No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger0 material7 low
What this review found
No material or immediate-danger item was identified.
Minor cautions
Dependency advisory GHSA-v2hh-gcrm-f6hx applies
Minor caution · low confidence
A security warning was found for a tool used during development. Since the final extension users install is a pre-built file, these development tools do not run on users' machines.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency declared in the lock file. All top-level dependencies in this project are devDependencies used for building a webpack bundle; the shipped artifact is dist/index.js. The visible lock-file entries show dev-only transitive dependencies. Build-time advisories do not affect end users who install the pre-built extension. Without the specific package name it is not possible to confirm runtime reachability, but the project structure strongly indicates these are build-tool dependencies.
Impact: low · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during your next build to keep your development environment current.
A security warning was found for a development tool. The tool is not included in the extension that users actually install and run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in the lock file. The project declares only devDependencies; the shipped extension is a webpack bundle that does not include build tooling. The flagged package is most likely a transitive dependency of eslint, webpack, or a loader, all of which are dev-only and not present in the distributed artifact.
Impact: low · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during your next build.
A security warning was found for a development dependency. These tools are used to build the extension but are not shipped to users. If the warning affects the PDF rendering library, updating it would be important.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in the lock file. All declared dependencies are devDependencies for the build pipeline. The extension ships a pre-built webpack bundle, so build-time dependency vulnerabilities do not reach end users. If this advisory pertains to pdfjs-dist, which is bundled into the output, the developer should verify the patched version is used; however the specific package could not be confirmed from the supplied evidence.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dependency to a patched version. If it is pdfjs-dist, prioritize the update since that library is bundled into the shipped extension.
A medium-severity security warning was found for a development tool. Since the tool is not part of the extension users install, the risk to users is low.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory matches a dependency in the lock file. The project uses only devDependencies for its webpack build pipeline. The distributed extension is a pre-built bundle that does not include build tooling, so this advisory most likely does not affect end users.
Impact: low · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during your next build.
A security warning was found for a development dependency that is not included in the extension users install.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in the lock file. All top-level dependencies are devDependencies. The shipped artifact is a webpack bundle that excludes build tooling. The flagged package is most likely a transitive dev dependency with no runtime reachability for end users.
Impact: low · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during your next build.
A security warning was found for a development dependency. If it affects the PDF rendering library that gets bundled into the extension, updating it would matter; otherwise it only affects the build environment.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in the lock file. The project declares only devDependencies and ships a pre-built webpack bundle. Build-time dependency vulnerabilities do not affect the distributed extension. If this advisory pertains to pdfjs-dist, which is bundled into the output, the developer should verify and update; the specific package could not be confirmed from the supplied evidence.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dependency to a patched version. If it is pdfjs-dist, prioritize the update since that library is bundled into the shipped extension.
All project dependencies are devDependencies in a webpack-built extension
low risk · medium confidence
All the libraries in this project are development tools used to build the extension. The extension users install is a single pre-built file. Most security warnings here only affect the developer's build environment. The one exception is the PDF rendering library, which gets bundled into the extension and processes files users upload.
Technical assessment
The package.json declares only devDependencies including eslint, webpack-cli, css-loader, html-loader, style-loader, ts-loader, typescript-eslint, and pdfjs-dist. The manifest ships dist/index.js as the sole runtime artifact. Build tooling advisories have no runtime reachability for end users. The one dependency that gets bundled into the output is pdfjs-dist, which processes user-supplied PDF files; if any of the six advisories pertain to pdfjs-dist, runtime reachability exists because attacker-controlled PDF content flows through it. The scanner removed package names, so individual advisory-to-package mapping could not be confirmed from the supplied evidence.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify which specific packages these advisories map to. If any affect pdfjs-dist, update it promptly since that library is bundled and processes user-supplied PDFs. For all others, update during the next routine build.