JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner saw text shaped like a web address and flagged it, but it is just the official label browsers require when creating the drawing elements for the skill tree picture. This code never contacts that address or any server.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged string is the standard W3C SVG namespace identifier, declared as a constant and used solely as the namespace argument to the DOM createElementNS API when the skill tree popup draws its connector lines and node graphics. It is an identifier literal required by the platform, not a network endpoint; the module contains no request, fetch, or connection logic and the surrounding code is pure interface rendering and local state manipulation. The link heuristic is a false positive on a well-known namespace URI.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- ui/skillTree.js:39
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file just contains default starting values for a game helper—like sample health, mana, and stat numbers. It has no hidden code, no scrambling, and does nothing beyond providing starter data. The security scanner's 'obfuscated code' alert appears to be a false alarm, likely caused by a harmless invisible byte at the file's beginning.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The flagged file is a plain, readable data module exporting a default preset array for the extension's game-management features: a character template with resource entries (Health, Mana, Stamina, Sanity, Stress, Ammo), attribute entries (Strength, Fortitude, Dexterity, Charisma), empty inventory/skills/passives lists, and two shared party resources. There is no obfuscation, no encoded payloads, no dynamic evaluation, no network access, no file or host-state access, and no execution logic at all—only static literal object definitions. The scanner's obfuscated-code signal (high severity, low confidence) does not correspond to anything in the supplied source: the code is fully human-readable, and the only non-ASCII byte is a UTF-8 BOM at the file start, which likely triggered the heuristic. The 'max: 100+(Level*10)' string is a display/progression formula used by the game system, not executed code in this file.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- settings/defaultPresets.js:1