A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The script downloads and runs the official installer for bun, a well-known JavaScript runtime, only when the preferred npm method is unavailable. This is a standard developer setup script for working on the project's code, not something that runs when users install the extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The flagged line pipes curl output from the official bun.sh install endpoint into bash. This is a development environment setup script, not a runtime artifact loaded by the extension. The script first tries npm install -g bun and only falls back to curl|bash if npm fails, which is the documented official bun installation method. The URL is the well-known bun installer endpoint. This script is for developers working on the repository, not for end users installing the extension. No obfuscation, no external untrusted parameterization, and the behavior is visible and consistent with the script's stated purpose.
This is a test file that loads the extension's built code into a test browser and checks its UI behavior. The scanner flagged it because the test injects and runs JavaScript in a browser, but that is exactly how browser-based tests work. There is no download of code from the internet and no malicious execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner's download-to-execution rule correlated a network retrieval primitive with a code execution sink in the same file. Examining the actual code, this is a Playwright-based UI test file (file) for a Lumiverse Auto Retry extension. The 'SOURCE' variable is read from local built files via readFileSync (per the imports at lines 21-24), not fetched over the network. page.addScriptTag injects that local source into a test browser page, and page.evaluate runs test assertions in the browser context. These are standard Playwright testing primitives. The file contains no external network fetch, no credential handling, no exfiltration, no obfuscation, and no dynamic code evaluation from untrusted input. The execution scope is automation (test harness), and all code flows are confined to the test environment. The scanner's correlation is a false positive: local file read + browser evaluate is inherent to browser testing, not a download-to-execution pattern.
A test file uses a made-up web address as a placeholder so the browser-based tests have a proper origin for storage. No real network connection is made; the test intercepts all requests and serves local HTML. This is normal test setup.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line defines a constant ORIGIN set to a .test TLD used only as a Playwright page origin. The stage() function routes all requests via page.route and fulfills them locally with inline HTML, so no actual outbound network call occurs. The comment explains this is needed because page.setContent leaves the page on about:blank where localStorage throws. This is standard test staging, not a real network destination.
The test reads a single environment variable to find an existing browser for running UI tests, instead of downloading one. No credentials or sensitive data are accessed or sent anywhere. This is a common testing pattern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The flagged line reads process.env.CHROMIUM_PATH to optionally pass an executablePath to chromium.launch in a Playwright test harness. The surrounding comment explains Playwright can be importable without its browser downloaded, so this lets a developer point at a pre-existing browser. Only one environment variable is read for a local test configuration purpose; no environment is serialized, exfiltrated, or transmitted anywhere.
The scanner found some regular expressions that could in theory be slow. However, the code already limits how many times each regex runs and caps how much text each pattern can scan, so there is no real risk of the extension hanging. The text being processed is AI-generated roleplay replies, not hostile input.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Playwright test harness uses addScriptTag and evaluate with locally-sourced extension code
low risk · high confidence
The test reads the extension's built JavaScript from local files and runs it in a test browser, which is normal for UI tests.
Technical assessment
The flagged lines show page.addScriptTag injecting SOURCE (read from local dist files) and page.evaluate running test logic in a Playwright browser context. This is the standard pattern for browser automation tests: load the built extension into a headless browser and assert on its DOM behavior. No remote code is retrieved; the only code executed is the project's own compiled output and inline test assertions.