No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.obfuscated-code
Minor caution · low confidence
The file is a large bundled JavaScript artifact, which makes review difficult. The evidence does not establish that the code is hiding harmful behavior, but clearer build output would improve accountability.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner reported obfuscated code with low confidence, while the supplied representation is a large production bundle containing readable identifiers, prompts, and settings. No specific concealed payload, secret harvesting, or malicious persistence is shown.
Impact: low · Exploitability: unlikely
Developer action: Provide an unminified or source-mapped build, document any generated bundling or transformation, and identify dynamic execution sites for focused review.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.js:1
JavaScript analysis reported javascript.download-to-execution
Minor caution · low confidence
The scanner found network access and a possible execution mechanism somewhere in the bundled file, but the supplied excerpt does not show them working together or downloading and running harmful code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The candidate is a correlation signal spanning the bundle, not a demonstrated data flow. The available context shows a frontend extension with configurable model connections and local file reading, but does not identify the retrieval destination, execution sink, trigger timing, input provenance, or payload.
Impact: low · Exploitability: plausible
Developer action: Document and isolate any intentional dynamic execution and network retrieval; otherwise remove unnecessary dynamic execution and add tests or policy controls for downloaded content.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:1-1620
Expected scanner matches (20)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
This section identifies text in responses from several normal AI service formats. It does not show a suspicious link or an attempt to contact an undisclosed destination.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The supplied context shows response-field extraction inside the generation client. It processes provider response structures and returns text or reasoning; no link construction, navigation, or outbound destination is shown at this candidate location.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/api.js:479
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
The flagged text is part of ordinary response parsing for AI output. The supplied evidence does not show it creating or following a suspicious link.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The candidate is within the same deep response extraction logic. It selects textual content from structured completion responses and performs no independent network operation or execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/api.js:480
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The network request sends the selected roleplay context to the AI service chosen in settings and reads the returned stream. The supplied code does not show downloaded content being run as a program.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The shown retrieval is a configured chat-completion request, with an optional user-supplied API key, JSON payload, streaming response parsing, and callback delivery. No dynamic evaluator, command launcher, or execution sink is present in the supplied bounded code window; the scanner correlation is therefore insufficient to establish download-to-execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- src/api.js:308-558
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This creates an SVG chart point for displaying usage statistics in the extension interface. It does not show suspicious network activity or data collection.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The supplied context shows creation of an SVG circle used as a statistics-chart data point, with locally calculated coordinates and presentation attributes. No external destination, credential access, persistence, or concealed execution is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3506
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is normal handling of streamed responses from the custom AI service selected in the extension settings.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged operation checks each server-sent event line, parses JSON response chunks, extracts generated text and reasoning, and forwards them to the UI callback. It does not create a destination or transmit data independently.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:14373
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
The reported signal is located in code handling a confirmation dialog and file reading. The supplied evidence does not show a suspicious destination or harmful use of the detected value.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The retained context around the reported location shows ordinary modal lifecycle, event handlers, timers, and a FileReader utility. Matched literal values were not retained, so the scanner signal cannot be tied to credential collection, exfiltration, or concealed behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:1443
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension sends chat messages to the custom AI endpoint that the user configured, which is its advertised purpose.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The shown request builds a custom endpoint from user settings, posts the selected model and messages, and optionally includes the user-supplied bearer key. The destination is configurable and consistent with an AI-provider integration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:14334
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This creates a graphical highlight circle for the statistics chart. It does not contact a network or expose information.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The supplied code creates an SVG circle element using the browser's SVG namespace and configures presentation attributes and pointer behavior. No destination, user data flow, or execution beyond chart rendering is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/features/feature-stats.js:381
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This draws horizontal guide lines on a usage chart. It is ordinary display code and does not indicate a harmful link.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The code constructs SVG line elements for chart gridlines and assigns visual attributes. The scanner signal is a false positive in this context; no link navigation, network request, sensitive-data flow, or execution behavior is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3560
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This adds a highlighted point to the chart when the user moves over it, so the graph can show which value is selected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The supplied code creates a non-interactive SVG highlight circle for chart hover feedback, styling it and appending it to the chart. It contains no external URL, outbound request, credential handling, or suspicious control flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3574
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
This is ordinary handling of model reasoning and text fields from an AI response. Nothing provided indicates a hidden destination or harmful action.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The evidence shows extraction of provider-specific response parts, including thinking fields, followed by aggregation into response text. It does not demonstrate link use, persistence, credential theft, or code execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/api.js:441
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
The scanner found a generic network-related JavaScript signal, but the supplied evidence does not show a suspicious destination, hidden link, credential theft, or unexpected transmission.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The candidate provides only a scanner rule name, a retained line reference, and an explanation that matched literal values were not retained. The surrounding source shows ordinary extension configuration, including a user-configurable local model endpoint and API routing settings, which is consistent with the stated AI assistant purpose. No actual outbound data flow or concealed destination can be established from the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/session.js:34
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a normal color-format parser used by the theme color picker. The input is matched against a fixed, simple color pattern and the evidence shows no network access, credential handling, or hidden execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression parses bounded-format rgb/rgba color strings using numeric character classes, whitespace, and fixed delimiters. It performs no external I/O or security-sensitive operation. Although the scanner labels it unsafe-regex, the supplied code shows no meaningful catastrophic-backtracking structure or attacker-relevant processing path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/utils/util-colorpicker.js:5
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This adds an SVG chart gridline for the extension's statistics display. Nothing in the shown code accesses accounts or sends information elsewhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The relevant operation creates an SVG line representing a y-axis gridline and inserts it into the statistics visualization. The evidence does not show a link or network destination; the static signal is inconsistent with the demonstrated file role and behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3556
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The code skips empty stream markers and processes actual response data, as expected for streaming AI output.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged conditional filters comments, empty lines, and the stream terminator before parsing data events. This is response-protocol handling and provides no evidence of concealed network activity or credential theft.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:14372
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The supplied material only reports a weak static signal and does not show hidden or harmful behavior. The visible file content is primarily configuration and prompt text for the extension.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The candidate is based on a low-confidence obfuscation detector result, while the supplied source excerpt shows readable exported constants and prompt templates. No obfuscated execution, concealed payload, credential access, persistence, or external exfiltration flow is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/constants.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This creates a horizontal guide line in the usage graph. It is ordinary chart drawing and does not send data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The code constructs an SVG line, sets coordinates and visual styling from locally calculated chart values, and inserts it into the chart. No external destination or credential handling is present in the supplied context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/features/feature-stats.js:363
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is a color-parsing expression that reads ordinary RGB or RGBA style values. The supplied code does not show credential access, data transmission, or harmful execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regular expression parses bounded numeric color components within an rgba-style string. Although the scanner labels it as an unsafe-regex signal, the expression has no nested ambiguous quantifiers or unbounded repeated groups that establish practical catastrophic backtracking in this context. Its use is local UI color parsing and is unrelated to security-sensitive data flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:8583
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This adds numeric labels to the statistics graph. It only affects what is displayed on screen.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The code creates an SVG text node, assigns a locally derived label and presentation attributes, and inserts it into the statistics SVG. The supplied flow shows no network access, persistence, or sensitive-data transmission.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/features/feature-stats.js:367
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This adds small data points to a usage chart. It is normal visual interface behavior and does not indicate a suspicious link or connection.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The code creates SVG circle elements for positive locally calculated statistics, assigns chart coordinates and styling, and inserts them into the graph. No URL, request, credential access, or external data destination is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/features/feature-stats.js:313