No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- tl_style.js:12
Contextual expected matches (18)
JavaScript analysis reported javascript.xray.short-identifiers
Expected behavior · high confidence
This is a tiny compressed helper that copies JavaScript object properties, bundled with a graph library. Its short names are just normal minification, and nothing here reads private data or sends information anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.short-identifiers. The match applies to this repository.
Contextual assessment: The short-identifier signal reflects standard minification of an object-assign polyfill dependency used by the cytoscape-popper module. The extracted source is a small, self-contained property-copy helper with no external communication, no persistence, and no demonstrated use of attacker-controlled input. Short variable names are a minification artifact rather than concealed or malicious behavior, and the evidence does not identify any concrete security impact.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.short-identifiers
- File role
- generated
- Source
- cytoscape-popper.min.js:1
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a standard minified graph-drawing library. The flagged code is a common technique libraries use to detect their host environment; it does not read or send user data.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This candidate is the vendored, minified Cytoscape distribution bundled for timeline graph rendering. The dynamic-execution signal corresponds to a Function-constructor call used by the UMD wrapper to obtain the global object across module, AMD, and browser environments. It runs at load time with no attacker-controlled input, no network destination, and no security-relevant data flow. This is standard boilerplate found in upstream Cytoscape and related bundles, and the evidence does not tie it to user chat content or host state.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- generated
- Source
- cytoscape.min.js:23
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
The scanner flagged a possible suspicious link in a packaged graph-drawing library, but the evidence doesn't show any data being sent anywhere. Loading images for graph nodes is normal for this type of library.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The supplied evidence does not retain the matched literal values for the two shady-link signals, and the visible minified code is consistent with a graph-rendering library that sets image sources for node display. No concrete external destination, credential flow, or private-content transmission path is demonstrated. A heuristic scanner label on a generated vendor bundle is not evidence of exfiltration or malicious linking.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- cytoscape.min.js:32
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This file is the ready-made Cytoscape graph library bundled with the Timelines extension so it can draw its node graphs. The scanner flagged code patterns that can be associated with a class of JavaScript bugs, but in context these are the library's own protective checks, and the extension does not feed untrusted data into these parts of the library. No actual dangerous behavior was shown.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.
Contextual assessment: The flagged occurrence is inside file, a minified vendored build of Cytoscape 3.26.0 used by the extension for graph rendering. The line-level expression is part of the bundled lodash-style hash-table implementation and is matched by a heuristic prototype-pollution rule. The surrounding evidence windows show defensive patterns: hash key handling explicitly rejects the literal "__proto__" value, deep-assignment helpers short-circuit before writing keys named "__proto__", "constructor", or "prototype", and the extension-registration path returns an error for those names with a message about prototype pollution. No evidence shows an attacker-controlled input path reaching these helpers in this project, and no global Object.prototype assignment is demonstrated. The signal describes standard internals of an upstream graphing library, not project-authored malicious or vulnerable code.
Impact: none · Exploitability: unlikely
Developer action: No change required for this finding. If desired for provenance, document the exact upstream Cytoscape version and build source so the vendored file can be compared or updated against future upstream releases.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.prototype-pollution
- File role
- generated
- Source
- cytoscape.min.js:5223
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · medium confidence
This file is a compressed helper library for right-click menus in the timeline view. The scanner pattern is common in minified third-party code, and nothing here shows it receiving untrusted input or sending information anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.
Contextual assessment: JS-X-Ray reported a prototype-pollution signal in this minified UMD bundle. The provided source excerpt shows standard class, DOM, and Babel-helper code for a Cytoscape context-menu UI library. No attacker-controlled object is shown flowing into a merge or assignment sink that could alter the global object prototype, and no network destination or persistence behavior appears in the evidence. The file is a generated third-party UI dependency used to render context menus in the timeline graph, so the heuristic signal is consistent with minified third-party code rather than demonstrated exploitable behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.prototype-pollution
- File role
- generated
- Source
- cytoscape-context-menus.min.js:5
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This flag points at standard boilerplate generated by a build tool to set up class inheritance in a bundled menu library. It never touches your chat data, settings, or credentials, and there is no way for outside input to reach it, so it is not a security issue.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.
Contextual assessment: The flagged assignment is inside the standard Babel transpiler helper that falls back to setting an object's prototype when Object.setPrototypeOf is unavailable. The line sets the __proto__ of a newly created class object to its parent class constructor, which is compiler-supplied, not attacker-controlled. This is part of the bundled cytoscape-context-menus library's class inheritance wiring and appears in its minified build. No untrusted key or value reaches this sink, and no prototype pollution data flow or exfiltration path is shown in the evidence. This is a well-known static-analysis false positive for the prototype-pollution pattern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.prototype-pollution
- File role
- generated
- Source
- cytoscape-context-menus.min.js:286
JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a common compatibility trick used by JavaScript libraries to find the global object in older environments. It runs a fixed, harmless expression and does not execute any user or chat content.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The flagged expression is a standard global-object lookup fallback found in bundled libraries. The constructor receives only a fixed literal string with no runtime or attacker-controlled input, and the result is used solely to access standard built-ins. No dynamic execution of user or chat content is present in the supplied evidence, and no data leaves the page context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
- File role
- generated
- Source
- cytoscape.min.js:581
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged code loads pictures that a timeline graph may show on its nodes. It is simply the graph library fetching image addresses it was given to display, like any web page loading images. The evidence does not show it sending user data or secrets anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged code is Cytoscape's image cache loader, part of the upstream renderer. When a graph node style references a background image, this routine creates an Image object, checks whether the value is a data URI, configures crossOrigin as needed, and assigns the image source URL. This is standard, expected browser image loading for a graph visualization library and matches the project's stated purpose of rendering timeline graphs. The destination of any fetch is the image URL placed in graph data or theme settings, not a fixed collection endpoint, and the path does not carry chat content, credentials, or other private data. No attacker-controlled data flow, hidden telemetry, or exfiltration behavior is demonstrated by the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: None required. This is expected rendering behavior of the bundled upstream library.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- cytoscape.min.js:18501
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · medium confidence
The scanner noticed a common code pattern inside a bundled graph-drawing library. That pattern exists in many normal copies of the library, and the evidence does not show a way for a malicious message or file to actually reach this code and cause harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.
Contextual assessment: The flagged line is lodash's private baseAssignValue helper within the vendored dagre bundle. It explicitly handles the __proto__ key by routing it through defineProperty, which is standard lodash internals present in many bundled builds. The scanner result is a static pattern match on the helper itself, not evidence of an attacker-controlled input reaching this function. The extension processes chat files locally to build graph structures, and the supplied evidence does not show a data flow by which a malicious object with a __proto__ key is passed to this assignment helper. No concrete prototype-pollution exposure or downstream harm is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.prototype-pollution
- File role
- production
- Source
- dagre.js:4818
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code is part of a standard library (lodash) that file bundles. It simply gets a reference to the global object (like 'window' in a browser) using a well-known safe technique. There's no hidden danger.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Line 8683 of file uses `Function('return this')()` to obtain the global object. This is a standard pattern found in lodash (the dagre dependency) to detect the JavaScript runtime global across environments (browser, Node.js, Web Workers). It does not execute user-controlled code or accept any attacker input. The function is created with a fixed string literal and is not influenced by external data. This is expected behavior for a utility library and poses no security risk.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- dagre.js:8683
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
The scanner looked for prototype-pollution tricks, but the visible code already blocks the dangerous key names, and no way for outside data to trigger this was shown.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.
Contextual assessment: The visible expansion shows explicit guards that return early when object-path keys equal reserved names such as prototype-related keys, and the extension-registration code explicitly rejects illegal type names as potential prototype pollution. These flagged sites appear guarded rather than exploitable. No attacker-controlled data flow from chat or timeline content into a prototype-polluting assignment is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.prototype-pollution
- File role
- generated
- Source
- cytoscape.min.js:29
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This is the same standard build-tool boilerplate for class inheritance as the other copy of this bundled file. It does not interact with user data or external input, so it does not create any exploitable risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.
Contextual assessment: The flagged line is the same standard Babel _setPrototypeOf fallback helper (e.__proto__ = t) used to wire class inheritance in the bundled cytoscape-context-menus library. The right-hand side is a parent class constructor provided by the bundler, not runtime or user-controlled data. The provided source shows no attacker-influenced object keys or values reaching this assignment and no other prototype-pollution sink or data flow. The normalized representation differs from the earlier bundle-module view only by formatting and line position, not behavior, so the scanner hit remains a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.prototype-pollution
- File role
- generated
- Source
- cytoscape-context-menus.min.js:310
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension fetches chat data from the same SillyTavern server it's already running on, which is exactly what it needs to do to show your timeline. It does not run any downloaded code or scripts.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The file file contains `fetch` calls to local SillyTavern API endpoints (`/api/characters/chats`, `/api/chats/get`, `/api/chats/group/get`) for retrieving chat data. These are standard network requests that the extension needs to provide timeline visualization. No dynamic code execution (eval, Function, setTimeout with string, or other code execution sinks) is present in this file. The scanner correlation between network retrieval and code execution is a false positive — there is no code execution sink to pair with the fetch calls. All fetches are to the same origin and use authentication headers consistent with SillyTavern's extension API.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- tl_node_data.js:360-427
JavaScript analysis reported javascript.xray.unsafe-import
Expected behavior · high confidence
This file is just a standard graph-drawing library. It doesn't do anything suspicious like sending data out or hiding behavior. The security scanner flagged it because of a generic pattern, but there's no real problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-import. The match applies to this repository.
Contextual assessment: The file is a bundled third-party graph layout library (dagre) used by the Timelines extension for rendering directed graphs. It contains a standard UMD wrapper with internal require() calls to its own modules and a conditional try-catch for the 'graphlib' npm package. No network access, credential handling, persistence, or obfuscated logic is present. The scanner's 'unsafe-import' signal is a generic static analysis flag that does not correspond to any actual security risk in this context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-import
- File role
- production
- Source
- dagre.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
The scanner flagged some complicated text-matching patterns in the packaged library. They process colors and style text locally, and there's no shown way for an attacker to abuse them.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regular expressions are color and string-parsing patterns used for local UI and style values. No remote or attacker-controlled input reaching these regexes with adversarial payloads is demonstrated, and any worst-case regex performance issue would be a recoverable local slowdown rather than meaningful concrete harm. The static unsafe-regex heuristic on minified bundled code does not by itself demonstrate a vulnerability.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- cytoscape.min.js:23
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A scanner thought the file might be deliberately hidden code, but it's just a compressed third-party library with a normal open-source license header. Nothing disguised is shown.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged obfuscated-code with high severity but low confidence. The supplied start of the file shows an MIT license followed by a standard UMD wrapper, and the code is minified rather than obfuscated: no encoded strings, packing, dynamic payload construction, or concealed behavior is visible. This is consistent with a generated vendor bundle for a graph-rendering library, and no malicious behavior is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- generated
- Source
- cytoscape.min.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
The scanner flagged a complicated text-matching pattern inside a bundled graph-drawing library. The pattern is a normal part of that library's code, and there is no evidence that a malicious user could submit input to trigger a problem in this extension.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged line is the rePropName regular expression in lodash's stringToPath helper, packaged inside the vendored dagre bundle. The scanner's unsafe-regex signal matches the regex's complex structure, but this is a well-known lodash internal used to parse property path strings. The supplied evidence does not show that untrusted, attacker-controlled input is fed into this regex, nor that the extension passes externally influenced strings of large or pathological shape into stringToPath. Even if reachable by unusual graph data, the worst indicated consequence would be a local, recoverable performance issue, which does not rise to material harm.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- dagre.js:8976
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This flag points to color-parsing patterns inside a bundled graph library. They only help convert color text into numbers for display and show no sign of being exploitable or sending data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regular expressions are CSS color parsers within a vendored graph-rendering library. They are anchored and use bounded numeric, percentage, and whitespace clauses with no catastrophic backtracking pattern. Input reaches them only from local graph or style data, and the worst plausible outcome is a failed color parse during rendering. No credential, data-exfiltration, persistence, or code-execution path is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- cytoscape.min.js:301