No material or high-risk concern was identified in this review.
This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.
0 high0 material3 low
What this review found
No material or high-risk item was identified.
Minor cautions
Dependency advisory GHSA-3jxr-9vmj-r5cp applies
Minor caution · medium confidence
A security warning was found in a tool used only during development, not in the extension itself. People who install this SillyTavern extension are not affected because the vulnerable tool is not shipped with it.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.
Contextual assessment: The lockfile declares only devDependencies (eslint, typescript, and related tooling). The project package.json has an empty dependencies object, and the extension ships prebuilt dist artifacts. The matched advisory applies to a transitive development/build dependency that is not included in the shipped extension or loaded at runtime in SillyTavern. The vulnerability does not affect end users who install the extension; it only affects the developer's local build and lint environment.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient to keep the development environment current.
A security warning was found in a development-only tool that is not part of the extension users install. This does not affect people using the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: The lockfile contains only development tooling packages; the extension has zero runtime dependencies and ships prebuilt dist files. This advisory matches a transitive dev dependency in the eslint or typescript toolchain that is never loaded by the extension at runtime. End users installing the extension are not exposed to the vulnerable package.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient to keep the development environment current.
A security warning was found in a build-time tool that does not ship with the extension. Users who install the extension are not affected.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: The lockfile is composed entirely of devDependencies for linting and building. The extension's package.json declares no runtime dependencies and ships prebuilt artifacts, so the advisory-matched transitive package is confined to the developer's build environment and is not present in the installed extension or executed in SillyTavern.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient to keep the development environment current.