No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- lib/listener.js:31
Contextual expected matches (11)
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension fetches quota information from its own local server and uses it to draw progress bars on the screen. Nothing it downloads is ever run as code. The flagged pattern is just the extension updating the interface, which is exactly what a UI extension is supposed to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive with a code execution sink, but the supplied source shows no path from fetched data to code execution. The only fetch calls request quota JSON from the extension's own same-origin SillyTavern plugin route or the user-configured local endpoint, and the responses are consumed as data to build DOM elements via createElement/textContent. The apparent 'execution' sinks are DOM manipulation (clearing an element with an empty innerHTML assignment) and jQuery trigger calls on hard-coded selector IDs, all targeting the user's own SillyTavern UI to perform the extension's documented one-click-connect function. No eval, Function constructor, script injection, or execution of remote content is present in the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:34-157
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The scanner flagged 'reading the environment' in code that touches login credentials. The line in question only figures out where the Claude CLI stores its login file on your machine (a standard settings location, or a custom folder if configured). Reading that file is unavoidable for the plugin's stated job: refreshing your subscription login token, showing quota usage, and reporting login health. Only the locally installed Claude CLI on your own machine ever sees the credentials; nothing is sent to any third-party site.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The flagged line reads the standard Claude CLI credentials-file location, honoring the documented CLAUDE_CONFIG_DIR override with a home-directory default. This is the documented location the Claude CLI itself maintains; the plugin must read it to perform the stated functions (out-of-band token refresh, quota meter, status health). Serialized credentials are only passed to the same upstream endpoints the CLI uses (the vendor token and usage endpoints with the CLI's public client id); no alternative destination is present. The status summary deliberately excludes secrets and absolute paths.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- lib/oauth.js:29
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner flagged a suspicious web link in the chat-handling code. Looking at the actual code, it only talks to the SillyTavern client that made the request — sending back streaming text, an error message, or a completion summary. No hidden external website is contacted and no chat content or credentials are sent anywhere else.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line only writes a stream-completion sentinel over the existing HTTP response to the SillyTavern client; every destination in the file is the same local response object (SSE chunks, error JSON, usage JSON). No outbound fetch, URL construction, or credential-bearing network call exists in this handler; all model I/O is delegated to the locally loaded SDK and subprocess configuration, which matches the project's documented proxy purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- lib/chat.js:550
JavaScript analysis reported javascript.xray.data-exfiltration
Expected behavior · high confidence
The scanner flagged 'data exfiltration' in the login-handling code. What the code actually does is talk to Anthropic's own official service addresses — the same ones the Claude CLI uses — to refresh your subscription login token and fetch your usage/quota numbers for the panel meter. These are the only external addresses contacted, they are hard-coded (so an attacker cannot redirect them via chat input), and they are exactly what the plugin advertises it does.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.data-exfiltration. The match applies to this repository.
Contextual assessment: The data-exfiltration signal reflects two outbound requests: a refresh-token POST to the vendor platform OAuth token endpoint using the CLI's public client id, and an access-token GET to the vendor usage endpoint for the quota meter. Both destinations are hard-coded constants; request bodies contain only the locally stored refresh token or access token destined for the vendor that issued them, which matches the stated refresh-and-quota functionality. Tokens originate from the local Claude CLI credentials file and are never logged, echoed into responses, or forwarded elsewhere; chat or request content does not influence destination or payload. No attacker-controlled redirection, hidden second channel, or third-party destination exists in the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.data-exfiltration
- File role
- production
- Source
- lib/oauth.js:19
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner saw a string that looks like a key. It is actually a public app ID — the same number the official Claude command-line tool uses to identify itself when renewing a login. It works like a username, not a password: it is meant to be visible in shipped code and knowing it lets nobody into your account.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged constant is an OAuth client identifier in UUID form, not a secret. Public OAuth clients embed their client identifier in distributed code by design; it identifies the application, grants no account access, and cannot authenticate anyone by itself. The supplied source shows this identifier is used only as a field in a standard refresh-token grant posted to the Anthropic token endpoint, mirroring the refresh the Claude Code CLI performs on the same credential file, and the file header states the identifier is the one the CLI itself uses. The scanner's generic pattern matched the identifier's shape and the variable name, which is candidate-locating evidence, not demonstrated credential exposure.
Impact: none · Exploitability: unlikely
Developer action: No code change required; the value is a public OAuth client identifier. Optionally add a secret-scanner allowlist annotation so this known false positive stops recurring.
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- lib/oauth.js:23
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged link is simply the address of the user's own local helper program on the same computer. Using a non-encrypted address for a purely local connection is standard and the address is shown openly in the extension's settings panel.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged literal is the default endpoint constant pointing at a loopback address on a fixed port with an http scheme. This matches the project's stated purpose: the server plugin exposes a local OpenAI-compatible proxy on the user's own machine, and the extension pilots SillyTavern's Custom source at that address. A plaintext scheme to 127.0.0.1 is normal for a local-only service and the value is disclosed to the user in the settings UI where it can be edited.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:45
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The scanner flagged that the code touches environment variables, which sometimes hints at secret-collecting malware. Here the plugin only reads three of its own published settings — which port to use, which network address to bind, and whether to skip an optional panel install. Nothing is gathered up, saved, or sent anywhere; it just uses those values to start up. This is a normal way for a server plugin to read its configuration.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The flagged occurrences are direct reads of three named configuration variables from the process environment: an opt-out flag for the companion panel install, a listener port override, and a listener host override. The values are consumed locally as a boolean branch, a parsed integer, and a bind address; only the resulting host and port appear in a local console startup message. There is no serialization of the environment object, no enumeration of variables beyond the plugin's own documented settings, no credential-bearing variable accessed, and no network transmission, file write, or response exposure of the values. This is ordinary, documented server-plugin configuration and matches the project's stated purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- plugin.js:81
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner flagged a numeric address in the code as potentially suspicious. It is simply the standard "this same computer" address — the conventional way a local helper service listens so that only programs on your own machine can reach it. It is not a strange external destination, and the code never connects out to it; it just tells the local service where to accept connections.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged literal is the standard loopback address used as the default bind host for the plugin's standalone local HTTP listener; it also appears in an informational console message describing the resulting endpoint. A loopback default confines the listener to the local machine and is a restrictive, safety-conscious choice. The file makes no outbound connection to this or any other address; it only configures where the local listener binds, with a documented environment override for advanced setups.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- plugin.js:37
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The scanner flagged 'copying the environment' as a possible way to steal credentials. In reality, this code builds the environment for launching the locally installed Claude command-line tool, which is exactly what the plugin is for. It deliberately removes stray Anthropic keys first so billing stays on your subscription, and only re-adds an API key if you explicitly supplied one for API billing. Nothing is transmitted anywhere; the copy stays in the plugin's own process and is handed to a local tool on your machine.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The signal fires on a spread-copy of process.env, but the copy is confined to the plugin process and consumed as the subprocess environment for the locally installed Claude CLI invocation required by the documented subscription-proxy purpose. The code actively scrubs inherited Anthropic credential and base-URL variables before assignment, pins model-alias and output-limit variables, disables claude.ai MCP connectors for isolation, and only re-introduces an API key when the SillyTavern client explicitly opted into API billing via a validated Bearer header. There is no logging, transmission, or external destination for the serialized environment; this is standard child-process environment construction, not credential theft.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- lib/env.js:36
Credential access and network transmission in one file
Expected behavior · high confidence
Yes, this plugin reads your Claude login file and makes internet requests carrying your login — that is its documented job. Every such request goes only to Anthropic's own servers, either to renew your login or to check how much of your plan's quota you have used, exactly what the project's description advertises. The evidence shows no path by which your credentials are sent anywhere else.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The file does read local OAuth credentials and make outbound requests, but the supplied source confines every credential-bearing request to hardcoded, Anthropic-branded provider endpoints. The refresh routine sends only the existing refresh token to the provider's token endpoint as a standard refresh grant, guards against clobbering a concurrently rotated token, and writes the rotated tokens back to the same local credential file via atomic temp-file rename. The quota routine sends only the access token as a bearer header to the provider's usage endpoint and caches the response. There is no third-party destination, no URL constructed from runtime or untrusted input, and no token value written to logs; the status summary deliberately omits secrets and absolute paths. These flows match the project's stated and README-disclosed purpose of subscription proxying with automatic token refresh and a usage meter, so co-location of a credential source and a network sink in one file is expected architecture for an OAuth client, not exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 5
- Rule
- credential-exfiltration
- File role
- production
- Source
- lib/oauth.js:158
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The flagged code reads the plugin's own settings from its environment variables, such as which port to use and where the Claude tool is installed. This is standard plugin configuration, and nothing suggests those values are sent anywhere they shouldn't go.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The serialize-environment signal fires on process.env access. The supplied source reads only the plugin's own documented configuration variables (a feature flag, an executable path override, and a turn-count limit) to configure the local Claude Agent SDK subprocess. This is the server plugin's stated purpose: it runs the locally installed Claude CLI on the user's machine using their subscription. No environment values are serialized into a network request, logged to an external destination, or written to attacker-reachable storage in the supplied evidence. The env-building helper is imported for constructing the subprocess environment, which is proportionate to the stated purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- lib/chat.js:60