The flagged code is plain, readable JavaScript for a SillyTavern toast-notification extension. There is no hidden or scrambled code, no suspicious network activity, and no credential handling. The scanner's obfuscation warning is a false positive.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged obfuscated-code with low confidence on line 1, but the supplied source is fully human-readable, well-commented JavaScript. The module imports standard SillyTavern extension APIs, defines a Settings instance, and proceeds to implement toast-history capture by wrapping window.toastr methods. All data flows are local: toast messages are normalized, stored in extension_settings and an in-memory array, rendered into a DOM panel, and optionally exported as a local text file via Blob URL. The only external resource loaded is a same-directory mobile-styles.css referenced via import.meta.url. No network requests, eval, dynamic code execution, credential access, or encoded payloads are present. The interception of toastr is explicitly disclosed in the README and matches the project's stated purpose of restyling and capturing notifications. The watchdog/retry timers are benign re-patching logic for ensuring the toastr wrapper persists.
Toastr interception and watchdog re-patching is expected for the stated purpose
low risk · high confidence
The extension intercepts the app's notification system to capture and restyle messages, which is exactly what the README describes. No data leaves the browser.
Technical assessment
The interceptToastr function wraps window.toastr error/warning/success/info methods, storing originals behind a flag and capturing toast text into local history. This is standard monkey-patching for a notification-history extension and is consistent with the README's stated override behavior. No data is sent to any external destination.