TavernKeeper Scan Report

bmen25124/SillyTavern-Roadway

Commit 8bd72bd Reviewed Aug 11, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 49 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

Dependency advisory GHSA-xvcm-6775-5m9r:pkg:b7ba0ee562d2ff64d5428476 applies

Minor caution · high confidence

This package is only used during development, not when you run the extension in your browser. So the vulnerability cannot be exploited by using the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xvcm-6775-5m9r:pkg:b7ba0ee562d2ff64d5428476 to a dependency declared by this repository.

Contextual assessment: immutable@5.0.3 is a devDependency (transitive through jest or similar) and is not included in the shipped extension bundle. There is no runtime reachability from the extension's main script. The advisory (GHSA-xvcm-6775-5m9r) affects a build-time tool with no attacker-controlled input path in the project's build process.

Impact: none · Exploitability: unlikely

Developer action: Update the dependency if a patched version is available for build hygiene.

Scanner: osv-scanner 2.4.0
Rule: GHSA-xvcm-6775-5m9r:pkg:b7ba0ee562d2ff64d5428476
File role: production
Source: package-lock.json

Dependency advisory GHSA-v6h2-p8h4-qcjw:pkg:8274239beac709c34bbdd8ec applies

Minor caution · high confidence

This is a development tool that doesn't run in the extension. There's no way for an attacker to use it through the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v6h2-p8h4-qcjw:pkg:8274239beac709c34bbdd8ec to a dependency declared by this repository.

Contextual assessment: brace-expansion@2.0.1 is a transitive devDependency (used by jest and other test tools). It is not part of the runtime extension. No attacker-controlled input reaches brace-expansion in the project's build pipeline in a way that could cause harm.

Impact: none · Exploitability: unlikely

Developer action: Update to a patched version if available.

Scanner: osv-scanner 2.4.0
Rule: GHSA-v6h2-p8h4-qcjw:pkg:8274239beac709c34bbdd8ec
File role: production
Source: package-lock.json

Dependency advisory GHSA-h67p-54hq-rp68:pkg:032a72735b89e8109ae31a3d applies

Minor caution · high confidence

This package is only used when developers run tests, not when you use the extension. So there is no risk from this vulnerability.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-h67p-54hq-rp68:pkg:032a72735b89e8109ae31a3d to a dependency declared by this repository.

Contextual assessment: js-yaml@3.14.1 is a transitive devDependency (used by eslint or other linting tools, possibly through jest config). It is not shipped or executed in the extension runtime. No attacker-controlled YAML input reaches this dependency during normal extension usage.

Impact: none · Exploitability: unlikely

Developer action: Consider updating js-yaml to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-h67p-54hq-rp68:pkg:032a72735b89e8109ae31a3d
File role: production
Source: package-lock.json

Dependency advisory GHSA-v6h2-p8h4-qcjw:pkg:954583494f7b71625ae8e6ee applies

Minor caution · high confidence

Same as the other brace-expansion issue – a development tool vulnerability that doesn't affect the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v6h2-p8h4-qcjw:pkg:954583494f7b71625ae8e6ee to a dependency declared by this repository.

Contextual assessment: brace-expansion@1.1.11 is another version used transitively by a different dev dependency. Same rationale: not runtime, not attacker-reachable.

Impact: none · Exploitability: unlikely

Developer action: Update if possible.

Scanner: osv-scanner 2.4.0
Rule: GHSA-v6h2-p8h4-qcjw:pkg:954583494f7b71625ae8e6ee
File role: production
Source: package-lock.json

Dependency advisory GHSA-fv7c-fp4j-7gwp:pkg:61a326311e4c18e21c55bdee applies

Minor caution · high confidence

This is a tool that helps prepare the code for the browser, but it runs only on the developer's machine. It cannot be exploited through the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fv7c-fp4j-7gwp:pkg:61a326311e4c18e21c55bdee to a dependency declared by this repository.

Contextual assessment: @babel/plugin-transform-modules-systemjs@7.25.9 is a build-time Babel plugin (devDependency). It is not included in the extension's runtime bundle. The advisory (GHSA-fv7c-fp4j-7gwp) describes a potential vulnerability in the plugin's code transformation, but no attacker-controlled input reaches this plugin during the build process in this project.

Impact: none · Exploitability: unlikely

Developer action: Update @babel/plugin-transform-modules-systemjs to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-fv7c-fp4j-7gwp:pkg:61a326311e4c18e21c55bdee
File role: production
Source: package-lock.json

Dependency advisory GHSA-38r7-794h-5758:pkg:939d3d37185299b5144d694f applies

Minor caution · high confidence

Webpack is a tool that combines code files together before the extension is created. It doesn't run when you use the extension, so this vulnerability is not a danger.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-38r7-794h-5758:pkg:939d3d37185299b5144d694f to a dependency declared by this repository.

Contextual assessment: webpack@5.97.1 is a build-time bundler (devDependency, marked as peer in lockfile). It runs during development/build, not at runtime in the extension. The advisory (GHSA-38r7-794h-5758) would require an attacker to control webpack configuration or input, which does not happen in normal extension use.

Impact: none · Exploitability: unlikely

Developer action: Consider updating webpack to a patched version.

Scanner: osv-scanner 2.4.0
Rule: GHSA-38r7-794h-5758:pkg:939d3d37185299b5144d694f
File role: production
Source: package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg:pkg:30da7db405d2e49715cb0ed6 applies

Minor caution · high confidence

Again, a development-only vulnerability that does not affect users of the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg:pkg:30da7db405d2e49715cb0ed6 to a dependency declared by this repository.

Contextual assessment: brace-expansion@1.1.11 appears again via another transitive dev dependency path. Same analysis: not runtime, not attacker-reachable.

Impact: none · Exploitability: unlikely

Developer action: Update if possible.

Scanner: osv-scanner 2.4.0
Rule: GHSA-mh99-v99m-4gvg:pkg:30da7db405d2e49715cb0ed6
File role: production
Source: package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895:pkg:567c541f015fe4079ca9b17e applies

Minor caution · high confidence

Another instance of the same development tool issue, not a runtime threat.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895:pkg:567c541f015fe4079ca9b17e to a dependency declared by this repository.

Contextual assessment: brace-expansion@1.1.11 again via yet another dev dependency chain. Same reasoning.

Impact: none · Exploitability: unlikely

Developer action: Update if possible.

Scanner: osv-scanner 2.4.0
Rule: GHSA-rgw5-rvv9-x895:pkg:567c541f015fe4079ca9b17e
File role: production
Source: package-lock.json

Dependency advisory GHSA-7p8r-x3mc-p8w7:pkg:2f8d75dd087c1050a99a8192 applies

Minor caution · medium confidence

A tool found that one of the project's build tools uses a package with a known security issue, but there is no proof that this issue can be triggered in the actual extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7:pkg:2f8d75dd087c1050a99a8192 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged fast-uri@3.0.6 with a high-severity advisory. The package appears as a transitive dependency of devDependencies (e.g., @babel/core) and possibly of sillytavern-utils-lib. No evidence of runtime reachability in the shipped extension was provided; the attacker-controlled input path and actual exploitability are not demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update fast-uri to a non-vulnerable version if it is a runtime dependency. If it is only a devDependency, consider updating to reduce security debt.

Scanner: osv-scanner 2.4.0
Rule: GHSA-7p8r-x3mc-p8w7:pkg:2f8d75dd087c1050a99a8192
File role: production
Source: package-lock.json

Dependency advisory GHSA-4c8g-83qw-93j6:pkg:181d5c1a6aff27dd93f86cff applies

Minor caution · medium confidence

Another scan result for the same build tool dependency shows a known vulnerability, but it is not shown to be reachable in the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6:pkg:181d5c1a6aff27dd93f86cff to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged fast-uri@3.0.6 with high-severity advisory GHSA-4c8g-83qw-93j6. This is the same package as in another candidate, flagged under a different rule. It is a transitive dependency of devDependencies. No runtime reachability or attacker-controlled input path was demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update fast-uri to a patched version if it is a runtime dependency; otherwise, consider updating for general hygiene.

Scanner: osv-scanner 2.4.0
Rule: GHSA-4c8g-83qw-93j6:pkg:181d5c1a6aff27dd93f86cff
File role: production
Source: package-lock.json

Dependency advisory GHSA-3ppc-4f35-3m26:pkg:f700a97b2d134373c6c36877 applies

Minor caution · medium confidence

A test library uses a package that could be slowed down by a crafted input, but there is no sign that an attacker can send such input through the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26:pkg:f700a97b2d134373c6c36877 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged minimatch@5.1.6 with high-severity advisory GHSA-3ppc-4f35-3m26 (ReDoS). This version is a transitive dependency of devDependencies (e.g., jest). No evidence of runtime reachability or attacker-controlled input to the vulnerable regex was provided.

Impact: low · Exploitability: unlikely

Developer action: Update minimatch to a version that includes the fix. If it is a devDependency, consider updating to reduce risk.

Scanner: osv-scanner 2.4.0
Rule: GHSA-3ppc-4f35-3m26:pkg:f700a97b2d134373c6c36877
File role: production
Source: package-lock.json

Dependency advisory GHSA-23c5-xmqv-rm74:pkg:28c6f8e6010383b649a97a01 applies

Minor caution · medium confidence

An older version of a pattern-matching library used during development has a known issue, but it is not shown to affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74:pkg:28c6f8e6010383b649a97a01 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged minimatch@3.1.2 with high-severity advisory GHSA-23c5-xmqv-rm74 (ReDoS). This version appears as a transitive dependency of devDependencies. No runtime reachability or attacker-controlled input path was demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update minimatch to a patched version. If it is a devDependency, consider updating to reduce security debt.

Scanner: osv-scanner 2.4.0
Rule: GHSA-23c5-xmqv-rm74:pkg:28c6f8e6010383b649a97a01
File role: production
Source: package-lock.json

Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:c6056f5a45897dd10bfacade applies

Minor caution · medium confidence

A brace expansion package used by development tools has a known flaw, but it is not shown to be usable in the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp:pkg:c6056f5a45897dd10bfacade to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged brace-expansion@1.1.11 with high-severity advisory GHSA-3jxr-9vmj-r5cp (ReDoS). This is a transitive dependency of devDependencies (e.g., minimatch). No evidence of runtime reachability or attacker-controlled input was provided.

Impact: low · Exploitability: unlikely

Developer action: Update brace-expansion to a non-vulnerable version if it is a runtime dependency; otherwise, consider updating for hygiene.

Scanner: osv-scanner 2.4.0
Rule: GHSA-3jxr-9vmj-r5cp:pkg:c6056f5a45897dd10bfacade
File role: production
Source: package-lock.json

Dependency advisory GHSA-v39h-62p7-jpjc:pkg:a6be302000b0d22d393bcd4e applies

Minor caution · medium confidence

Another scan result for the same vulnerable build tool dependency shows no runtime proof.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v39h-62p7-jpjc:pkg:a6be302000b0d22d393bcd4e to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged fast-uri@3.0.6 with high-severity advisory GHSA-v39h-62p7-jpjc. This is a duplicate of the same package flagged under other rule IDs. It is a transitive dependency of devDependencies. No runtime reachability or attacker-controlled input path was demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update fast-uri to a patched version if it is a runtime dependency; otherwise, update for general security.

Scanner: osv-scanner 2.4.0
Rule: GHSA-v39h-62p7-jpjc:pkg:a6be302000b0d22d393bcd4e
File role: production
Source: package-lock.json

Dependency advisory GHSA-4x5r-pxfx-6jf8:pkg:1c1f84f322690ba267d9bb14 applies

Minor caution · medium confidence

A build tool has a low-severity advisory, meaning it is unlikely to cause harm. It is not used in the extension's runtime.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4x5r-pxfx-6jf8:pkg:1c1f84f322690ba267d9bb14 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged @babel/core@7.26.0 with low-severity advisory GHSA-4x5r-pxfx-6jf8. This package is a devDependency used for transpilation. The advisory severity is low, indicating minimal impact. No runtime reachability in the shipped extension was demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update @babel/core to a newer version if a fix is available. This is a devDependency, so it is not critical but good practice.

Scanner: osv-scanner 2.4.0
Rule: GHSA-4x5r-pxfx-6jf8:pkg:1c1f84f322690ba267d9bb14
File role: production
Source: package-lock.json

Dependency advisory GHSA-3ppc-4f35-3m26:pkg:173c1b2fab8e025126fb982c applies

Minor caution · medium confidence

Another scan result for the same development dependency shows a known issue, but it is not shown to affect the extension's users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26:pkg:173c1b2fab8e025126fb982c to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged minimatch@3.1.2 with high-severity advisory GHSA-3ppc-4f35-3m26 (ReDoS). This is a duplicate of the same package flagged under another rule, appearing as a transitive dependency of devDependencies. No runtime reachability or attacker-controlled input path was demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update minimatch to a patched version if it is a runtime dependency; otherwise, update for hygiene.

Scanner: osv-scanner 2.4.0
Rule: GHSA-3ppc-4f35-3m26:pkg:173c1b2fab8e025126fb982c
File role: production
Source: package-lock.json

Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:4914f0d37f422ddfa7f1c7dd applies

Minor caution · medium confidence

A development tool uses a brace expansion package with a known issue, but there is no proof that an attacker can exploit it through the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp:pkg:4914f0d37f422ddfa7f1c7dd to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged brace-expansion@2.0.1 with high-severity advisory GHSA-3jxr-9vmj-r5cp (ReDoS). This version is a transitive dependency of devDependencies (e.g., minimatch). No evidence of runtime reachability or attacker-controlled input was provided.

Impact: low · Exploitability: unlikely

Developer action: Update brace-expansion to a non-vulnerable version if it is a runtime dependency; otherwise, consider updating to reduce security debt.

Scanner: osv-scanner 2.4.0
Rule: GHSA-3jxr-9vmj-r5cp:pkg:4914f0d37f422ddfa7f1c7dd
File role: production
Source: package-lock.json

Dependency advisory GHSA-968p-4wvh-cqc8:pkg:3a0c63b3ad926e4d282ae47a applies

Minor caution · medium confidence

A helper library used during build time has a moderate advisory, but it is not used in the extension's runtime.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-968p-4wvh-cqc8:pkg:3a0c63b3ad926e4d282ae47a to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged @babel/helpers@7.26.0 with medium-severity advisory GHSA-968p-4wvh-cqc8. This package is a transitive dependency of @babel/core, a devDependency. No runtime reachability or attacker-controlled input path was demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update @babel/helpers to a patched version if available. It is a devDependency, so not critical but good practice.

Scanner: osv-scanner 2.4.0
Rule: GHSA-968p-4wvh-cqc8:pkg:3a0c63b3ad926e4d282ae47a
File role: production
Source: package-lock.json

Dependency advisory GHSA-wf6x-7x77-mvgw:pkg:47474d29e3aaf60546241778 applies

Minor caution · medium confidence

A data structure library used by the Sass compiler has a known vulnerability, but it is not shown to be reachable in the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-wf6x-7x77-mvgw:pkg:47474d29e3aaf60546241778 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged immutable@5.0.3 with high-severity advisory GHSA-wf6x-7x77-mvgw. This package is a dependency of sass (itself a devDependency). No evidence of runtime reachability or attacker-controlled input to the vulnerable code was provided.

Impact: low · Exploitability: unlikely

Developer action: Update immutable to a non-vulnerable version. If sass is only a devDependency, this is not a runtime risk but still worth updating.

Scanner: osv-scanner 2.4.0
Rule: GHSA-wf6x-7x77-mvgw:pkg:47474d29e3aaf60546241778
File role: production
Source: package-lock.json

Dependency advisory GHSA-7r86-cg39-jmmj:pkg:fa706fb036ae029fca4e7e55 applies

Minor caution · medium confidence

A pattern matching library used during development has a known flaw, but it is not shown to affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj:pkg:fa706fb036ae029fca4e7e55 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged minimatch@3.1.2 with high-severity advisory GHSA-7r86-cg39-jmmj (ReDoS). This version appears as a transitive dependency of devDependencies. No evidence of runtime reachability or attacker-controlled input was provided.

Impact: low · Exploitability: unlikely

Developer action: Update minimatch to a patched version. If it is a devDependency, consider updating to reduce security debt.

Scanner: osv-scanner 2.4.0
Rule: GHSA-7r86-cg39-jmmj:pkg:fa706fb036ae029fca4e7e55
File role: production
Source: package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895:pkg:f366c29948c70f361f7b3905 applies

Minor caution · medium confidence

Another scan result for the same development dependency shows a known issue, but it is not proven to be exploitable.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895:pkg:f366c29948c70f361f7b3905 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged brace-expansion@2.0.1 with high-severity advisory GHSA-rgw5-rvv9-x895 (ReDoS). This is a duplicate of the same package flagged under another rule, a transitive dependency of devDependencies. No runtime reachability or attacker-controlled input path was demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update brace-expansion to a non-vulnerable version if runtime; otherwise, update for hygiene.

Scanner: osv-scanner 2.4.0
Rule: GHSA-rgw5-rvv9-x895:pkg:f366c29948c70f361f7b3905
File role: production
Source: package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg:pkg:b2da24d008a395da126c5ca9 applies

Minor caution · medium confidence

Yet another scan alert for the same brace-expansion library used in development, with no runtime proof.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg:pkg:b2da24d008a395da126c5ca9 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged brace-expansion@2.0.1 with high-severity advisory GHSA-mh99-v99m-4gvg (ReDoS). This is another duplicate of the same package, a transitive dependency of devDependencies. No evidence of runtime reachability or attacker-controlled input was provided.

Impact: low · Exploitability: unlikely

Developer action: Update brace-expansion to a patched version if runtime; otherwise, update for general security.

Scanner: osv-scanner 2.4.0
Rule: GHSA-mh99-v99m-4gvg:pkg:b2da24d008a395da126c5ca9
File role: production
Source: package-lock.json

Dependency advisory GHSA-v2hh-gcrm-f6hx:pkg:9600c6310040af533d8d1920 applies

Minor caution · medium confidence

Another scan for the same fast-uri build dependency shows a known vulnerability, but it is not shown to be reachable.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx:pkg:9600c6310040af533d8d1920 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged fast-uri@3.0.6 with high-severity advisory GHSA-v2hh-gcrm-f6hx. This is the same package flagged in the other group, a transitive dependency of devDependencies. No runtime reachability or attacker-controlled input path was demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update fast-uri to a patched version if it is a runtime dependency; otherwise, update for hygiene.

Scanner: osv-scanner 2.4.0
Rule: GHSA-v2hh-gcrm-f6hx:pkg:9600c6310040af533d8d1920
File role: production
Source: package-lock.json

Dependency advisory GHSA-q3j6-qgpj-74h6:pkg:2d0d5c8fc1bb62c4e3b44b2a applies

Minor caution · medium confidence

Another scan alert for the same fast-uri library in development dependencies, with no runtime proof.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-q3j6-qgpj-74h6:pkg:2d0d5c8fc1bb62c4e3b44b2a to a dependency declared by this repository.

Contextual assessment: OSV-Scanner flagged fast-uri@3.0.6 with high-severity advisory GHSA-q3j6-qgpj-74h6. This is a duplicate of the same package flagged under other rule IDs. It is a transitive dependency of devDependencies. No runtime reachability or attacker-controlled input path was demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Update fast-uri to a non-vulnerable version if runtime; otherwise, update for security.

Scanner: osv-scanner 2.4.0
Rule: GHSA-q3j6-qgpj-74h6:pkg:2d0d5c8fc1bb62c4e3b44b2a
File role: production
Source: package-lock.json

Deterministic technical evidence (3)

JavaScript analysis reported javascript.xray.prototype-pollution · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: javascript-xray-structured-weakness · Execution scope: runtime

Source: dist/index.js:8
JavaScript analysis reported javascript.xray.prototype-pollution · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: javascript-xray-structured-weakness · Execution scope: runtime

Source: dist/index.js:3870
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: webpack.config.cjs:5

Contextual expected matches (22)

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file looks like normal computer-generated code from a build tool, not intentionally hidden malicious code. It imports parts of SillyTavern to do its job, which is expected for an extension.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The file file is a webpack-generated bundle from a TypeScript project. The code shows standard module bundling patterns (imports, helper functions for property assignment, and use of SillyTavern internal modules). The obfuscation detected by JS-X-Ray is typical of minified/transpiled output, not concealed malicious logic. No hidden data flows, network exfiltration, or unauthorized persistence are present in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: generated
Source: dist/index.js:1

Dependency advisory GHSA-v56q-mh7h-f735:pkg:b44c0e2e8fd0009fd7dd62d0 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v56q-mh7h-f735:pkg:b44c0e2e8fd0009fd7dd62d0 to a dependency declared by this repository.

Contextual assessment: immutable@5.0.3 is a transitive dev dependency used during build (webpack/babel toolchain). No evidence that its vulnerable code is reachable in the shipped SillyTavern extension runtime. The advisory is noted but does not affect end users.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-v56q-mh7h-f735:pkg:b44c0e2e8fd0009fd7dd62d0
File role: production
Source: package-lock.json

Dependency advisory GHSA-7r86-cg39-jmmj:pkg:d1c7abe70f0b881829849922 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj:pkg:d1c7abe70f0b881829849922 to a dependency declared by this repository.

Contextual assessment: minimatch@5.1.6 is a transitive dev dependency used by build tooling. It is not part of the shipped extension code. No attacker-controlled input path exists in the extension's runtime context.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-7r86-cg39-jmmj:pkg:d1c7abe70f0b881829849922
File role: production
Source: package-lock.json

Dependency advisory GHSA-8fgc-7cc6-rx7x:pkg:5073cde698ce07faa9278c33 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8fgc-7cc6-rx7x:pkg:5073cde698ce07faa9278c33 to a dependency declared by this repository.

Contextual assessment: webpack@5.97.1 is a dev dependency used to bundle the extension. It is not shipped to the browser. The advisory does not affect runtime users.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-8fgc-7cc6-rx7x:pkg:5073cde698ce07faa9278c33
File role: production
Source: package-lock.json

Dependency advisory GHSA-qj8w-gfj5-8c6v:pkg:7d87d343aa0c80bd7734851a applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-qj8w-gfj5-8c6v:pkg:7d87d343aa0c80bd7734851a to a dependency declared by this repository.

Contextual assessment: serialize-javascript@6.0.2 is a transitive dev dependency of terser-webpack-plugin. Not shipped. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-qj8w-gfj5-8c6v:pkg:7d87d343aa0c80bd7734851a
File role: production
Source: package-lock.json

Dependency advisory GHSA-f886-m6hf-6m8v:pkg:689dbb9a6583acd763e055a3 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v:pkg:689dbb9a6583acd763e055a3 to a dependency declared by this repository.

Contextual assessment: brace-expansion@2.0.1 is a transitive dev dependency of minimatch. Not shipped. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-f886-m6hf-6m8v:pkg:689dbb9a6583acd763e055a3
File role: production
Source: package-lock.json

Dependency advisory GHSA-2g4f-4pwh-qvx6:pkg:e75f751e62b1e8418f7d80f3 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2g4f-4pwh-qvx6:pkg:e75f751e62b1e8418f7d80f3 to a dependency declared by this repository.

Contextual assessment: ajv@8.17.1 is a transitive dev dependency of webpack. Not shipped. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-2g4f-4pwh-qvx6:pkg:e75f751e62b1e8418f7d80f3
File role: production
Source: package-lock.json

Dependency advisory GHSA-2v37-7h3g-55p8:pkg:32565e5915130b51271b4195 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2v37-7h3g-55p8:pkg:32565e5915130b51271b4195 to a dependency declared by this repository.

Contextual assessment: nanoid@3.3.12 is a transitive dev dependency used by webpack loaders. Not shipped. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-2v37-7h3g-55p8:pkg:32565e5915130b51271b4195
File role: production
Source: package-lock.json

Dependency advisory GHSA-r28c-9q8g-f849:pkg:6f926e74aaf2969f045549e9 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849:pkg:6f926e74aaf2969f045549e9 to a dependency declared by this repository.

Contextual assessment: postcss@8.5.15 is a dev dependency used by sass and webpack for CSS processing. Not shipped. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-r28c-9q8g-f849:pkg:6f926e74aaf2969f045549e9
File role: production
Source: package-lock.json

Dependency advisory GHSA-52cp-r559-cp3m:pkg:b50fc3b7dc4817b2367e97d7 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m:pkg:b50fc3b7dc4817b2367e97d7 to a dependency declared by this repository.

Contextual assessment: js-yaml@3.14.1 is a transitive dev dependency used by babel/jest. Not shipped. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-52cp-r559-cp3m:pkg:b50fc3b7dc4817b2367e97d7
File role: production
Source: package-lock.json

Dependency advisory GHSA-mh29-5h37-fv8m:pkg:be84c0d3fc58da2798a815e5 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh29-5h37-fv8m:pkg:be84c0d3fc58da2798a815e5 to a dependency declared by this repository.

Contextual assessment: js-yaml@3.14.1 (second advisory) same dependency, same analysis. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-mh29-5h37-fv8m:pkg:be84c0d3fc58da2798a815e5
File role: production
Source: package-lock.json

Dependency advisory GHSA-2g4f-4pwh-qvx6:pkg:cad7e9fb17eb5405be0d1fe2 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2g4f-4pwh-qvx6:pkg:cad7e9fb17eb5405be0d1fe2 to a dependency declared by this repository.

Contextual assessment: ajv@6.12.6 is a transitive dev dependency of webpack peer dependency. Not shipped. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-2g4f-4pwh-qvx6:pkg:cad7e9fb17eb5405be0d1fe2
File role: production
Source: package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:c9523a0885d757426ed83e80 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp:pkg:c9523a0885d757426ed83e80 to a dependency declared by this repository.

Contextual assessment: postcss@8.5.15 (second advisory) same package, same analysis. Dev dependency, not shipped.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-fxqj-rqcc-2cmp:pkg:c9523a0885d757426ed83e80
File role: production
Source: package-lock.json

Dependency advisory GHSA-f886-m6hf-6m8v:pkg:db05cad6d25aec0390d39a8c applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v:pkg:db05cad6d25aec0390d39a8c to a dependency declared by this repository.

Contextual assessment: brace-expansion@1.1.11 is a transitive dev dependency of older minimatch used by jest. Not shipped. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-f886-m6hf-6m8v:pkg:db05cad6d25aec0390d39a8c
File role: production
Source: package-lock.json

Dependency advisory GHSA-5c6j-r48x-rmvq:pkg:9695ebfe7ac51867550b15ed applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5c6j-r48x-rmvq:pkg:9695ebfe7ac51867550b15ed to a dependency declared by this repository.

Contextual assessment: serialize-javascript@6.0.2 (second advisory) same package, same analysis. Dev dependency not shipped.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-5c6j-r48x-rmvq:pkg:9695ebfe7ac51867550b15ed
File role: production
Source: package-lock.json

Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a to a dependency declared by this repository.

Contextual assessment: picomatch@2.3.1 is a transitive dev dependency of jest/cli. Not shipped. No runtime exposure.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a
File role: production
Source: package-lock.json

Dependency advisory GHSA-23c5-xmqv-rm74:pkg:129158f1f423f49b12e76a97 applies

Expected behavior · high confidence

This package is only used during development, not when you run the extension. The security warning doesn't apply to normal use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74:pkg:129158f1f423f49b12e76a97 to a dependency declared by this repository.

Contextual assessment: minimatch@5.1.6 (second advisory) same package, same analysis. Dev dependency not shipped.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-23c5-xmqv-rm74:pkg:129158f1f423f49b12e76a97
File role: production
Source: package-lock.json

Dependency advisory GHSA-968p-4wvh-cqc8:pkg:3023221b39e02d9567361551 applies

Expected behavior · high confidence

This package is only used during development to help compile the code, not when the extension runs in SillyTavern. The reported security issue cannot affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-968p-4wvh-cqc8:pkg:3023221b39e02d9567361551 to a dependency declared by this repository.

Contextual assessment: @babel/runtime is a transitive dependency of @babel/core, which is a devDependency used only during the build process. The vulnerability is not reachable in the shipped extension at runtime, as the package is not included in the deployed artifact. No user data or credentials are exposed.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-968p-4wvh-cqc8:pkg:3023221b39e02d9567361551
File role: production
Source: package-lock.json

Dependency advisory GHSA-5p4m-2wfm-xmqj:pkg:854982e350d33df8baa91ad9 applies

Expected behavior · high confidence

This package helps during development to read YAML files, but it is not included when the extension is installed and used. So the vulnerability does not affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5p4m-2wfm-xmqj:pkg:854982e350d33df8baa91ad9 to a dependency declared by this repository.

Contextual assessment: js-yaml 3.14.1 is a transitive devDependency, not used in the runtime extension. The shipped SillyTavern extension does not include this package. No attacker-controlled input reaches it in a deployed scenario.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-5p4m-2wfm-xmqj:pkg:854982e350d33df8baa91ad9
File role: production
Source: package-lock.json

Dependency advisory GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7 applies

Expected behavior · high confidence

This package is only used by tools that watch files while coding, not in the extension users actually run. No user risk.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7 to a dependency declared by this repository.

Contextual assessment: picomatch 2.3.1 is a transitive devDependency used by file-watching tools during development. It is not included in the runtime extension bundle. The vulnerability has no runtime reachability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7
File role: production
Source: package-lock.json

Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:d681b9f3617b82bd6b835445 applies

Expected behavior · high confidence

This package is used during development to create unique identifiers, but it is not part of the extension that runs in SillyTavern. No danger to users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-28wg-ghj8-5hjv:pkg:d681b9f3617b82bd6b835445 to a dependency declared by this repository.

Contextual assessment: nanoid 3.3.12 is a transitive devDependency, not used in the runtime extension. The package is only present during build and test. No attacker-controlled path reaches it in deployed use.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-28wg-ghj8-5hjv:pkg:d681b9f3617b82bd6b835445
File role: production
Source: package-lock.json

Dependency advisory GHSA-48c2-rrv3-qjmp:pkg:a2b2de1b67a6232727d04ad2 applies

Expected behavior · high confidence

This package is used during development for parsing YAML files, but it is not included in the extension that runs in SillyTavern. The reported issue does not affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-48c2-rrv3-qjmp:pkg:a2b2de1b67a6232727d04ad2 to a dependency declared by this repository.

Contextual assessment: yaml 1.10.2 is a dev/peer dependency (marked dev:true, optional, peer in the lockfile). It is not used in the runtime extension. No runtime reachability, no user impact.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: osv-scanner 2.4.0
Rule: GHSA-48c2-rrv3-qjmp:pkg:a2b2de1b67a6232727d04ad2
File role: production
Source: package-lock.json

Coverage and limitations

Inventory: 19 files · 720486 bytes
Contextual coverage: 49 of 49 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 5 files · 130542 bytes
X-Ray review families: 8 warning occurrences compacted to 4 evidence-preserving review families
Representations: 5 raw · 0 decoded · 1 normalized · 0 bundle modules
Stage scans: 5 raw signatures · 3 raw AST · 5 raw OpenGrep · 1 derived signatures · 1 derived AST · 1 derived OpenGrep

Unresolved JavaScript stages

src/index.ts — raw-ast / parse
src/test/bullet.test.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 8bd72bdbfecf707ebf2d15f0dd11d9fd886644ed
Completed: Aug 11, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · deepseek/deepseek-v4-flash:thinking
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 7 fresh / 0 reused groups · 46 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 3 deterministic / 46 contextual candidates · 7 contextual / 10 total behavior cases
Model budget: 6 model calls · 7 / 12 fresh cases · 191549 / 200000 estimated input · 196661 / 250000 actual input · 24524 / 40000 output tokens
Review batching: 6 model calls · up to 2 groups and 16 candidates per call · 2 retry calls · 0 over-budget singleton calls
Review usage: 196661 input · 24524 output · 0 cache read · 0 reasoning tokens
Report: 2c790e96a8001629bb8761f313847ef2b074db2f01e94f43a0191b94afbac5ba