What this review found
No material or immediate-danger item was identified.
Minor cautions
Dependency advisory GHSA-v6h2-p8h4-qcjw applies
Minor caution · low confidence
A low-severity security notice was found in the project's dependency list. This project compiles its code into a single file before shipping, so the tools used during development are not included in what users actually install. The flagged dependency is most likely a development tool that never runs in the final extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v6h2-p8h4-qcjw to a dependency declared by this repository.
Contextual assessment: A low-severity advisory matched in the lockfile of a project that bundles its output via webpack into a single shipped JS file. The lockfile contains extensive dev and build tooling (babel, jest, webpack, sass, typescript) whose transitive dependencies are common sources of advisory matches. These build-time dependencies are not included in the shipped extension artifact. The only production dependencies are handlebars at version 4.7.8 (the latest patched release) and sillytavern-utils-lib. Without the specific package name (removed by the scanner), precise reachability cannot be confirmed, but the project structure indicates this is most likely a dev-dependency advisory with no runtime path to the shipped extension.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it if a patched version is available, as general dependency hygiene.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v6h2-p8h4-qcjw
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-4x5r-pxfx-6jf8 applies
Minor caution · low confidence
A low-severity security notice was found in the project's dependency list. Since the project packages its code into a single file for distribution, the flagged dependency is most likely a development tool that does not reach end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4x5r-pxfx-6jf8 to a dependency declared by this repository.
Contextual assessment: A low-severity advisory matched in the lockfile. The project ships a webpack-bundled dist/index.js, meaning dev and build dependencies are not part of the runtime artifact. The lockfile includes many build-tool transitive dependencies that commonly trigger advisory matches. The two production dependencies (handlebars 4.7.8, sillytavern-utils-lib) are at current versions. Without the specific package identity, full reachability analysis is not possible, but the bundled-output architecture strongly suggests no runtime exposure.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it if a patched version is available.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4x5r-pxfx-6jf8
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fv7c-fp4j-7gwp applies
Minor caution · low confidence
A high-severity security notice was found in the project's dependency list. However, this project compiles its code into a single file before shipping, so development tools are not included in what users install. The flagged dependency is most likely a build tool that never runs in the final extension, though the specific package could not be confirmed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fv7c-fp4j-7gwp to a dependency declared by this repository.
Contextual assessment: A high-severity advisory was matched in the lockfile, but the scanner removed the package identity. The project bundles its production code via webpack into dist/index.js, excluding dev and build dependencies from the shipped artifact. The lockfile's large size (301KB) reflects many transitive build-tool dependencies (babel, jest, webpack, sass, typescript) that are common advisory sources and do not ship with the extension. The two direct production dependencies are at current patched versions. Without the specific package name, definitive reachability cannot be established, but the architecture indicates the vulnerable code is most likely in a build-time dependency with no runtime path to the extension.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package. If it is a production dependency, update it immediately; if it is a dev dependency, update it when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fv7c-fp4j-7gwp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-mh29-5h37-fv8m applies
Minor caution · low confidence
A medium-severity security notice was found in the project's dependency list. The project packages its code into a single file for distribution, so the flagged dependency is most likely a development tool that does not reach end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh29-5h37-fv8m to a dependency declared by this repository.
Contextual assessment: A medium-severity advisory matched in the lockfile. The project ships a webpack bundle (dist/index.js) that excludes dev and build dependencies. The lockfile contains extensive build tooling whose transitive dependencies frequently trigger advisory matches. Production dependencies (handlebars 4.7.8, sillytavern-utils-lib) are at current versions. Without the specific package name, precise reachability cannot be confirmed, but the bundled-output architecture indicates no runtime exposure for end users.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it if a patched version is available.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh29-5h37-fv8m
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-7rx3-28cr-v5wh applies
Minor caution · low confidence
A medium-severity security notice was found in the project's dependency list. Since the project compiles its code into a single file for distribution, the flagged dependency is most likely a development tool that does not reach end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7rx3-28cr-v5wh to a dependency declared by this repository.
Contextual assessment: A medium-severity advisory matched in the lockfile. The project's webpack-bundled output means dev and build dependencies are not shipped. The lockfile's many build-tool transitive dependencies are common advisory sources. Production dependencies are at current patched versions. Without the specific package identity, full reachability analysis is not possible, but the architecture strongly suggests a build-time-only dependency.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it if a patched version is available.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7rx3-28cr-v5wh
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-9cx6-37pm-9jff applies
Minor caution · low confidence
A high-severity security notice was found in the project's dependency list. However, this project compiles its code into a single file before shipping, so development tools are not included in what users install. The flagged dependency is most likely a build tool that never runs in the final extension, though the specific package could not be confirmed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-9cx6-37pm-9jff to a dependency declared by this repository.
Contextual assessment: A high-severity advisory was matched in the lockfile, but the package identity was removed by the scanner. The project bundles production code via webpack into dist/index.js, excluding dev and build dependencies from the shipped artifact. The lockfile's large size reflects many transitive build-tool dependencies that commonly trigger advisory matches and do not ship with the extension. Direct production dependencies (handlebars 4.7.8, sillytavern-utils-lib) are at current versions. Without the specific package name, definitive reachability cannot be established, but the architecture indicates the vulnerable code is most likely in a build-time dependency.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package. If it is a production dependency, update it immediately; if it is a dev dependency, update it when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-9cx6-37pm-9jff
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v2hh-gcrm-f6hx applies
Minor caution · low confidence
A high-severity security notice was found in the project's dependency list. However, this project compiles its code into a single file before shipping, so development tools are not included in what users install. The flagged dependency is most likely a build tool that never runs in the final extension, though the specific package could not be confirmed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.
Contextual assessment: A high-severity advisory was matched in the lockfile, but the package identity was removed by the scanner. The project ships a webpack-bundled dist/index.js that excludes dev and build dependencies. The lockfile contains extensive build tooling (babel, jest, webpack, sass, typescript) whose transitive dependencies are common advisory sources. Direct production dependencies are at current patched versions. Without the specific package name, definitive reachability cannot be established, but the bundled-output architecture indicates the vulnerable code is most likely in a build-time dependency with no runtime path to the extension.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package. If it is a production dependency, update it immediately; if it is a dev dependency, update it when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v2hh-gcrm-f6hx
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-968p-4wvh-cqc8 applies
Minor caution · low confidence
A medium-severity security notice was found in the project's dependency list. Since the project compiles its code into a single file for distribution, the flagged dependency is most likely a development tool that does not reach end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-968p-4wvh-cqc8 to a dependency declared by this repository.
Contextual assessment: A medium-severity advisory matched in the lockfile. The project's webpack-bundled output means dev and build dependencies are not shipped to end users. The lockfile's many build-tool transitive dependencies are common advisory sources. Direct production dependencies are at current patched versions. Without the specific package identity, full reachability analysis is not possible, but the architecture strongly suggests a build-time-only dependency with no runtime exposure.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it if a patched version is available.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-968p-4wvh-cqc8
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-2g4f-4pwh-qvx6 applies
Minor caution · medium confidence
This flagged dependency is part of the developer's build tools, not the actual extension that users install. The vulnerability doesn't affect the finished product that runs in SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2g4f-4pwh-qvx6 to a dependency declared by this repository.
Contextual assessment: This advisory is matched against a dependency declared in the file of a SillyTavern browser extension. The project ships compiled JS and CSS artifacts (dist/index.js, dist/style.css) to SillyTavern's browser context; node_modules are not shipped to end users. The production dependencies are handlebars 4.7.8 and sillytavern-utils-lib, neither of which is associated with this advisory. The advisory most likely affects a transitive dependency of the devDependencies (babel, webpack, jest, sass, typescript toolchain). Build-time vulnerabilities in dev tooling do not reach the runtime of the shipped extension, and attacker-controlled input would need to reach the vulnerable code during the build process. No concrete user harm from the shipped extension results.
Impact: none · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during routine maintenance; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2g4f-4pwh-qvx6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v39h-62p7-jpjc applies
Minor caution · medium confidence
Although this vulnerability is rated high, it lives in the developer's build tools rather than the extension users install. It cannot affect people using the extension in SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v39h-62p7-jpjc to a dependency declared by this repository.
Contextual assessment: This high-severity advisory is matched against a dependency in the lockfile of a browser extension project. The shipped artifacts are compiled static files loaded by SillyTavern in a browser sandbox. The two production dependencies (handlebars 4.7.8, sillytavern-utils-lib) are not associated with this advisory. The vulnerable package is most likely a transitive dependency of the dev toolchain (babel, webpack, jest, sass). Such vulnerabilities require attacker-controlled input to reach the vulnerable code during build or test execution, which is not part of the extension's runtime. No runtime reachability to end users exists.
Impact: none · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during routine maintenance; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v39h-62p7-jpjc
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-h67p-54hq-rp68 applies
Minor caution · medium confidence
This flagged dependency is a build tool, not part of the extension users install. The vulnerability doesn't reach the finished product.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-h67p-54hq-rp68 to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory is matched against a lockfile dependency of a SillyTavern browser extension. The extension ships compiled JS and CSS; node_modules are not distributed. The production dependencies (handlebars 4.7.8, sillytavern-utils-lib) do not correspond to this advisory. The vulnerable package is most likely within the devDependency tree (babel, webpack, jest, sass, typescript). Build-time vulnerabilities in dev tooling have no runtime reachability to the shipped extension and require a compromised build environment for exploitation.
Impact: none · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during routine maintenance; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-h67p-54hq-rp68
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-q3j6-qgpj-74h6 applies
Minor caution · medium confidence
This vulnerability is in the developer's build tools, not the extension that users install. It cannot affect people using the extension in SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-q3j6-qgpj-74h6 to a dependency declared by this repository.
Contextual assessment: This high-severity advisory is matched against a lockfile dependency of a browser extension. The shipped product is compiled static assets loaded in SillyTavern's browser context. The production dependencies (handlebars 4.7.8, sillytavern-utils-lib) are not associated with this advisory. The vulnerable package is most likely a transitive dependency of the dev toolchain. No runtime reachability to end users of the extension exists; exploitation would require attacker-controlled input during the build process.
Impact: none · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during routine maintenance; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-q3j6-qgpj-74h6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-wf6x-7x77-mvgw applies
Minor caution · medium confidence
This vulnerability is in the developer's build tools, not the extension that users install. It cannot affect people using the extension in SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-wf6x-7x77-mvgw to a dependency declared by this repository.
Contextual assessment: This high-severity advisory is matched against a lockfile dependency of a SillyTavern browser extension. The extension distributes compiled JS and CSS files; node_modules are not shipped. The production dependencies (handlebars 4.7.8, sillytavern-utils-lib) do not correspond to this advisory. The vulnerable package is most likely within the devDependency tree (babel, webpack, jest, sass, typescript). Build-time vulnerabilities have no runtime reachability to the shipped extension and require a compromised build environment for exploitation.
Impact: none · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during routine maintenance; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-wf6x-7x77-mvgw
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-23c5-xmqv-rm74 applies
Minor caution · medium confidence
This vulnerability is in the developer's build tools, not the extension that users install. It cannot affect people using the extension in SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74 to a dependency declared by this repository.
Contextual assessment: This high-severity advisory is matched against a lockfile dependency of a browser extension project. The shipped artifacts are compiled static files loaded by SillyTavern in a browser sandbox. The production dependencies (handlebars 4.7.8, sillytavern-utils-lib) are not associated with this advisory. The vulnerable package is most likely a transitive dependency of the dev toolchain. No runtime reachability to end users exists; exploitation would require attacker-controlled input during the build process.
Impact: none · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during routine maintenance; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-23c5-xmqv-rm74
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3jxr-9vmj-r5cp applies
Minor caution · medium confidence
This vulnerability is in the developer's build tools, not the extension that users install. It cannot affect people using the extension in SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.
Contextual assessment: This high-severity advisory is matched against a lockfile dependency of a SillyTavern browser extension. The extension ships compiled JS and CSS; node_modules are not distributed to end users. The production dependencies (handlebars 4.7.8, sillytavern-utils-lib) do not correspond to this advisory. The vulnerable package is most likely within the devDependency tree (babel, webpack, jest, sass, typescript). Build-time vulnerabilities have no runtime reachability to the shipped extension and require a compromised build environment for exploitation.
Impact: none · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during routine maintenance; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3jxr-9vmj-r5cp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-2w6w-674q-4c4q applies
Minor caution · medium confidence
Although this vulnerability is rated critical, it lives in the developer's build tools rather than the extension users install. It cannot affect people using the extension in SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2w6w-674q-4c4q to a dependency declared by this repository.
Contextual assessment: This critical-severity advisory is matched against a lockfile dependency of a SillyTavern browser extension. The shipped product is compiled static assets (dist/index.js, dist/style.css) loaded in SillyTavern's browser context; node_modules are not shipped. The production dependencies (handlebars 4.7.8, sillytavern-utils-lib) are not associated with this advisory. The vulnerable package is most likely a transitive dependency of the dev toolchain (babel, webpack, jest, sass, typescript). Despite the critical scanner severity, the vulnerable code has no runtime reachability to the shipped extension. Exploitation would require attacker-controlled input reaching the vulnerable code during the build process, which is not part of the extension's runtime. No concrete user harm from the shipped extension results.
Impact: none · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version during routine maintenance; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2w6w-674q-4c4q
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-xjpj-3mr7-gcpf applies
Minor caution · high confidence
The flagged software components are tools used by the developer to build the extension. They are not included in the final product that users install, so they do not pose a risk to users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xjpj-3mr7-gcpf to a dependency declared by this repository.
Contextual assessment: The advisory matches a development dependency used for building the extension. The shipped extension only includes the compiled output files, not the build tooling or its transitive dependencies. The vulnerable code is not present in the runtime environment of the end user and has no runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependencies to their latest patched versions to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xjpj-3mr7-gcpf
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v56q-mh7h-f735 applies
Minor caution · high confidence
The flagged software components are tools used by the developer to build the extension. They are not included in the final product that users install, so they do not pose a risk to users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v56q-mh7h-f735 to a dependency declared by this repository.
Contextual assessment: The advisory matches a development dependency used for building the extension. The shipped extension only includes the compiled output files, not the build tooling or its transitive dependencies. The vulnerable code is not present in the runtime environment of the end user and has no runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependencies to their latest patched versions to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v56q-mh7h-f735
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-7p8r-x3mc-p8w7 applies
Minor caution · high confidence
The flagged software components are tools used by the developer to build the extension. They are not included in the final product that users install, so they do not pose a risk to users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.
Contextual assessment: The advisory matches a development dependency used for building the extension. The shipped extension only includes the compiled output files, not the build tooling or its transitive dependencies. The vulnerable code is not present in the runtime environment of the end user and has no runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependencies to their latest patched versions to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7p8r-x3mc-p8w7
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-7r86-cg39-jmmj applies
Minor caution · high confidence
The flagged software components are tools used by the developer to build the extension. They are not included in the final product that users install, so they do not pose a risk to users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj to a dependency declared by this repository.
Contextual assessment: The advisory matches a development dependency used for building the extension. The shipped extension only includes the compiled output files, not the build tooling or its transitive dependencies. The vulnerable code is not present in the runtime environment of the end user and has no runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependencies to their latest patched versions to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7r86-cg39-jmmj
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-r28c-9q8g-f849 applies
Minor caution · high confidence
The flagged software components are tools used by the developer to build the extension. They are not included in the final product that users install, so they do not pose a risk to users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: The advisory matches a development dependency used for building the extension. The shipped extension only includes the compiled output files, not the build tooling or its transitive dependencies. The vulnerable code is not present in the runtime environment of the end user and has no runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependencies to their latest patched versions to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r28c-9q8g-f849
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-xhpv-hc6g-r9c6 applies
Minor caution · high confidence
The flagged software components are tools used by the developer to build the extension. They are not included in the final product that users install, so they do not pose a risk to users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xhpv-hc6g-r9c6 to a dependency declared by this repository.
Contextual assessment: The advisory matches a development dependency used for building the extension. The shipped extension only includes the compiled output files, not the build tooling or its transitive dependencies. The vulnerable code is not present in the runtime environment of the end user and has no runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependencies to their latest patched versions to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xhpv-hc6g-r9c6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-xvcm-6775-5m9r applies
Minor caution · high confidence
The flagged software components are tools used by the developer to build the extension. They are not included in the final product that users install, so they do not pose a risk to users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xvcm-6775-5m9r to a dependency declared by this repository.
Contextual assessment: The advisory matches a development dependency used for building the extension. The shipped extension only includes the compiled output files, not the build tooling or its transitive dependencies. The vulnerable code is not present in the runtime environment of the end user and has no runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependencies to their latest patched versions to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xvcm-6775-5m9r
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3v7f-55p6-f55p applies
Minor caution · high confidence
The flagged software components are tools used by the developer to build the extension. They are not included in the final product that users install, so they do not pose a risk to users of the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p to a dependency declared by this repository.
Contextual assessment: The advisory matches a development dependency used for building the extension. The shipped extension only includes the compiled output files, not the build tooling or its transitive dependencies. The vulnerable code is not present in the runtime environment of the end user and has no runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependencies to their latest patched versions to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3v7f-55p6-f55p
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3mfm-83xf-c92r applies
Minor caution · medium confidence
A known security issue was found in a dependency used to build this extension. Since the extension ships only the final bundled JavaScript to users and not the build tools themselves, this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3mfm-83xf-c92r to a dependency declared by this repository.
Contextual assessment: The advisory matches a dependency declared in package-lock.json. The project ships a webpack bundle (dist/index.js) as its runtime artifact; devDependencies and their transitive dependencies are build-time only and are not included in the shipped extension. The production dependencies are limited to handlebars and sillytavern-utils-lib. Without the full lockfile it is not possible to confirm the exact package, but the project structure strongly suggests this advisory is in dev-tooling transitive dependencies with no runtime reachability for end users.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update affected dev dependencies when convenient; no urgent action required for shipped extension users.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3mfm-83xf-c92r
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-4c8g-83qw-93j6 applies
Minor caution · medium confidence
A known security issue was found in a build-time dependency. The extension only ships the compiled output, so this issue probably does not reach end users who install the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6 to a dependency declared by this repository.
Contextual assessment: The advisory matches a dependency in the lockfile. The shipped artifact is a webpack bundle; devDependencies such as babel, jest, webpack, sass, and their transitive dependencies are not part of the runtime. The advisory is most likely in a dev-only transitive dependency with no path to end-user execution.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update affected dev dependencies when convenient; no urgent action required for shipped extension users.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4c8g-83qw-93j6
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-f886-m6hf-6m8v applies
Minor caution · medium confidence
A medium-severity known issue was found in a build-time dependency. Since only the compiled extension code is shipped to users, this likely does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v to a dependency declared by this repository.
Contextual assessment: The advisory matches a dependency in the lockfile. The project ships a webpack bundle as its runtime artifact, and devDependencies are excluded from the shipped output. The advisory is most likely in a dev-only transitive dependency with no runtime reachability for extension users.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update affected dev dependencies when convenient; no urgent action required for shipped extension users.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-f886-m6hf-6m8v
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-52cp-r559-cp3m applies
Minor caution · medium confidence
A known security issue was found in a build-time dependency. The extension ships only the final compiled JavaScript, so this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m to a dependency declared by this repository.
Contextual assessment: The advisory matches a dependency in the lockfile. The shipped artifact is a webpack bundle; devDependencies and their transitive dependencies are build-time only. The advisory is most likely in a dev-only transitive dependency with no path to end-user execution.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update affected dev dependencies when convenient; no urgent action required for shipped extension users.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-52cp-r559-cp3m
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Minor caution · medium confidence
A medium-severity known issue was found in a build-time dependency. Since only the compiled extension code is shipped to users, this likely does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: The advisory matches a dependency in the lockfile. The project ships a webpack bundle as its runtime artifact, and devDependencies are excluded from the shipped output. The advisory is most likely in a dev-only transitive dependency with no runtime reachability for extension users.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update affected dev dependencies when convenient; no urgent action required for shipped extension users.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3ppc-4f35-3m26 applies
Minor caution · medium confidence
A known security issue was found in a build-time dependency. The extension ships only the final compiled JavaScript, so this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26 to a dependency declared by this repository.
Contextual assessment: The advisory matches a dependency in the lockfile. The shipped artifact is a webpack bundle; devDependencies and their transitive dependencies are build-time only. The advisory is most likely in a dev-only transitive dependency with no path to end-user execution.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update affected dev dependencies when convenient; no urgent action required for shipped extension users.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3ppc-4f35-3m26
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg applies
Minor caution · medium confidence
A known security issue was found in a build-time dependency. The extension ships only the final compiled JavaScript, so this issue most likely does not affect people who install and use the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: The advisory matches a dependency in the lockfile. The shipped artifact is a webpack bundle; devDependencies and their transitive dependencies are build-time only. The advisory is most likely in a dev-only transitive dependency with no path to end-user execution.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update affected dev dependencies when convenient; no urgent action required for shipped extension users.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh99-v99m-4gvg
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-442j-39wm-28r2 applies
Minor caution · medium confidence
A low-severity known issue was found in a build-time dependency. Since only the compiled extension code is shipped to users, this likely does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-442j-39wm-28r2 to a dependency declared by this repository.
Contextual assessment: The advisory matches a dependency in the lockfile. The project ships a webpack bundle as its runtime artifact, and devDependencies are excluded from the shipped output. The advisory is most likely in a dev-only transitive dependency with no runtime reachability for extension users.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit and update affected dev dependencies when convenient; no urgent action required for shipped extension users.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-442j-39wm-28r2
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-c2c7-rcm5-vvqj applies
Minor caution · medium confidence
A security scanner found a known-vulnerable package listed in this project's dependency file. This extension only ships its compiled output to users, and the vulnerable package is most likely a build-time tool that never runs in the actual extension. The practical risk to people using the extension is very low.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency declared in the lockfile. The project ships only compiled browser JS (dist/index.js) and CSS to end users. The production dependency tree is minimal (handlebars 4.7.8, sillytavern-utils-lib), while the devDependencies include extensive build tooling (babel, jest, webpack, sass, typescript) whose transitive dependencies commonly carry advisories. Without the specific package name and version, the most probable placement is in a dev-only transitive dependency with no runtime reachability in the shipped extension. Even if a production transitive dependency were affected, the vulnerable code would need to be bundled into dist/index.js and reachable by attacker-controlled input in a browser context, which is unlikely for a translation extension that sends prompts to LLM APIs.
Impact: low · Exploitability: unlikely
Developer action: Update affected dev dependencies to patched versions during the next build tooling refresh. No urgent action required for shipped extension safety.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-c2c7-rcm5-vvqj
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-2qvq-rjwj-gvw9 applies
Minor caution · medium confidence
A scanner flagged a moderately vulnerable package in this project's dependency list. Since the extension only ships its final compiled code to users and the flagged package is probably just a build tool, the risk to extension users is minimal.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2qvq-rjwj-gvw9 to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory matches a dependency in the lockfile. The project is a browser extension shipping compiled JS; its production dependencies are handlebars 4.7.8 and sillytavern-utils-lib. The advisory most likely corresponds to a transitive dependency of the build tooling (babel, jest, webpack, sass) rather than a runtime dependency. Build-time vulnerabilities do not reach end users of the compiled extension. The scanner removed package details, preventing exact confirmation, but the project structure strongly suggests no runtime reachability in the shipped artifact.
Impact: low · Exploitability: unlikely
Developer action: Update affected dependencies to patched versions when convenient. No urgent action required for shipped extension safety.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-2qvq-rjwj-gvw9
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Minor caution · medium confidence
A scanner found a high-severity vulnerability in a package used by this project. However, the extension only ships its compiled output, and the vulnerable package is most likely a development build tool that never runs when users install and use the extension. The real-world risk to users is low.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: This high-severity advisory matches a dependency in the lockfile. Despite the scanner severity, the project ships only compiled browser JS and CSS. The production dependency tree is limited to handlebars 4.7.8 (latest, no known advisories) and sillytavern-utils-lib. The advisory most likely targets a transitive dependency of dev tooling such as babel, jest, webpack, or sass. Such dependencies execute only during the developer's build process and are not included in the shipped extension bundle. Without the specific package identity, exact confirmation is not possible, but the project architecture indicates no runtime exposure to end users.
Impact: low · Exploitability: unlikely
Developer action: Update affected dev dependencies to patched versions during the next build tooling refresh. No urgent action required for shipped extension safety.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- package-lock.json
Expected scanner matches (0)
None.