No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/core/stscript.js:209
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/core/lorebook.js:340
Contextual expected matches (7)
JavaScript analysis reported javascript.xray.unsafe-import
Expected behavior · high confidence
This is a standard, well-known compression library bundled with the extension. The code at the flagged spot just moves data through a ZIP-compression helper. Nothing here loads other code unexpectedly, contacts the internet, or touches private information.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-import. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-import
- File role
- vendored
- Source
- vendor/fflate.mjs:1963
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This file is a bundled copy of a popular open-source user-interface library (a small React-like tool for building the extension's interface). The scanner flagged it because it saw a web address written into the code, but that address is just the standard official identifier browsers require for drawing SVG graphics — nothing is ever contacted over the network. The file only draws and updates on-screen interface elements; it never sends data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged file is a vendored, minified Preact-plus-HTM rendering library. The scanner's shady-link heuristic was most likely triggered by the embedded SVG namespace identifier string used when creating SVG elements, which is a standard W3C namespace constant, not a network destination. Manual review of the full source shows only DOM rendering, component state management, hooks, and tagged-template HTML parsing. There are no fetch calls, XMLHttpRequest, WebSocket usage, dynamic script loading, or any outbound network data flow. No obfuscation beyond ordinary minification is present, and the exported symbols match the well-known Preact/HTM API surface. The file's role as a vendored UI library is proportionate to the extension's stated purpose of generating roleplay content with an interactive interface.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- vendored
- Source
- vendor/preact-htm.mjs:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged web address is just the standard local address for a ComfyUI image program running on your own computer. The extension uses it to paint portraits, which is an advertised feature, and it sends pictures and image prompts there — nothing secret.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged literal is a default ComfyUI server address on localhost, the same default SillyTavern's own Image Generation extension uses. The file routes image-generation requests through SillyTavern's existing server-side proxy endpoints, plus one direct browser-to-ComfyUI image upload that only targets the user-configured ComfyUI URL. The destination is disclosed, user-configurable, holds no credentials, and directly matches the project's stated ComfyUI portrait feature. No secrets, private chat content, or credential material is sent to any of these endpoints.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/st/comfy.js:14
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged text is a technical identifier that web browsers require when drawing SVG graphics; it tells the browser which drawing format to use and does not cause any internet connection. This is part of a common interface-building library bundled with the extension, and nothing in it sends data anywhere or does anything hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line creates an SVG-namespaced DOM element using the standard W3C SVG namespace identifier string. This namespace URI is a required argument of the browser's element-creation API and is not a network request, fetch target, or resource load. The surrounding vendored file is a Preact/htm UI rendering library that performs virtual-DOM diffing and DOM manipulation only. No network access, data exfiltration, script execution, or credential handling is present in the supplied code; the scanner's link-detection rule matched the namespace URI literal and produced a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- vendored
- Source
- vendor/preact-htm.mjs:515
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged web addresses are the standard local addresses for running AI models on your own computer (LM Studio and Ollama). The extension uses SillyTavern's own secure key storage for API keys and never stores or sends them anywhere unexpected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged literals are default local endpoints for LM Studio and Ollama, used as suggested base URLs for local, key-free OpenAI-compatible backends. All credential handling goes through SillyTavern's own secret-store API endpoints; the extension stores API keys via the host's secret mechanism and references them by id rather than embedding key values in extension settings or profiles. Model lists are fetched through SillyTavern's server-side status endpoint rather than by the extension calling providers directly with credentials. No exfiltration path, no credentials in persisted extension settings, and all destinations are disclosed and consistent with the project's stated provider-configuration purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/st/providers.js:20
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file converts character card files between formats (PNG, CHARX, JSON) so the studio can read and write them. The code is fully readable and does nothing hidden — the scanner's obfuscation warning appears to be a false match on ordinary code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscation signal, but the supplied source is plain, readable JavaScript with clear function names, comments, and straightforward data flow: it parses imported character-card files (PNG chunks, CHARX zip archives, JSON), normalizes them to the V3 card shape, and serializes cards back out for export. There are no encoded blobs, eval-style execution, hidden strings, or obfuscated constructs anywhere in the supplied code. Data stays local within the extension's own card pipeline.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/core/cardio.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A scanning tool guessed this file might hide its purpose, but the actual code shown is clearly written and easy to follow. It takes the user's roleplay project and packages it into files SillyTavern can import. There is nothing hidden, no strange encoding, and no code that runs in the background. The scanner's guess appears to have been tripped by normal-looking pattern-matching text in the code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/core/bundle.js:1