"context":{"endpointSource":"hardcoded-url"},"sourceUrl":"https://github.com/konfuzz/arweave-uploader-plugin/blob/1.0.1/main.ts#L180"}],"resolvedFindings":[{"category":"network_calls","severity":"info","filePath":"main.ts","lineNumber":182,"codeSnippet":" 179 | \t}\n 180 | \n 181 | \tasync getArPriceInUSD() {\n> 182 | \t\tconst response = await fetch('https://api.coingecko.com/api/v3/simple/price?ids=arweave&vs_currencies=usd');\n 183 | \t\tconst data = await response.json();\n 184 | \t\treturn data.arweave.usd;\n 185 | \t}","explanation":"fetch() makes a network request to api.coingecko.com (https://api.coingecko.com/api/v3/simple/price?ids=arweave&vs_currencies=usd)","networkType":"active-inbound","host":"api.coingecko.com","chainLink":2,"findingKind":"capability","context":{"endpointSource":"hardcoded-url"},"sourceUrl":"https://github.com/konfuzz/arweave-uploader-plugin/blob/1.0.0/main.ts#L182"}],"scoreChange":5}},"initialDiffFrom":"1.0.0","initialDiffTo":"1.0.1","summary":"This plugin reads file contents from your Obsidian vault and converts them to HTML for upload to Arweave, a decentralized blockchain storage network. It fetches cryptocurrency price data from an external API, likely to estimate upload costs or transaction fees. The code is unobfuscated, allowing transparent inspection of its network requests and data handling. The plugin's privacy practices are not formally documented, though the upload to Arweave means your converted notes are written to a permanent, public distributed ledger.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"bn.js","packageVersion":"<4.12.3","severity":"moderate","title":"bn.js affected by an infinite loop","advisoryUrl":"https://github.com/advisories/GHSA-378v-28hj-76wf","ghsaId":"GHSA-378v-28hj-76wf","cveId":null,"vulnerableRange":"<4.12.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"cross-spawn","packageVersion":">=7.0.0 <7.0.5","severity":"high","title":"Regular Expression Denial of Service (ReDoS) in cross-spawn","advisoryUrl":"https://github.com/advisories/GHSA-3xgq-45jj-v275","ghsaId":"GHSA-3xgq-45jj-v275","cveId":null,"vulnerableRange":">=7.0.0 <7.0.5","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path"

Arweave Uploader