Status":null,"artifactStatus":"verified","artifactUnavailableReason":null,"artifactDivergenceSummary":null,"activityTier":"active"},"versions":[{"id":105062,"version":"0.1.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-13T11:28:43.000Z","releaseDate":"2026-07-22T15:58:04.000Z","artifactStatus":"verified"},{"id":105061,"version":"0.1.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-13T11:28:33.000Z","releaseDate":"2026-07-18T18:46:33.000Z","artifactStatus":null}],"findings":[{"id":1079207,"pluginId":"details-markdown","version":"0.1.1","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":94,"codeSnippet":"this.app.workspace.getLeavesOfType","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/nickolay-kondratyev/obsidian-plugin-collapsible-details/blob/refs/tags/0.1.1/src/main.ts#L94"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.1.0","initialDiffTo":"0.1.1","summary":"This plugin works locally in Reading view by rendering Markdown elements inside native HTML `

` blocks, so it processes the note content already being displayed. It does not use Obsidian Vault APIs, and it has no reported network activity, so it does not send data to any remote service.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","advisoryUrl":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","ghsaId":"GHSA-4w7w-66w2-5vf9","cveId":null,"vulnerableRange":"<=6.4.1","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"high","title":"vite: `server.fs.deny` bypass on Windows alternate paths","advisoryUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","ghsaId":"GHSA-fx2h-pf6j-xcff","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"vite-node > vite, vitest > vite"},{"packageName":"vitest","packageVersion":"<3.2.6","severity":"critical","title":"When Vitest UI server is listening, arbitrary file can be read and executed","advisoryUrl":"https://github.com/advisories/GHSA-5xrq-8626-4rwp","ghsaId":"GHSA-5xrq-8626-4rwp","cveId":null,"vulnerableRange":"<3.2.6","fixAvailable":"4.1.10","source":"npm-audit","isDirect":true,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":7,"directDeps":0,"transitiveDeps":0}}]]}]

Details Markdown