No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
The extension uses a regular expression to clean up extra blank lines in chat messages. This specific pattern could slow down the page briefly if given a very carefully crafted piece of text, but since it only processes chat messages you or the AI write, the worst that could happen is a short, temporary freeze that goes away when you refresh the page. It is not a serious security concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex on line 9504 is used to collapse three or more blank lines into two newlines. The pattern `(?:\r?\n[ \t]*){3,}` contains a quantified group with an inner `*` quantifier, which could theoretically cause polynomial backtracking on adversarial text input. However, the input is user- or AI-generated chat content, and the pattern's structure limits the risk to a minor, temporary performance degradation in extreme edge cases. No code execution, data leakage, or persistent harm is possible. The scanner's 'unsafe-regex' signal flags a potential ReDoS vector, but the actual exploitability and impact are very low.
Impact: low · Exploitability: unlikely
Developer action: Consider replacing the regex with a simpler non-regex approach such as splitting the string by newlines and filtering empty or whitespace-only lines, then rejoining with double newlines. Alternatively, add a length check or use a bounded quantifier pattern to eliminate any theoretical ReDoS risk. The current risk is minimal.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:9504
Expected scanner matches (14)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code lets you save NPC data as a JSON file to your computer. It creates a download link inside the webpage and clicks it automatically. This is completely normal and safe, just like clicking "Save As" in a browser. No data is sent anywhere else.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The downloadJsonFile function at line 3884 constructs a data URL with JSON content and triggers a browser download via a temporary anchor element. This is a standard JavaScript pattern for client-side file export, not an external network fetch or form submission. The data URL is built from function-local data and is never sent to an external server or third party. No user-controlled URL is used; the only dynamic part is the JSON content being exported. The scanner signal likely matched the data: URI construction but this is a common, expected pattern in browser extensions for saving user data. There is no network request, no concealed exfiltration, and no attacker-controlled destination. The behavior matches the stated project purpose of exporting NPC bank data.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3884
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension lets you store NPC profiles with pictures. When you turn on 'send portraits to AI,' it includes those pictures (stored as data URIs) in the AI prompt. This is a normal feature for this extension and not a security problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The code checks if an NPC's profile picture (pfp) is a data:image URI before including it in activeNpcImages for AI prompt injection. This is part of the NPC Bank feature that sends NPC portraits to the AI when enabled by the user. The data URIs originate from locally stored NPC data, not from external sources. The static analysis rule 'shady-link' flags this data URI usage, but it is legitimate behavior for the extension's stated purpose of automated NPC tracking and image generation integration. No external network destination is involved; the image data is prepared for injection into the AI prompt context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:9230
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This extension loads its own pictures by checking if they exist, which is normal for displaying a default background. It does not download or run any outside code, so there is no security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The candidate range (lines 855–1262) contains functions such as pruneFutureData, saveProfileToMemory, updateLiveTokenCount, discoverDefaultImages, and UI rendering code. The only network retrieval present is a fetch HEAD request in discoverDefaultImages that probes for static extension image files (e.g., 'default1.png') in a local folder. No dynamic code execution sink (eval, new Function, etc.) is used; the only HTML injection sinks (jQuery .html()) operate on hardcoded or extension-controlled strings without attacker influence. The scanner's correlation of network retrieval with a code execution sink is not supported by the actual code. This is legitimate asset loading within the extension's expected behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:855-1262
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code creates a downloadable file of the user's banned phrases list. It works entirely in the browser and does not send any data to the internet.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3082
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension checks for its own image files and draws UI elements on the screen—normal behavior for an addon. There is no hidden code execution or danger here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The scanner correlated a network retrieval primitive with a code execution sink across a broad range (lines 1010–1475), but the supplied source within that range contains only local fetch calls to extension-bundled images (discoverDefaultImages using HEAD requests) and UI rendering functions. There are no eval, Function constructor, dynamic script injection, or command execution sinks. The fetch is constrained to the extension's own /img/ directory and does not accept user-controlled URLs. No evidence of untrusted data reaching an execution sink exists in the provided code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:1010-1475
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The code checks whether an NPC's picture is a data image (a way to embed images directly). This is used to optionally send NPC images to the AI when the user turns on that setting. It's a normal part of the extension's features and not a security issue.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Line 7631 checks if the NPC's profile picture (pfp) property is a data URI string starting with 'data:image'. This is part of the NPC Bank feature that optionally sends NPC portrait images as base64 data to the AI model when the user enables 'sendPortraitsToAi'. The data originates from locally stored NPC definitions and is used only within the extension's prompt construction. There is no external URL loading, network request, or exfiltration. The scanner signal 'shady-link' is a false positive; the string 'data:image' is a legitimate data URI prefix for embedded images, not a malicious link.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:7631
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:4895
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3755
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension lets you save your custom settings to a file on your computer. The code makes a download link using the data inside your browser—nothing is sent over the internet. This is safe and expected behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:8087
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A security scanner thought this file might have hidden code, but the actual code is just a list of instructions for the AI roleplay extension. There is nothing secret or dangerous here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: JS-X-Ray flagged a long, heavily-escaped template literal in file as potentially obfuscated code. However, the source is a straightforward configuration object containing AI prompt templates for a roleplay extension. There is no concealed execution, dynamic code construction, eval, or hidden data flow. The scanner signal is a false positive caused by the length and escape sequences (\n, ") in legitimate prompt text. The code is clean and directly serves the documented purpose of directing AI narrative generation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The extension includes code to clean up extra blank lines in chat messages so the AI doesn't see messy formatting. The flagged line uses a simple pattern to find three or more empty lines and replace them with a single blank line. This pattern is not dangerous; it just does basic text cleanup.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex /(?:\r?\n[ \t]*){3,}/g is used to collapse sequences of three or more blank lines into a single double line break in chat message content. This regex pattern is linear, containing no nested quantifiers, overlapping alternations, or other constructs known to cause catastrophic backtracking. The scanner's 'unsafe-regex' classification is a false positive for this pattern. The operation is a standard text cleanup step within the extension's message processing pipeline, operating solely on in-memory string data. No external network transmission, credential handling, or sensitive data flow is involved.
Impact: none · Exploitability: unlikely
Developer action: No change needed. The flagged regex is safe and does not pose a ReDoS risk. The scanner alert can be suppressed as a false positive.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:7903
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension stores a default address for a local image-generation tool (ComfyUI) running on your own computer. This is normal and expected for an extension that generates pictures. Nothing is sent to the internet.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged line is a default configuration value for a local ComfyUI server URL (127.0.0.1:8188). This is a standard, expected setting for an extension that offers local image generation. The hardcoded localhost URL is not externally reachable and poses no network risk. No data is sent to an external or unknown destination.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:332
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code lets you download a copy of your custom engine settings as a JSON file to your computer. It does not send your data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:9703
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This is simply a parser that reads AI-generated chat messages to extract story details like world state and NPC info. The security scanner warning is not accurate — the code is straightforward and does exactly what it claims to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray 'obfuscated-code' signal on line 1 (the eslint-disable comment) is a false positive. The entire file is clear, well-commented, and serves its stated purpose: parsing structured data from AI chat messages. There is no minification, encoding, or concealed logic anywhere in the code. The file exports parsing functions that read chat text and return extracted objects; it does not access credentials, network resources, or perform any concealed execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/sidepanel/parsers.js:1