TavernKeeper Scan Report

TCLowe1982/Marinara-Extender

Commit e2ac670 Reviewed

5 material concerns identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 high 5 material 33 low

What this review found

Dependency advisory GHSA-7p8r-x3mc-p8w7 applies

Material concern · medium confidence

A security scanner found that one of the libraries this project depends on has a known serious security flaw. Because the project runs locally on your machine rather than on the public internet, the risk is reduced, but the flaw is still worth fixing by updating the affected library.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a high-severity known advisory against a dependency declared in this production lockfile. The lockfile shows production dependencies including fastify, undici, and other packages commonly affected by advisories. The project is a local sidecar binding to 127.0.0.1, which limits remote exposure, but a high-severity advisory in a network or parsing library could still be exploitable depending on the specific package and vulnerability. The exact affected package name was stripped from the scanner output, preventing precise data-flow analysis.

Impact: medium · Exploitability: plausible

Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version. Regenerate the lockfile after updating.

Scanner
osv-scanner 2.4.0
Rule
GHSA-7p8r-x3mc-p8w7
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-4c8g-83qw-93j6 applies

Material concern · medium confidence

A second library used by this project has a known serious security issue. The project runs locally which helps, but updating the library is still recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a second high-severity known advisory against a dependency in this production lockfile. The lockfile declares multiple production dependencies that are frequent advisory targets. The local-only binding reduces but does not eliminate risk, particularly if the vulnerability affects request handling, parsing, or path traversal in a library used by the sidecar. The affected package name was removed from scanner output, limiting precise assessment.

Impact: medium · Exploitability: plausible

Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version. Regenerate the lockfile after updating.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4c8g-83qw-93j6
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-c96f-x56v-gq3h applies

Material concern · medium confidence

A security tool found that one of the libraries this project depends on has a known serious security flaw. Because the project runs locally on your machine, the risk is somewhat reduced, but the flaw is still real and the library should be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-c96f-x56v-gq3h to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known high-severity advisory (GHSA-c96f-x56v-gq3h) against a dependency declared in the lockfile with high confidence. The project is a local sidecar binding to loopback, which reduces remote attack surface, but vulnerable dependency code paths may still be reachable through processed inputs or outbound HTTP calls. Without the specific package identity and advisory details, precise impact cannot be determined, but a high-severity advisory match in a production lockfile warrants remediation.

Impact: medium · Exploitability: plausible

Developer action: Run npm audit or osv-scanner with full output to identify the specific package and advisory, then update the affected dependency to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-c96f-x56v-gq3h
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-v2hh-gcrm-f6hx applies

Material concern · medium confidence

A security tool found that one of the project's libraries has a known serious security issue. The project handles text from AI models and makes web requests, so the flaw could potentially be triggered. The library should be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known high-severity advisory (GHSA-v2hh-gcrm-f6hx) against a dependency declared in the lockfile with high confidence. The project processes external AI-generated text and makes outbound HTTP calls to model APIs, so vulnerable code paths in HTTP or parsing dependencies could be reachable. The loopback binding reduces but does not eliminate risk.

Impact: medium · Exploitability: plausible

Developer action: Run npm audit to identify the specific package and update to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v2hh-gcrm-f6hx
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-vxpw-j846-p89q applies

Material concern · medium confidence

A security tool found a serious known flaw in one of the project's dependencies. Because the project handles various types of data and makes web requests, this should be addressed by updating the affected library.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-vxpw-j846-p89q to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known high-severity advisory (GHSA-vxpw-j846-p89q) against a dependency in the lockfile with high confidence. The project parses YAML files, processes AI-generated text, and makes HTTP requests to model endpoints, providing multiple potential entry points for a high-severity vulnerability to be triggered.

Impact: medium · Exploitability: plausible

Developer action: Run npm audit to identify the specific package and update to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-vxpw-j846-p89q
File role
production
Source
memory-extender/package-lock.json

Minor cautions

Dependency advisory GHSA-m8rv-5g2x-5cg5 applies

Minor caution · medium confidence

A library used by this project has a known moderate security issue. Since the project runs only on your local machine, the practical risk is low, but updating the library when convenient is good practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-m8rv-5g2x-5cg5 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lockfile. The project is a local sidecar binding to 127.0.0.1 only, which significantly reduces the attack surface for most dependency vulnerabilities. Without knowing the exact affected package, the medium severity combined with local-only operation suggests limited practical impact, though it remains a weakness worth addressing.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the affected package and update it to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-m8rv-5g2x-5cg5
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-g7r4-m6w7-qqqr applies

Minor caution · medium confidence

A library used by this project has a minor known security issue with low impact. This is a routine update item and poses little practical risk for a locally-run project.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-g7r4-m6w7-qqqr to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in this lockfile. Low-severity advisories typically represent edge-case or limited-impact issues. Combined with the project's local-only binding to 127.0.0.1, the practical risk is minimal. This is a routine maintenance item rather than an active security concern.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version during routine maintenance. Run npm audit for details.

Scanner
osv-scanner 2.4.0
Rule
GHSA-g7r4-m6w7-qqqr
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-8j4g-w8fx-2239 applies

Minor caution · medium confidence

A library used by this project has a known moderate security issue. Because the project runs locally, the practical risk is low, but updating when convenient is recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8j4g-w8fx-2239 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lockfile. The project operates as a local sidecar on 127.0.0.1, limiting exposure. Medium-severity dependency issues in a local-only context represent a minor weakness rather than a material risk, though the specific affected package is unknown from the provided evidence.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the affected package and update it to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8j4g-w8fx-2239
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-g8m3-5g58-fq7m applies

Minor caution · medium confidence

A library used by this project has a minor known security issue. This poses little practical risk and is a routine update item.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-g8m3-5g58-fq7m to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a low-severity advisory against a dependency in this lockfile. Low-severity advisories have limited impact, and the project's local-only binding further reduces practical risk. This is a routine maintenance item.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version during routine maintenance. Run npm audit for details.

Scanner
osv-scanner 2.4.0
Rule
GHSA-g8m3-5g58-fq7m
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-frvp-7c67-39w9 applies

Minor caution · medium confidence

A library used by this project has a known moderate security issue. The local-only nature of the project keeps practical risk low, but updating is recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-frvp-7c67-39w9 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lockfile. The project's local-only operation on 127.0.0.1 limits the attack surface. Without the specific package name, the medium severity in a local context suggests a minor weakness warranting routine updates.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the affected package and update it to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-frvp-7c67-39w9
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-v6wh-96g9-6wx3 applies

Minor caution · medium confidence

A library used by this project has a known moderate security issue. Since the project runs locally, practical risk is low, but updating when convenient is good practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3 to a dependency declared by this repository.

Contextual assessment: OSV-scanner matched a medium-severity advisory against a dependency in this lockfile. The project binds to 127.0.0.1 only, reducing remote attack surface. A medium-severity dependency vulnerability in this local context is a minor weakness rather than a material risk, though routine remediation is still advisable.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the affected package and update it to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v6wh-96g9-6wx3
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-8xcm-r25x-g524 applies

Minor caution · medium confidence

A security tool found a medium-level flaw in one of the project's dependencies. Since the project runs locally and isn't exposed to the internet, the practical risk is low, but updating the library when convenient is good practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8xcm-r25x-g524 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known medium-severity advisory (GHSA-8xcm-r25x-g524) against a dependency in the lockfile. The project binds only to 127.0.0.1 and processes locally generated content, limiting exposure. Medium-severity dependency issues in a loopback-only sidecar represent a low practical risk but should still be patched during routine maintenance.

Impact: low · Exploitability: unlikely

Developer action: Identify the affected package via npm audit and update it to a patched version in a routine dependency refresh.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8xcm-r25x-g524
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-4xrf-jv44-h6hh applies

Minor caution · medium confidence

A security tool found a medium-level flaw in one of the project's dependencies. The risk is low because the project runs locally, but updating the library is recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4xrf-jv44-h6hh to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known medium-severity advisory (GHSA-4xrf-jv44-h6hh) against a dependency in the lockfile. The sidecar's loopback-only binding and local data processing limit the practical exploitability of a medium-severity dependency vulnerability.

Impact: low · Exploitability: unlikely

Developer action: Identify the affected package via npm audit and update it during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4xrf-jv44-h6hh
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-xgm2-5f3f-mvvc applies

Minor caution · medium confidence

A security tool found a medium-level flaw in a dependency. The risk is low given the local-only setup, but updating is good practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xgm2-5f3f-mvvc to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known medium-severity advisory (GHSA-xgm2-5f3f-mvvc) against a dependency in the lockfile. The loopback-only sidecar architecture limits practical exposure to medium-severity dependency issues.

Impact: low · Exploitability: unlikely

Developer action: Identify the affected package via npm audit and update it during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-xgm2-5f3f-mvvc
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-22jq-vg5j-6vgg applies

Minor caution · medium confidence

A security tool found a medium-level flaw in a dependency. The local-only nature of the project keeps the risk low, but the library should be updated when convenient.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-22jq-vg5j-6vgg to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known medium-severity advisory (GHSA-22jq-vg5j-6vgg) against a dependency in the lockfile. The sidecar binds only to loopback and processes local content, reducing the practical risk of a medium-severity dependency vulnerability.

Impact: low · Exploitability: unlikely

Developer action: Identify the affected package via npm audit and update it during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-22jq-vg5j-6vgg
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-w62v-xxxg-mg59 applies

Minor caution · medium confidence

A security tool found a medium-level flaw in a dependency. The risk is low because the project runs locally, but updating the library is recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-w62v-xxxg-mg59 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known medium-severity advisory (GHSA-w62v-xxxg-mg59) against a dependency in the lockfile. The project's loopback-only binding and local data processing limit the practical exploitability of medium-severity dependency vulnerabilities.

Impact: low · Exploitability: unlikely

Developer action: Identify the affected package via npm audit and update it during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-w62v-xxxg-mg59
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-r28c-9q8g-f849 applies

Minor caution · medium confidence

A known security issue was found in one of the libraries this project uses. Because the server only runs locally on your machine and only talks to endpoints you configure, the practical risk is low. Updating the dependency is still recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory against a declared dependency in the lockfile. The project's dependencies include undici and fastify, both of which have had multiple advisories. The server binds to 127.0.0.1 only and makes outbound requests to user-configured endpoints (local Ollama or an optional external API), limiting the attack surface. The vulnerable code path is unlikely to be reachable by an external attacker in this deployment model.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version in package.json and regenerate the lockfile.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r28c-9q8g-f849
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-mwp4-54f8-5fhr applies

Minor caution · medium confidence

A known security issue was found in a library used by this project. Since the server runs locally and only connects to endpoints you set up, the real-world danger is low. The library should still be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mwp4-54f8-5fhr to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory against a declared dependency. The project uses undici for HTTP requests and fastify for its local server, both common sources of advisories. The server is localhost-only and outbound requests target user-configured endpoints, reducing exploitability of most known dependency vulnerabilities in these libraries.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version and regenerate the lockfile.

Scanner
osv-scanner 2.4.0
Rule
GHSA-mwp4-54f8-5fhr
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-hvrm-45r6-mjfj applies

Minor caution · medium confidence

A medium-severity security issue was found in a library this project uses. The local-only nature of the server keeps the practical risk low, but the dependency should be patched.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-hvrm-45r6-mjfj to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory against a declared dependency. The lockfile shows dependencies such as undici, fastify, yaml, and zod. Given the localhost-only binding and user-configured outbound endpoints, the vulnerable code path is unlikely to be exploitable by remote attackers.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version and regenerate the lockfile.

Scanner
osv-scanner 2.4.0
Rule
GHSA-hvrm-45r6-mjfj
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-p88m-4jfj-68fv applies

Minor caution · medium confidence

A medium-severity security issue was found in a library used by this project. Because the server only runs locally, the risk is low. Updating the library is still good practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-p88m-4jfj-68fv to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory against a declared dependency. The project's dependencies include undici and fastify, which are common advisory sources. The localhost-only server binding and user-configured outbound endpoints limit practical exploitability.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version and regenerate the lockfile.

Scanner
osv-scanner 2.4.0
Rule
GHSA-p88m-4jfj-68fv
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-v3r7-h72x-cjcm applies

Minor caution · medium confidence

A medium-severity security issue was found in a library this project depends on. The local-only setup keeps the practical risk low, but the dependency should be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v3r7-h72x-cjcm to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory against a declared dependency. The lockfile includes undici, fastify, yaml, and zod as runtime dependencies. The server binds to 127.0.0.1 and makes outbound requests only to user-configured endpoints, limiting the attack surface for most known dependency vulnerabilities.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version and regenerate the lockfile.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v3r7-h72x-cjcm
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-fx2h-pf6j-xcff applies

Minor caution · medium confidence

A high-severity known issue was found in a library this project uses. Because the server runs only on your local machine and connects only to endpoints you configure, the real-world risk is low. The library should still be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory against a declared dependency. The project uses undici for HTTP client operations and fastify for its local REST server. Both have had multiple advisories. The server binds to localhost only and outbound requests target user-configured endpoints, which significantly reduces the practical exploitability of these known dependency issues.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version and regenerate the lockfile.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fx2h-pf6j-xcff
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Minor caution · medium confidence

A medium-severity security issue was found in a library used by this project. The local-only server setup keeps the practical risk low. Updating the dependency is recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory against a declared dependency. The lockfile shows runtime dependencies including undici, fastify, yaml, and zod. The localhost-only binding and user-configured outbound endpoints limit the practical attack surface for these known dependency vulnerabilities.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version and regenerate the lockfile.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
memory-extender/package-lock.json

Dependency advisory GHSA-35p6-xmwp-9g52 applies

Minor caution · medium confidence

A low-severity security issue was found in a library this project uses. The local-only setup and low severity make the practical risk minimal. Updating is still good hygiene.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-35p6-xmwp-9g52 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a low-severity advisory against a declared dependency. The project's runtime dependencies include undici, fastify, yaml, and zod. The localhost-only server binding and user-configured outbound endpoints further reduce the already-low severity impact.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dependency to a patched version and regenerate the lockfile.

Scanner
osv-scanner 2.4.0
Rule
GHSA-35p6-xmwp-9g52
File role
production
Source
memory-extender/package-lock.json
Expected scanner matches (10)

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

This is just a help document showing users how to install a separate tool. The download-and-run command is a common install instruction written in a README, not something the project runs automatically.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.

Contextual assessment: The flagged content is a markdown code block inside a documentation file (.beads/README.md) describing how to install a third-party issue-tracking tool called Beads. The curl-pipe-to-bash pattern is a standard installation snippet presented as user-facing instructions in documentation, not executable code within the project itself. No code in this repository is invoked by this snippet; it is illustrative text for installing an unrelated tool.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
.beads/README.md:64-65

OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network

Expected behavior · high confidence

This code serves a local JavaScript file over a localhost-only connection when the user has configured a path for it. No passwords or API keys are involved — only a file path from the environment is read, and the file content is sent back. This matches the project's stated purpose of serving local builds.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.

Contextual assessment: The route reads a file path from the MARINARA_RWA_PATH environment variable and serves that file's contents. The environment variable accessed is a filesystem path, not a credential or secret. The server binds to 127.0.0.1 only, and the route is explicitly designed to serve a local Rewrite Assistant build for its auto-update loader. No credential data reaches the network sink.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.credential-exfiltration.javascript-secret-to-network
File role
production
Source
memory-extender/src/setup.ts:379

OpenGrep reported tavernkeeper.dynamic-execution.node-shell

Expected behavior · high confidence

The code runs a fixed git command to find out which version of the software is running, so it can show that information in the panel. The command cannot be changed by any user input, and the result is only used for display. This is a normal and safe way to identify the current build.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell in this repository.

Contextual assessment: The matched execSync call uses a fully static command string (git rev-parse --short HEAD) with no interpolation of user, network, or file content. The working directory is derived deterministically from the package root, a 3-second timeout is set, and stderr is ignored. The result is only used to build a version suffix for diagnostics. There is no command injection vector and no exfiltration or persistence behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.node-shell
File role
production
Source
memory-extender/src/update.ts:52-56

Credential access and network transmission in one file

Expected behavior · high confidence

This code deletes old memory entries from the character's lorebook so it can write fresh ones. It talks only to the local Marinara app on the same machine. No passwords or secret keys are involved anywhere in this code.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The flagged line issues a same-origin DELETE request to the local Marinara lorebook API endpoint to remove existing lorebook entries before recreating two fresh memory entries. This is the core stated functionality of the extension: sweeping and rewriting lorebook entries that hold the memory block. No credentials, secrets, or API keys are read, referenced, or transmitted in this code path. The fetch target is a relative path on the same host, not an external destination. The scanner's co-location heuristic (credential source plus network sink in one file) does not correspond to any credential exfiltration in the shown context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
tavernkeeper 3
Rule
credential-exfiltration
File role
production
Source
marinara-extender.js:4145

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line just checks whether the auto-start feature is currently turned on, so it can show the right status on the menu. It doesn't change anything on its own.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: Line 417 only checks whether an autostart marker file exists to display ON/off status in the console menu. It reads no sensitive data and performs no persistence action itself; it is a display-only status check tied to a user-facing toggle.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
start.ps1:417

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line deletes the auto-start shortcut when the user chooses to turn auto-start off. It's the off-switch for a feature the user deliberately enabled.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: Line 472 removes the autostart launcher file from the Windows startup directory when the user explicitly presses 'A' to disable auto-start. This is the disable half of a user-facing toggle with clear console feedback. Removing a startup entry is the opposite of covert persistence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
start.ps1:478

OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network

Expected behavior · high confidence

This endpoint tells the setup page whether an API key has been configured, but it only sends a yes/no answer — never the actual key. The rest of the data is non-sensitive connection settings. This is normal behavior for a configuration page.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.

Contextual assessment: The GET /api/config endpoint returns connection configuration for the setup page. The API key field is reduced to a boolean via double negation (!!) and trim, so only whether a key is set is disclosed, never the key value itself. The other fields are non-secret model and URL configuration. The server is localhost-only. This is a standard pattern for a setup/status page to display current configuration state.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.credential-exfiltration.javascript-secret-to-network
File role
production
Source
memory-extender/src/setup.ts:403-410

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This code sets up the file path for an optional feature that lets the program start automatically when you log into Windows. It only defines where the startup shortcut would go (in your own user Startup folder) and is described as something you choose to turn on. This is a normal convenience feature for local server tools and does not secretly install itself.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: Lines 25-27 define two path variables pointing to the user's own Windows Startup folder and a .cmd launcher filename. The accompanying comment explicitly states this is an opt-in auto-start feature: a launcher dropped in the user's Startup folder so the local sidecar server starts on boot. The paths are constructed from the user's own APPDATA environment variable, targeting the current user's Startup directory only. No file creation or registry modification is shown in this excerpt—only variable assignment. This is a standard, proportionate pattern for a local service launcher offering auto-start convenience.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
start.ps1:27

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

When the user presses A, this line checks whether auto-start is already on. If so, the next line turns it off. This is a normal on/off toggle the user controls.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: Line 471 is the conditional branch that checks whether the autostart file already exists when the user presses the 'A' key. If it exists, the script removes it (disabling autostart). This is the user-initiated disable path of a clearly disclosed toggle, not covert persistence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
start.ps1:472

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

When the user presses A to turn auto-start on, this line creates a startup shortcut so the memory server launches automatically on login. The script tells the user it did this and how to turn it off. This is a normal optional convenience feature, not hidden behavior.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: Line 478 writes a batch launcher into the Windows startup directory, but only when the user explicitly presses 'A' to enable auto-start. The launcher content is visible in the script: it re-runs start.ps1 minimized with ExecutionPolicy Bypass. The console immediately confirms the action and tells the user how to disable it. This is a standard, disclosed, user-initiated auto-start toggle for a local sidecar server, proportionate to the project's stated purpose of keeping a local memory server running.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
start.ps1:471

Related contextual observations

Mixed use of marinara.apiFetch and raw fetch for lorebook operations

low risk · high confidence

The code uses two slightly different methods to talk to the local app when deleting and unlocking lorebook entries. It works but is inconsistent and could fail silently if the app needs special headers.

Technical assessment

The sweep loop uses marinara.apiFetch for the PATCH unlock call but switches to a raw browser fetch for the DELETE call on the same lorebook endpoint. Both target the same-origin local Marinara API. The raw fetch omits any explicit headers or credentials handling that marinara.apiFetch may provide, which could cause the DELETE to behave differently from other calls if Marinara requires authentication headers. This is a consistency concern, not a security exfiltration issue.

Impact: none · Exploitability: unlikely

Developer action: Use marinara.apiFetch consistently for all lorebook API calls, including the DELETE, to ensure authentication and header handling match the rest of the extension.

Sources:

Multiple dependency advisories concentrated in undici and fastify

low risk · medium confidence

The project uses several libraries that have known security updates available. Because the server only runs locally and only connects to services you set up yourself, the practical danger is low. The developer should update these libraries to their latest patched versions.

Technical assessment

Eight OSV-Scanner advisories were raised against this lockfile. The runtime dependencies include undici and fastify, both of which have accumulated numerous advisories. The project server binds to 127.0.0.1 only and makes outbound HTTP requests to user-configured endpoints (local Ollama or an optional external OpenAI-compatible API). This deployment model substantially limits the practical exploitability of most known dependency vulnerabilities in these libraries. A single dependency update pass would likely resolve all or most of the flagged advisories.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or npm update to identify and upgrade all affected dependencies to patched versions, then regenerate the lockfile and verify the application still works.

Sources:

Static git command for build version identification

low risk · high confidence

The extension runs a simple, unchangeable git command to label the current build. It is used only for showing version information and is not influenced by any user input.

Technical assessment

The execSync invocation passes a literal command string with no external data. The cwd is constrained to a discovered repository root, and failure falls through to a content-hash fallback. This matches the stated purpose of producing a build version string for diagnostics.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

User-initiated auto-start toggle with clear disclosure

low risk · high confidence

The four flagged lines are all part of one feature: an optional auto-start switch the user turns on or off by pressing A. When on, it creates a startup shortcut for the local memory server; when off, it removes it. The script clearly tells the user what it did and how to undo it.

Technical assessment

All four candidates belong to a single user-facing auto-start toggle triggered by pressing 'A' in the console menu. The toggle writes or removes a batch launcher in the Windows startup directory that re-runs start.ps1 minimized. The launcher content is plainly visible in the script, the action is gated behind explicit user input, and the console provides immediate confirmation and instructions to disable. No covert installation, no obfuscation, and the persistence is limited to re-launching the project's own local server.

Impact: low · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity