40 derived signatures · 0 derived AST · 40 derived OpenGrep

Unresolved JavaScript stages

dist/backend.js — derived-ast / parse
dist/backend.js — normalize / parse
dist/frontend.js — derived-ast / parse
dist/frontend.js — normalize / parse
dist/frontend.js — raw-opengrep / parse
src/backend.ts — raw-ast / parse
src/backend.ts — raw-opengrep / parse
src/frontend.ts — raw-ast / parse
src/frontend.ts — raw-opengrep / parse
src/inlineTemplates.ts — raw-ast / parse
src/templatePresets.ts — raw-ast / parse
src/trackerData.ts — raw-ast / parse
src/typesafe.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
OpenGrep could not parse some source files; findings from successfully analyzed files are included.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: f88b45e5804979ab8cd785d0888a841e61f13c44
Completed: Oct 3, 2026
History depth: 2 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 3 fresh / 2 reused groups · 7 fresh / 2 reused candidates
Review source reports: 7292936b53b3faaaebde546f25cc56fe963f10888153154168ebb7287e72564d
Evidence triage: 9 deterministic / 9 contextual candidates · 5 contextual / 7 total behavior cases
Model budget: 3 model calls · 3 / 12 fresh cases · 129642 / 200000 estimated input · 118516 / 250000 actual input · 10378 / 40000 output tokens
Review batching: 3 model calls · up to 2 groups and 5 candidates per call · 1 retry call · 0 over-budget singleton calls
Review usage: 118516 input · 10378 output · 0 cache read · 5490 reasoning tokens
Report: 37dc15f7ca6150bda68dfb233a96239bacb9a574eff8c3781789331de151d9cc