JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
An automated scanner flagged this file as possibly containing hidden or scrambled code, but the actual code shown is completely open and readable. It is a normal SillyTavern extension that collects and displays notification history with a themed popup. Nothing is hidden, disguised, or sent anywhere unexpected, and the only 'powerful' thing it does—replacing how notifications look and saving their history—is exactly what the extension advertises it does.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray obfuscation signal (reported with low scanner confidence) is contradicted by the supplied source. The visible file is fully readable, plainly commented, self-documenting extension code: it imports standard SillyTavern extension APIs, defines straightforward constants for toast-level metadata and timing, and implements readable helper functions for HTML escaping, text normalization, timestamp formatting, and Roman numeral conversion. There are no packed or encoded payloads, no string-decoding routines, no dynamic code evaluation, no concealed network destinations, and no minified or renamed identifiers. The remaining data flows shown are proportionate to the stated purpose of a toast-history extension: DOM manipulation for a badge and panel, localStorage for panel size, extension_settings for persisted history and suppression lists, clipboard copy with a fallback, and a local blob download for history export. The interception of the host notification library is explicitly disclosed in the project description and is the extension's stated purpose. No shipped behavior in the supplied evidence matches the obfuscation claim.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.js:1