TavernKeeper Scan Report

KritBlade/VectFox

Commit f7ca8ee Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 25 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

Dependency advisory GHSA-5xrq-8626-4rwp applies

Minor caution · medium confidence

The flagged library is part of the project's testing tools, not the actual extension that users install. The security issue is real but only matters when running tests, not when using VectFox in SillyTavern.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5xrq-8626-4rwp to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency declared in a file whose root project (vectfox-tests) lists only devDependencies. The visible lockfile entries are all marked dev: true, indicating test-scope tooling such as Playwright, Vitest, and jsdom. The vulnerable package is not part of the production extension runtime; it is used only during local development and CI testing. Runtime reachability into end-user-facing code is therefore absent.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient; no urgent action required.

Scanner
osv-scanner 2.4.0
Rule
GHSA-5xrq-8626-4rwp
File role
production
Source
package-lock.json

Dependency advisory GHSA-v6wh-96g9-6wx3 applies

Minor caution · medium confidence

The flagged library is used by the project's test suite, not the extension itself. The vulnerability does not affect users who install VectFox.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3 to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory applies to a package within a test-only lockfile (vectfox-tests) where the root project declares exclusively devDependencies. The dependency is consumed by test infrastructure and is not bundled into or executed by the production extension. Attacker-controlled input reaching the vulnerable code path during testing would require a compromised development environment.

Impact: low · Exploitability: unlikely

Developer action: Bump the dev dependency to a non-vulnerable version when convenient; no urgent action required.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v6wh-96g9-6wx3
File role
production
Source
package-lock.json

Dependency advisory GHSA-25h7-pfq9-p65f applies

Minor caution · medium confidence

The affected library is part of the testing toolchain, not the VectFox extension. Even though the advisory is rated high, it does not impact end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-25h7-pfq9-p65f to a dependency declared by this repository.

Contextual assessment: This high-severity advisory matches a transitive dependency of the test toolchain declared in the vectfox-tests lockfile. The root project has only devDependencies, and visible packages carry the dev: true flag. The vulnerable package does not ship with the extension and has no runtime execution path in production. Exploitation would require an attacker to control inputs processed by the test harness itself.

Impact: low · Exploitability: unlikely

Developer action: Update the dev dependency tree to resolve the advisory when convenient; no urgent action required.

Scanner
osv-scanner 2.4.0
Rule
GHSA-25h7-pfq9-p65f
File role
production
Source
package-lock.json

Dependency advisory GHSA-4w7w-66w2-5vf9 applies

Minor caution · medium confidence

The flagged library is used only for testing, not in the extension itself. The vulnerability does not affect users of VectFox.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4w7w-66w2-5vf9 to a dependency declared by this repository.

Contextual assessment: This medium-severity advisory targets a package in a lockfile whose root project lists only devDependencies. The dependency supports test infrastructure (Playwright, Vitest, jsdom ecosystem) and does not execute in the production extension. No end-user-facing data flow reaches the vulnerable code.

Impact: low · Exploitability: unlikely

Developer action: Update the dev dependency when convenient; no urgent action required.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4w7w-66w2-5vf9
File role
production
Source
package-lock.json

Dependency advisory GHSA-23c5-xmqv-rm74 applies

Minor caution · medium confidence

The affected library is part of the testing setup, not the extension. The vulnerability does not reach users who install VectFox.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74 to a dependency declared by this repository.

Contextual assessment: This high-severity advisory matches a transitive dependency pulled in by test tooling in the vectfox-tests lockfile. All root-level packages are devDependencies and visible entries are marked dev: true. The vulnerable code runs only during development or CI and is absent from the shipped extension bundle.

Impact: low · Exploitability: unlikely

Developer action: Resolve the advisory by updating dev dependencies when convenient; no urgent action required.

Scanner
osv-scanner 2.4.0
Rule
GHSA-23c5-xmqv-rm74
File role
production
Source
package-lock.json

Dependency advisory GHSA-3jxr-9vmj-r5cp applies

Minor caution · medium confidence

The flagged library is part of the project's test tools. It does not ship with VectFox and does not affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.

Contextual assessment: This high-severity advisory applies to a dependency within the test-only lockfile. The root project declares exclusively devDependencies and visible packages are flagged dev: true. The package is consumed by test or build tooling and has no production runtime path in the extension.

Impact: low · Exploitability: unlikely

Developer action: Update dev dependencies to patch the advisory when convenient; no urgent action required.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3jxr-9vmj-r5cp
File role
production
Source
package-lock.json

Dependency advisory GHSA-7r86-cg39-jmmj applies

Minor caution · medium confidence

The affected library is used for testing, not in the extension. The vulnerability does not impact VectFox users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj to a dependency declared by this repository.

Contextual assessment: This high-severity advisory matches a transitive dependency in a test-scope lockfile (vectfox-tests) whose root project contains only devDependencies. The vulnerable code executes during testing only and is not part of the production extension runtime. No user-facing data flow reaches the affected package.

Impact: low · Exploitability: unlikely

Developer action: Bump the dev dependency to a patched version when convenient; no urgent action required.

Scanner
osv-scanner 2.4.0
Rule
GHSA-7r86-cg39-jmmj
File role
production
Source
package-lock.json

Dependency advisory GHSA-6g55-p6wh-862q applies

Minor caution · medium confidence

The flagged library is part of the testing toolchain. It is not included in the VectFox extension and does not affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-6g55-p6wh-862q to a dependency declared by this repository.

Contextual assessment: This high-severity advisory targets a dependency in the vectfox-tests lockfile, which has only devDependencies at the root. The package is part of the test toolchain and is not bundled into or executed by the production extension. Exploitation requires control over inputs processed by the development or CI environment, not the extension runtime.

Impact: low · Exploitability: unlikely

Developer action: Update the dev dependency tree when convenient; no urgent action required.

Scanner
osv-scanner 2.4.0
Rule
GHSA-6g55-p6wh-862q
File role
production
Source
package-lock.json

Dependency advisory GHSA-67mh-4wv8-2f99 applies

Minor caution · medium confidence

The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-67mh-4wv8-2f99 to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-67mh-4wv8-2f99
File role
production
Source
package-lock.json

Dependency advisory GHSA-rf6f-7fwh-wjgh applies

Minor caution · medium confidence

The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rf6f-7fwh-wjgh to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-rf6f-7fwh-wjgh
File role
production
Source
package-lock.json

Dependency advisory GHSA-r28c-9q8g-f849 applies

Minor caution · medium confidence

The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r28c-9q8g-f849
File role
production
Source
package-lock.json

Dependency advisory GHSA-3v7f-55p6-f55p applies

Minor caution · medium confidence

The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3v7f-55p6-f55p
File role
production
Source
package-lock.json

Dependency advisory GHSA-mw96-cpmx-2vgc applies

Minor caution · medium confidence

The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mw96-cpmx-2vgc to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-mw96-cpmx-2vgc
File role
production
Source
package-lock.json

Dependency advisory GHSA-f886-m6hf-6m8v applies

Minor caution · medium confidence

The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-f886-m6hf-6m8v
File role
production
Source
package-lock.json

Dependency advisory GHSA-qx2v-qp2m-jg93 applies

Minor caution · medium confidence

The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-qx2v-qp2m-jg93 to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-qx2v-qp2m-jg93
File role
production
Source
package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Minor caution · medium confidence

The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev dependency to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
package-lock.json

Dependency advisory GHSA-96hv-2xvq-fx4p applies

Minor caution · high confidence

This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-96hv-2xvq-fx4p to a dependency declared by this repository.

Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.

Impact: none · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version to keep the development environment secure.

Scanner
osv-scanner 2.4.0
Rule
GHSA-96hv-2xvq-fx4p
File role
production
Source
package-lock.json

Dependency advisory GHSA-3ppc-4f35-3m26 applies

Minor caution · high confidence

This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26 to a dependency declared by this repository.

Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.

Impact: none · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version to keep the development environment secure.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3ppc-4f35-3m26
File role
production
Source
package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg applies

Minor caution · high confidence

This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.

Impact: none · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version to keep the development environment secure.

Scanner
osv-scanner 2.4.0
Rule
GHSA-mh99-v99m-4gvg
File role
production
Source
package-lock.json

Dependency advisory GHSA-58qx-3vcg-4xpx applies

Minor caution · high confidence

This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-58qx-3vcg-4xpx to a dependency declared by this repository.

Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.

Impact: none · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version to keep the development environment secure.

Scanner
osv-scanner 2.4.0
Rule
GHSA-58qx-3vcg-4xpx
File role
production
Source
package-lock.json

Dependency advisory GHSA-c2c7-rcm5-vvqj applies

Minor caution · high confidence

This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj to a dependency declared by this repository.

Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.

Impact: none · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version to keep the development environment secure.

Scanner
osv-scanner 2.4.0
Rule
GHSA-c2c7-rcm5-vvqj
File role
production
Source
package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895 applies

Minor caution · high confidence

This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.

Impact: none · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version to keep the development environment secure.

Scanner
osv-scanner 2.4.0
Rule
GHSA-rgw5-rvv9-x895
File role
production
Source
package-lock.json

Dependency advisory GHSA-fx2h-pf6j-xcff applies

Minor caution · high confidence

This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff to a dependency declared by this repository.

Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.

Impact: none · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version to keep the development environment secure.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fx2h-pf6j-xcff
File role
production
Source
package-lock.json
Expected scanner matches (0)

None.

Related contextual observations

All advisories reside in a test-only lockfile with no production dependencies

low risk · medium confidence

This lockfile is for testing tools only — it has no production dependencies at all. All eight security alerts are in libraries used to run tests, not in the VectFox extension that users install.

Technical assessment

The root project in this lockfile is named vectfox-tests and declares exclusively devDependencies (Playwright, Vitest, jsdom, and their transitive trees). All visible package entries carry the dev: true flag. No production dependencies are declared at the root. Consequently, every advisory matched by OSV-Scanner affects packages that execute only during development or CI, not in the SillyTavern extension runtime.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Lockfile is test-only with devDependencies exclusively

low risk · medium confidence

The lockfile is for a test-only package that only pulls in developer testing tools, not the extension itself.

Technical assessment

The root package is named vectfox-tests and declares only devDependencies such as playwright, vitest, jsdom, and jieba-wasm. Every resolved package visible in the supplied source is marked dev true. This lockfile appears to serve the test suite, not the shipped extension bundle. Dependency advisories in this lockfile therefore have no production runtime reachability for end users of the extension.

Impact: low · Exploitability: unlikely

Developer action: Confirm that this lockfile is not used to build or bundle the shipped extension and that no production runtime code imports from these devDependencies.

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity