A scanner flagged a line as containing a suspicious link, but the flagged text is just the standard browser blob URL prefix. The code checks whether an image uses a blob URL so it can properly clean up memory. This is normal, correct practice with no network access or data leaving the browser.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The JS-X-Ray shady-link signal fires on line 413, which contains the string literal 'blob:' used in a startsWith check: $img.attr('src')?.startsWith('blob:'). This is the standard browser blob: URL scheme produced by URL.createObjectURL for locally generated object URLs. The code checks for blob: sources before calling URL.revokeObjectURL to free browser memory when deleting or replacing lorebook images. No external URL, fetch, XHR, or network destination is present anywhere in this data flow. The blob: references are entirely local and match the project's stated purpose of storing images locally in IndexedDB and displaying them via object URLs.
A scanner flagged the first line as potentially obfuscated code, but the file is plainly readable, well-commented JavaScript. The alert appears to be a false positive, likely triggered by a Unicode dash character in a comment. There is nothing hidden or suspicious here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal fires on line 1, which is a JSDoc comment containing a Unicode em-dash. The full source is a standard, clearly written ES module that imports helpers, renders a jQuery-based image grid, manages IndexedDB image blobs, and uses a MutationObserver to inject UI into SillyTavern lorebook editors. There is no minification, encoding, eval, string concatenation to hide code, or any other obfuscation technique. All dynamic HTML construction uses escapeHtml on user-controlled values (filenames, labels, entry UIDs, world names). The code matches the stated project purpose of attaching images to lorebook entries.