The flagged links are default localhost addresses for local AI servers like Ollama and LM Studio. They are standard, user-configurable placeholders that match the extension's stated purpose of connecting to local LLM providers. No external or suspicious destinations are involved.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner noticed that the code both makes network requests and has something it thinks looks like code execution. In reality, the network requests go to the user's own local AI server, and the responses are simply parsed as JSON to get room names and descriptions. There is no download-then-execute pattern here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive (fetch in providerFetch and fetchProviderModels) with a suspected dynamic execution sink across lines 169-1098. Examining the actual code: fetch calls target user-configured local LLM endpoints (Ollama /api/generate, /api/chat, /api/tags; OpenAI-compatible /v1/completions, /v1/chat/completions, /v1/models). Responses are processed via response.json() and JSON.parse(jsonString) to extract room name and description fields. No eval, Function constructor, innerHTML assignment from network data, or other dynamic code execution sink is present in the supplied source. The correlation is a broad heuristic match between fetch and JSON.parse, not a demonstrated download-to-execution data flow. The behavior matches the extension's stated purpose of calling local LLM providers for room generation.