A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The automated release workflow uses an outdated, no-longer-maintained GitHub tool. This is not a security problem today, but it means the tool will not receive fixes if issues are found later. The workflow does what it says—creates releases—and does not show any harmful or suspicious behavior.
Technical evidence
Scanner reason: zizmor matched workflow-security rule archived-uses. The match applies to this repository.
Contextual assessment: The workflow uses an archived GitHub Action for creating releases. Archived actions receive no security patches or maintenance, creating a long-term supply-chain hygiene concern. The workflow itself runs only on merged pull requests to the release branch, uses the standard scoped GITHUB_TOKEN, and performs only release-creation tasks consistent with its purpose. No malicious behavior, credential exfiltration, or unauthorized data flow is present. The token written to a local file is a minor hygiene issue but not a demonstrated exposure in this CI context.
Impact: low · Exploitability: unlikely
Developer action: Replace the archived action with a maintained alternative such as softprops/action-gh-release or the GitHub CLI release command, and avoid writing tokens to files.
The minified JavaScript file uses very short variable names because the build tool compresses code to save space. This is normal and expected. The code itself is just a sorting utility from a known public library and contains nothing suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.short-identifiers. The match applies to this repository.
Contextual assessment: The flagged short identifiers are the standard output of esbuild minification applied to the natsort npm dependency, which is declared in package.json. The visible code is a natural-sorting comparator implementation with no network access, no credential handling, no dynamic code evaluation, and no suspicious data flow. Short variable names in minified bundles are a normal build artifact, not intentional obfuscation of malicious logic.