TavernKeeper Scan Report

SillyTavern/Extension-GroupGreetings

Commit 52e74dd Reviewed Aug 24, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 30 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (13)

Dependency advisory GHSA-rgw5-rvv9-x895:pkg:cc4debc6cb1f2e1673faaa9b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-4c8g-83qw-93j6:pkg:1372faecb5851c2db1a935f0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-4x5r-pxfx-6jf8:pkg:5d05d295ab71b8b28f6cf3e2 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-h67p-54hq-rp68:pkg:0199d54d4e55594b20539f39 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-5p4m-2wfm-xmqj:pkg:a2732cf17ea59b7c9ad7dcba applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-q3j6-qgpj-74h6:pkg:72c95ab6d027fa66d4c2567c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-fv7c-fp4j-7gwp:pkg:31e02f2120b5c9c2060db33d applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:57256f4b2ff7d21305eae028 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-v39h-62p7-jpjc:pkg:33e1140242e3fdb4577a5fde applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-52cp-r559-cp3m:pkg:cf5cb3ae8e56cb4261cd5e98 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-7p8r-x3mc-p8w7:pkg:936f2f623c05148e5153dbfe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-v2hh-gcrm-f6hx:pkg:65e56d3e94b4e1a92191e9c1 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg:pkg:6c65130e708055c34d924f90 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json

Contextual expected matches (16)

JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a standard pattern used by the Lodash library to find the global JavaScript object. It is not executing any downloaded or user-supplied code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: Line 145 shows Function('return this')() inside Lodash's bundled code, used to resolve the global object (gn = hn || vn || Function('return this')()). This is a well-known pattern in Lodash and many polyfills for obtaining the global scope in a cross-environment manner. It does not evaluate attacker-controlled input and is part of the vendored Lodash dependency.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
File role: generated
Source: dist/index.js:145

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The extension saves group greeting data to character cards through the local SillyTavern API. No credentials or sensitive data are accessed or sent anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: Line 45 in the raw minified bundle shows the extension's save function: calling SillyTavern.getContext(), fetch to '/api/characters/merge-attributes' with getRequestHeaders(), JSON.parse/stringify for character json_data, and lodash set() for group greeting fields. The serialize-environment signal was triggered by getRequestHeaders() and JSON operations, but these are standard SillyTavern API patterns for local same-origin calls. No environment variables, secrets, or credentials are accessed.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: generated
Source: dist/index.js:45

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

The code references to __proto__ are actually defensive checks built into Lodash to prevent prototype pollution attacks, not to cause them.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: The matched lines (863, 1846, 2039, 2788, 2949) are all within Lodash's bundled utility functions. The code at line 1846 explicitly guards against prototype pollution: if (c === '__proto__' || c === 'constructor' || c === 'prototype') return e. The __proto__ references at other lines are defensive checks (e.g., preventing __proto__ as a key, using Object.defineProperty when __proto__ is encountered). These are Lodash's own mitigations, not exploitable pollution sinks.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.prototype-pollution
File role: generated
Source: dist/index.js:863

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The flagged code is part of the standard React and webpack toolkit bundled into the extension. The pattern detected is a fixed, well-known way for libraries to find the global object across different JavaScript environments, not a way to run untrusted code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The scanner matched the webpack bootstrap global-object polyfill `new Function('return this')()` (visible in the webpack runtime `t.g` helper) and React 18.2.0 internals at the cited line. This is a standard, fixed-expression idiom used by webpack and lodash to obtain the global `this` reference across Node and browser environments. It does not evaluate user-controlled or externally-supplied strings. The extension's own component code (group greetings UI) contains no dynamic execution. This is expected behavior in bundled JavaScript output.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: generated
Source: dist/index.js:45

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

The __proto__ references in the code are Lodash's built-in defenses against prototype pollution, not vulnerabilities.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: Line 9 in the minified bundle contains Lodash's utility functions. The code includes defensive checks: if('__proto__'===c||'constructor'===c||'prototype'===c)return e (function ea), and '__proto__'==n&&tn?tn(e,n,{...}):e[n]=t (function lr). These are Lodash's prototype pollution mitigations that prevent dangerous property assignments, not exploitable sinks.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.prototype-pollution
File role: generated
Source: dist/index.js:9

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

These are standard text-matching patterns used by Lodash for parsing paths and escaping HTML. They do not pose a security risk.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/index.js:68

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

These are standard Lodash text-processing patterns for parsing and escaping. They are safe.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: Line 9 in the minified bundle contains Lodash's regex constants for template compilation, HTML escaping, and path parsing (e.g., /&(?:amp|lt|gt|quot|#39);/g, /[^.[/]]+/g, /^[+]?0x[0-9a-f]+$/i). These are standard bounded patterns with no catastrophic backtracking on typical inputs.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/index.js:9

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The flagged code is from the bundled Lodash library, which uses a standard fixed pattern to detect the global JavaScript object. No user input or external data is passed through this code, so there is no security risk.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The match at line 9 falls within the bundled Lodash library source (identified by its license header and characteristic code). Lodash uses `Function('return this')()` as a fixed expression to determine the root global object in a cross-environment manner. The argument is a constant string literal, not attacker-controlled data, and the result is only used to set up library internals. No untrusted input flows into this construct. This is standard, expected behavior for bundled utility libraries.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: generated
Source: dist/index.js:9

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension saves data to the local SillyTavern server, and the code execution pattern is just standard library code for finding the global object. No remote code is downloaded and run.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The network retrieval is the extension's fetch to '/api/characters/merge-attributes' (local same-origin SillyTavern API). The code execution sink is Function('return this')() from Lodash's global scope resolution. These are unrelated: the fetch posts character attribute data to the local server, and the Function constructor resolves the global object. No fetched content is executed.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: generated
Source: dist/index.js:9-45

JavaScript analysis reported javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is webpack's runtime code for finding the global JavaScript object, not code execution of downloaded content.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: Line 16797 shows the webpack runtime's t.g function which tries globalThis, then falls back to this || new Function('return this')(). This is webpack's standard global object resolution and does not evaluate any remote or user-controlled data.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.opengrep.tavernkeeper.dynamic-execution.javascript-eval
File role: generated
Source: dist/index.js:16797

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension calls the local SillyTavern API to save character data, and the code execution pattern is just Lodash getting the global object. These are unrelated and both legitimate.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The network retrieval is fetch('/api/characters/merge-attributes', ...) at line 17118, which is the extension's own code calling the local SillyTavern server API to save group greeting attributes. The code execution sink is Function('return this')() from Lodash/webpack runtime. These are independent: the fetch targets the local same-origin API and the Function constructor is for global scope resolution. No remote code is fetched and executed.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: generated
Source: dist/index.js:14-17099

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The extension saves group greeting text to character cards using standard JSON operations. No credentials or sensitive environment data are accessed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: Line 17118 shows the extension's save logic: JSON.parse(t.json_data), lodash set() to update group greeting fields, JSON.stringify back, and a POST to the local SillyTavern API. The scanner flagged getRequestHeaders() as serialize-environment, but this is the standard SillyTavern context method for obtaining auth headers for local API calls. No environment variables, credentials, or sensitive data are serialized or exfiltrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: generated
Source: dist/index.js:17118

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged URLs are standard web technology namespace URLs used internally by React-DOM, not suspicious external links.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: generated
Source: dist/index.js:5872

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged URLs are standard web technology namespace identifiers used by React-DOM internally, not links to external websites.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: generated
Source: dist/index.js:18

JavaScript analysis reported javascript.xray.monkey-patch

Expected behavior · high confidence

This is React's standard internal code for setting up component classes and prototypes, not malicious modification of other code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.monkey-patch. The match applies to this repository.

Contextual assessment: Lines 15976-15987 show React's Component class definition: m.prototype.isReactComponent = {}, m.prototype.setState, m.prototype.forceUpdate, and Pure Component prototype chain setup (y.prototype = m.prototype, _.constructor = b). These are React's standard internal prototype assignments for its component system, not monkey-patching of external objects.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.monkey-patch
File role: generated
Source: dist/index.js:15976

JavaScript analysis reported javascript.xray.monkey-patch

Expected behavior · high confidence

This is React's standard component setup code, not malicious tampering with other software.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.monkey-patch. The match applies to this repository.

Contextual assessment: Line 36 in the minified bundle shows React's Component and PureComponent class definitions: m.prototype.isReactComponent={}, m.prototype.setState, m.prototype.forceUpdate, y.prototype=m.prototype, _.constructor=b, v(_,m.prototype), _.isPureReactComponent=!0. These are React's internal prototype chain setup for its component system, not modification of external or host objects.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.monkey-patch
File role: generated
Source: dist/index.js:36

Related contextual observations

Webpack global-object polyfill uses Function constructor with constant string

low risk · high confidence

The bundled code contains a standard fixed pattern for detecting the global JavaScript object. This is normal in webpack bundles and utility libraries, uses no external input, and does not pose a security risk.

Technical assessment

The webpack runtime helper `t.g` uses `new Function('return this')()` as a fixed-expression fallback to obtain the global object when `globalThis` is unavailable. This pattern also appears in the bundled Lodash library. Both usages involve constant string literals only, with no untrusted or dynamic input. This is a well-known, safe idiom in bundled JavaScript and does not represent exploitable dynamic code execution.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Inventory: 17 files · 1647532 bytes
Contextual coverage: 29 of 29 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 10 files · 238726 bytes
X-Ray review families: 52 warning occurrences compacted to 10 evidence-preserving review families
Representations: 10 raw · 28 decoded · 2 normalized · 0 bundle modules
Stage scans: 10 raw signatures · 10 raw AST · 10 raw OpenGrep · 30 derived signatures · 1 derived AST · 30 derived OpenGrep

Unresolved JavaScript stages

dist/index.js — derived-ast / parse
dist/index.js — normalize / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — not-applicable

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 52e74dd35dd6f1cfe7dbd9ce3b8b6c4a2ac1fba1
Completed: Aug 24, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 3 fresh / 0 reused groups · 16 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 13 deterministic / 16 contextual candidates · 3 contextual / 5 total behavior cases
Model budget: 2 model calls · 3 / 12 fresh cases · 94001 / 200000 estimated input · 96701 / 250000 actual input · 6277 / 40000 output tokens
Review batching: 2 model calls · up to 2 groups and 14 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 96701 input · 6277 output · 2944 cache read · 0 reasoning tokens
Report: cee06c4f031cb8e262df7da28a7399645c14566506ed81d67a4bbed411f19b23