TavernKeeper Scan Report

LenAnderson/SillyTavern-VideoBackgrounds

Commit 6a7a607 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension looks for a video file that matches the selected background image and swaps in a video player instead. The network request just checks whether a local video file exists, and the video element simply plays that file. There is no hidden code execution or data exfiltration—this is exactly what a video background extension should do.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: No change warranted. The fetch and DOM operations are consistent with the extension's stated purpose.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:3-32

Related contextual observations

Background replacement via MutationObserver and same-origin HEAD fetch

low risk · high confidence

The extension watches for background changes and checks for matching video files. This is the core feature working as advertised.

Technical assessment

The replaceBg function uses a MutationObserver on #bg1 to detect background changes, extracts the background image URL via regex, strips the last file extension to derive a candidate video URL, performs a HEAD request to verify existence, and creates a video element if the file is found. This is a straightforward implementation of the extension's documented purpose.

Impact: none · Exploitability: unlikely

Developer action: No change warranted.

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity