What this review found
No material or immediate-danger item was identified.
Minor cautions
Dependency advisory GHSA-r28c-9q8g-f849:pkg:bae8c729cd012e7cdc762310 applies
Minor caution · high confidence
This is an old version of a build tool (PostCSS) used to process CSS during development. It is not active when you use the extension, so it cannot affect your data or SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849:pkg:bae8c729cd012e7cdc762310 to a dependency declared by this repository.
Contextual assessment: postcss@8.5.8 is listed as a transitive dev dependency (tested via lockfile metadata). It is only used during the pre-build step (webpack/babel bundling) and not shipped to end users. No runtime code path exists in the extension that uses postcss. Advisory GHSA-r28c-9q8g-f849 describes a denial-of-service vulnerability that requires local exploitation; it cannot be triggered by an attacker in this context.
Impact: low · Exploitability: unlikely
Developer action: Update postcss to a patched version (8.5.10+) via npm update or lockfile refresh. While not a runtime risk, updating improves supply-chain hygiene.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r28c-9q8g-f849:pkg:bae8c729cd012e7cdc762310
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:8dfa267b268efc0b662f65f3 applies
Minor caution · high confidence
This is another advisory for the same old PostCSS version. It only exists during development and cannot affect your use.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp:pkg:8dfa267b268efc0b662f65f3 to a dependency declared by this repository.
Contextual assessment: postcss@8.5.8 is listed as a transitive dev dependency. Advisory GHSA-fxqj-rqcc-2cmp is associated with a medium-severity issue. The package is only used during build time and is not present in the distributed extension code.
Impact: low · Exploitability: unlikely
Developer action: Same as above - update postcss to the latest patched version.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp:pkg:8dfa267b268efc0b662f65f3
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-4c8g-83qw-93j6:pkg:1372faecb5851c2db1a935f0 applies
Minor caution · high confidence
This is an outdated library for parsing URIs used by the build tools. It is not active when you use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6:pkg:1372faecb5851c2db1a935f0 to a dependency declared by this repository.
Contextual assessment: fast-uri@3.1.0 is a transitive dev dependency used by various webpack/babel dependencies. It is not used in the extension's runtime code. Advisory GHSA-4c8g-83qw-93j6 requires untrusted URI parsing, which does not occur in the build context.
Impact: low · Exploitability: unlikely
Developer action: Update fast-uri to version 3.1.1 or later via dependency resolution. No runtime risk, but best practice to patch.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4c8g-83qw-93j6:pkg:1372faecb5851c2db1a935f0
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-q3j6-qgpj-74h6:pkg:72c95ab6d027fa66d4c2567c applies
Minor caution · high confidence
Another advisory for the same fast-uri version. It cannot be exploited in normal extension use.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-q3j6-qgpj-74h6:pkg:72c95ab6d027fa66d4c2567c to a dependency declared by this repository.
Contextual assessment: fast-uri@3.1.0 is a dev dependency. Advisory GHSA-q3j6-qgpj-74h6 describes a regular expression denial-of-service. Since the package runs only during closed build pipelines, there is no attacker-controlled input.
Impact: low · Exploitability: unlikely
Developer action: Update fast-uri to a patched version.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-q3j6-qgpj-74h6:pkg:72c95ab6d027fa66d4c2567c
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v39h-62p7-jpjc:pkg:33e1140242e3fdb4577a5fde applies
Minor caution · high confidence
Same fast-uri version with a different advisory. Not a real danger here.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v39h-62p7-jpjc:pkg:33e1140242e3fdb4577a5fde to a dependency declared by this repository.
Contextual assessment: fast-uri@3.1.0 dev dependency. Advisory GHSA-v39h-62p7-jpjc concerns a prototype pollution vulnerability. No runtime exposure as the package is build-only.
Impact: low · Exploitability: unlikely
Developer action: Update fast-uri to 3.1.1+.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v39h-62p7-jpjc:pkg:33e1140242e3fdb4577a5fde
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-6g55-p6wh-862q:pkg:48ce53e19d4b406f8f9515a3 applies
Minor caution · high confidence
Another postcss advisory. Build-only, no risk.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-6g55-p6wh-862q:pkg:48ce53e19d4b406f8f9515a3 to a dependency declared by this repository.
Contextual assessment: postcss@8.5.8 dev dependency. Advisory GHSA-6g55-p6wh-862q. Not runtime reachable.
Impact: low · Exploitability: unlikely
Developer action: Update postcss as above.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-6g55-p6wh-862q:pkg:48ce53e19d4b406f8f9515a3
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-7p8r-x3mc-p8w7:pkg:936f2f623c05148e5153dbfe applies
Minor caution · high confidence
Another fast-uri advisory. No impact on extension users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7:pkg:936f2f623c05148e5153dbfe to a dependency declared by this repository.
Contextual assessment: fast-uri@3.1.0 dev dependency. Advisory GHSA-7p8r-x3mc-p8w7. Build-only.
Impact: low · Exploitability: unlikely
Developer action: Update fast-uri.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7p8r-x3mc-p8w7:pkg:936f2f623c05148e5153dbfe
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679 applies
Minor caution · high confidence
This is an old version of a small library that generates random IDs. It is only used while building the extension, not when you use it.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679 to a dependency declared by this repository.
Contextual assessment: nanoid@3.3.11 is a transitive dev dependency used by various build tool dependencies. Advisory GHSA-28wg-ghj8-5hjv describes an insecure entropy issue. The package is only used during build for generating temporary IDs; it is not present in runtime code.
Impact: low · Exploitability: unlikely
Developer action: Update nanoid to version 3.3.12 or later.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-4x5r-pxfx-6jf8:pkg:25699e8af93adc546e42c0c5 applies
Minor caution · high confidence
This is an old version of Babel, a JavaScript tool used only during development. It does not affect the extension you install.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4x5r-pxfx-6jf8:pkg:25699e8af93adc546e42c0c5 to a dependency declared by this repository.
Contextual assessment: @babel/core@7.29.0 is a dev-only peer dependency used during webpack bundling. Advisory GHSA-4x5r-pxfx-6jf8 is a low-severity issue. The package runs in a closed build environment with no attacker-controlled input.
Impact: low · Exploitability: unlikely
Developer action: Update @babel/core to version 7.29.6 or later. No runtime risk, but recommended.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4x5r-pxfx-6jf8:pkg:25699e8af93adc546e42c0c5
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v2hh-gcrm-f6hx:pkg:65e56d3e94b4e1a92191e9c1 applies
Minor caution · high confidence
Another fast-uri advisory. No user impact.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx:pkg:65e56d3e94b4e1a92191e9c1 to a dependency declared by this repository.
Contextual assessment: fast-uri@3.1.0 is a transitive dev dependency. Advisory GHSA-v2hh-gcrm-f6hx is a high-severity issue in a build-only package. No runtime reachability.
Impact: low · Exploitability: unlikely
Developer action: Update fast-uri to a patched version.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v2hh-gcrm-f6hx:pkg:65e56d3e94b4e1a92191e9c1
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b applies
Minor caution · high confidence
Same old nanoid version as before. No risk.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b to a dependency declared by this repository.
Contextual assessment: nanoid@3.3.11 is a transitive dev dependency. Advisory GHSA-2v37-7h3g-55p8. Build-only, no runtime exposure.
Impact: low · Exploitability: unlikely
Developer action: Update nanoid.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fv7c-fp4j-7gwp:pkg:3392b9f9f798716ce4a425b0 applies
Minor caution · high confidence
A Babel plugin used during development. Not active for users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fv7c-fp4j-7gwp:pkg:3392b9f9f798716ce4a425b0 to a dependency declared by this repository.
Contextual assessment: @babel/plugin-transform-modules-systemjs@7.29.0 is a dev dependency. Advisory GHSA-fv7c-fp4j-7gwp is high severity. This plugin runs only during build, not in the final extension bundle.
Impact: low · Exploitability: unlikely
Developer action: Update the babel package to a patched version. Ensure the overall @babel/plugin-transform-modules-systemjs is upgraded to 7.29.1 or later.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fv7c-fp4j-7gwp:pkg:3392b9f9f798716ce4a425b0
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-qx2v-qp2m-jg93:pkg:993938275fd8c839d24348ad applies
Minor caution · high confidence
Another postcss advisory. No user risk.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-qx2v-qp2m-jg93:pkg:993938275fd8c839d24348ad to a dependency declared by this repository.
Contextual assessment: postcss@8.5.8 dev dependency. Advisory GHSA-qx2v-qp2m-jg93 is medium severity. Build-only.
Impact: low · Exploitability: unlikely
Developer action: Update postcss to a patched version.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-qx2v-qp2m-jg93:pkg:993938275fd8c839d24348ad
- File role
- production
- Source
- package-lock.json
Contextual expected matches (2)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The security scanner found a web address in the code, but it's just a normal part of the React library that handles SVG images. It does not connect to the internet or do anything suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The scanner flagged the presence of a URI string at line 2426, which is the standard SVG namespace URI used by React's internal attribute handling for xlink properties. This is a static string constant in the bundled React runtime code and does not initiate any network request, data exfiltration, or untrusted link resolution. No evidence of malicious intent or actual network access was found; the code is part of normal React DOM attribute processing.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- dist/index.js:2426
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is the same React code, just minified to save space. It's still just setting up SVG support—nothing harmful.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The minified bundle contains identical React internal code as the previous candidate, defining SVG attribute lists and XLink namespace constants. The 'shady-link' signal is triggered solely by the presence of a well-known W3C namespace URL string. No runtime network access, user-controlled data, or malicious data flow is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- dist/index.js:11