The code is plain, readable JavaScript for a favorites carousel UI. There is no hidden code, no secret network calls, and no suspicious behavior. The scanner flag is a false alarm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal on line 1 is a false positive. The supplied source is fully plain-text, human-readable JavaScript with standard ES module imports from SillyTavern APIs, clear function names, inline comments, and no eval, hex decoding, string packing, minified blobs, or concealed execution. Data flow is entirely local DOM manipulation: it reads entity lists, builds avatar elements, manages scroll behavior, and toggles UI visibility. No network requests, credential access, external destinations, or obfuscation are present. All capabilities match the stated purpose of a favorites carousel extension.
Readable DOM-only carousel extension with no obfuscation
low risk · high confidence
The extension only reads the local character list and builds a scrolling favorites bar. It does not send data anywhere or access sensitive information.
Technical assessment
The entire file consists of DOM manipulation for a UI carousel: importing eventSource, event_types, getEntitiesList, getThumbnailUrl, and debounce from SillyTavern internals; creating wrapper elements; filtering favorite entities; cloning carousel items for infinite scroll; and wiring click/scroll/resize handlers. No outbound network calls, no filesystem access, no credential handling, and no dynamic code evaluation are present. Behavior is proportionate to the extension's stated purpose.