,"totalDownloads":225,"lastAnalyzedAt":"2026-08-12T09:34:17.000Z","securityMdStatus":null,"artifactStatus":"verified","artifactUnavailableReason":null,"artifactDivergenceSummary":null,"activityTier":"active"},"versions":[{"id":102280,"version":"1.0.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-12T09:34:17.000Z","releaseDate":"2026-05-16T07:23:30.000Z","artifactStatus":"verified"}],"findings":[],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"1.0.1","summary":"Canvas Drag Fix appears to work locally by adjusting Obsidian Canvas drag-and-drop input handling on affected Linux setups where Chromium mislabels the mouse as a pen. It does not use any Obsidian vault APIs, so it does not demonstrably read or modify vault content through Obsidian’s data layer. The available metadata reports no network activity, so it does not send data to any endpoints in its current form.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.2","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=2.0.0 <2.1.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"fast-uri","packageVersion":"<=3.1.0","severity":"high","title":"fast-uri vulnerable to path traversal via percent-encoded dot segments","advisoryUrl":"https://github.com/advisories/GHSA-q3j6-qgpj-74h6","ghsaId":"GHSA-q3j6-qgpj-74h6","cveId":null,"vulnerableRange":"<=3.1.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"fast-uri","packageVersion":"<=3.1.1","severity":"high","title":"fast-uri vulnerable to host confusion via percent-encoded authority delimiters","advisoryUrl":"https://github.com/advisories/GHSA-v39h-62p7-jpjc","ghsaId":"GHSA-v39h-62p7-jpjc","cveId":null,"vulnerableRange":"<=3.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"fast-uri","packageVersion":">=3.0.0 <=3.1.3","severity":"high","title":"fast-uri vulnerable to host confusion via literal backslash authority delimiter","advisoryUrl":"https://github.com/advisories/GHSA-v2hh-gcrm-f6hx","ghsaId":"GHSA-v2hh-gcrm-f6hx","cveId":null,"vulnerableRange":">=3.0.0 <=3.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"fast-uri","packageVersion":">=3.0.0 <3.1.3","severity":"high","title":"fast-uri vulnerable to host confusion via failed IDN canonicalization","advisoryUrl":"https://github.com/advisories/GHSA-4c8g-83qw-93j6","ghsaId":"GHSA-4c8g-83qw-93j6","cveId":null,"vulnerableRange":">=3.0.0 <3.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <=4.1.1","sev