No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- lib/listener.js:31
Contextual expected matches (12)
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The plugin reads a configuration directory path from the environment to find where Claude stores its login credentials locally. This is needed to refresh login tokens and check quota, which are features described in the README. The path is not sent anywhere external.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The scanner flagged `process.env.CLAUDE_CONFIG_DIR` access on line 29. This is used to locate the Claude CLI's credentials file (`~/.claude/.credentials.json` or a custom config dir), which is necessary for the plugin's stated purpose of OAuth token refresh and quota polling. The environment variable is read locally, not serialized or transmitted anywhere. The credentials path is used only for local file reads/writes for token refresh. No exfiltration, no external destination. This is expected behavior for a subscription proxy that must manage OAuth credentials.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- lib/oauth.js:29
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged line is just the standard way streaming chat APIs mark the end of a response stream. This is normal and correct behavior for a proxy that provides an OpenAI-compatible endpoint, and does not send any data anywhere suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged a 'shady-link' signal at line 550, which corresponds to `res.write('data: [DONE]');` — a standard Server-Sent Events (SSE) stream terminator used in OpenAI-compatible streaming responses. The code is implementing an SSE streaming endpoint for chat completions, writing SSE chunks (role, content, reasoning, finish, error events) and closing with the standard `data: [DONE]` sentinel. This is exactly the expected behavior for a proxy exposing an OpenAI-compatible API as stated in the project purpose. There is no external URL, no network exfiltration, no suspicious destination. The signal is a false positive from the static scanner matching on the SSE format string.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- lib/chat.js:550
JavaScript analysis reported javascript.xray.data-exfiltration
Expected behavior · high confidence
The plugin uses the OS home directory to find Claude's credential file locally. It sends tokens only to Anthropic's official token and quota endpoints, which is required for refreshing login and showing quota — both features described in the README. No credentials go to any third party.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.data-exfiltration. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.data-exfiltration
- File role
- production
- Source
- lib/oauth.js:19
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner found what looks like a key, but it is actually a public application identifier embedded in the official Claude CLI. It is not a password or secret token — it simply tells the Anthropic login server which app is requesting access. Publishing it is normal and harmless.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The gitleaks generic-api-key rule matched the value on line 23, which is the OAuth client identifier constant OAUTH_CLIENT_ID. This is a public OAuth client_id, not a secret API key or access credential. OAuth client IDs are designed to be embedded in distributed client applications and are shipped in the public Claude Code CLI npm package. The comment on line 9 explicitly states this is the same client_id the CLI uses. A client ID alone cannot authenticate or access resources without a corresponding token; it identifies the application to the authorization server. There is no secret exposure, no exfiltration, and no attacker-controlled path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- lib/oauth.js:23
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged link is just the default address of the plugin's own local server. It is a standard localhost URL used for one-click connection to the proxy, not a suspicious external destination.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:45
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The code reads a configuration environment variable to decide whether to skip auto-installing a UI extension. This is a normal, documented setting and does not send any data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The JS-X-Ray serialize-environment signal fired on line 81 where process.env.CLAUDE_SUBSCRIPTION_NO_UI_INSTALL is read via a regex test. This is a read-only configuration check: the value is compared against a fixed set of boolean-like strings and the result controls whether installUiExtension returns early. No environment data is serialized, transmitted, logged, or written to disk. The README explicitly documents this override. This matches the stated project purpose and is visible to users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- plugin.js:81
Credential access and network transmission in one file
Expected behavior · high confidence
The extension reads your Claude login tokens and sends them to Anthropic's own official servers — exactly the servers those tokens are meant for. One call refreshes your login session and the other checks your subscription usage. This is the normal, advertised behavior of the plugin and nothing is sent to any third party.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The scanner flagged credential-source and network-sink co-occurrence in the same file. Tracing the actual data flow: doRefresh reads the refresh token from the local Claude credentials file and sends it via POST to the hardcoded official Anthropic token endpoint for a standard OAuth refresh_token grant. fetchQuota reads the access token and sends it as a Bearer header to the hardcoded official Anthropic usage endpoint. Both destinations are first-party Anthropic URLs, both are the correct and expected endpoints for these credential types, and both behaviors are explicitly described in the project README (automatic OAuth token refresh and quota meter). No credentials are sent to any third-party or non-Anthropic destination. The credentialSummary function deliberately omits secrets and absolute paths. There is no exfiltration, no obfuscation, and no attacker-controlled input path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 5
- Rule
- credential-exfiltration
- File role
- production
- Source
- lib/oauth.js:157
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged link is just the standard localhost address used to run the proxy server on your own machine. It is not an external or suspicious destination.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The shady-link signal fired on line 37 where DEFAULT_HOST is assigned the loopback literal '127.0.0.1'. This address is used as the default bind host for the standalone listener (confirmed at lines 138 and 141). Binding to localhost is the correct and safe default for a local proxy intended to sit alongside SillyTavern. The README documents both the host and port overrides. There is no outbound connection to an external endpoint; the value only configures the local listener's bind address.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- plugin.js:37
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The plugin needs to build the environment for the local Claude command-line tool it runs. Copying the current process environment is the normal way to do this. The code actually goes further and removes sensitive billing keys unless the user explicitly provides one, which is a protective measure. No environment data is sent anywhere external.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- lib/env.js:36
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The scanner flagged fetch calls together with DOM manipulation, but the code only fetches quota data from the local plugin and safely builds UI elements. No downloaded code is ever executed.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The download-to-execution correlation spans lines 34-156, covering the IIFE wrapper, connect function, settings injection, and quota meter. The network retrieval primitives are fetch calls to /api/plugins/claude-subscription/quota and the local endpoint's /v1/usage/quota — both fetching JSON quota data from the plugin's own local server. The 'execution sinks' the scanner detects are DOM manipulation calls (document.createElement, element.append, box.innerHTML='') and jQuery trigger calls (.trigger('change')), not dynamic code execution. No eval, Function constructor, or script injection exists. All user-facing data is set via textContent (safe), and box.innerHTML='' only clears existing content. The fetched JSON is read but never executed as code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:34-156
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged a hardcoded identifier, but it is a public OAuth client ID that the official Claude CLI itself uses. It is not a secret key — it is meant to be embedded in applications. The actual sensitive tokens are read from a local file at runtime, never hardcoded.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The gitleaks match on line 23 is OAUTH_CLIENT_ID, a UUID-format public OAuth client identifier. OAuth client IDs are intentionally embedded in client applications and are not secrets — the OAuth 2.0 protocol relies on the authorization server and refresh tokens for security, not the client ID. The code comment confirms this is the same client_id the Claude Code CLI itself uses. Actual secrets (refreshToken, accessToken) are read at runtime from ~/.claude/.credentials.json via readCredentials(), never hardcoded. The token refresh POST to platform.claude.com sends the client_id alongside the refresh_token, which is standard OAuth 2.0 refresh-token grant flow. No exfiltration or misuse is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- lib/oauth.js:23
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The scanner flagged environment variable access, but the code only reads a few specific configuration variables by name (like port and feature toggles). It does not collect or send out the full environment. These are standard settings documented in the README.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- lib/chat.js:60