JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension fetches data from an AI model API to produce summaries of roleplay scenes, which is exactly its stated purpose. No evidence of downloading and running hidden code was found in the provided source. The scanner's alert appears to be a broad pattern match that does not correspond to any dangerous behavior visible in the code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flagged a correlation between a network retrieval primitive and a code execution sink across lines 273-917. The visible network retrieval is the callAI function, which uses fetch to POST to an OpenAI-compatible /chat/completions endpoint whose URL is derived from user-configured settings (settings.baseUrl) or borrowed from neighboring extension settings, consistent with the extension's stated purpose of arc summarization. The response is parsed as JSON and only the text content of the model output is extracted and stored. No eval, Function constructor, innerHTML assignment from network data, or other dynamic code execution sink is present in the supplied source. The only setTimeout usage is a benign delay promise. The scanner's wide-range correlation does not identify a concrete execution sink or a data flow from fetch output into code execution. The fetch destination and API key usage are proportionate to the extension's documented summarization feature and are visible in the extension's settings UI.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:273-917