ctStatus":"verified"},{"id":8910,"version":"1.0.0","score":88,"privacyLevel":null,"analyzedAt":"2025-03-24T05:57:15.000Z","releaseDate":"2025-03-24T05:57:15.000Z","artifactStatus":"divergent"}],"findings":[{"id":744234,"pluginId":"double-row-toolbar","version":"1.0.1","category":"network_calls","severity":"info","filePath":"bump.ts","lineNumber":81,"codeSnippet":" 78 | function gitCommitAndTag() {\n 79 | \ttry {\n 80 | \t\t// Stage all changes\n> 81 | \t\texecSync(\"git add .\");\n 82 | \t\tconsole.log();\n 83 | \t\tconsole.log(logInsert([\"-- staged all changes. ✓✓\", \"greenBright\", null]));\n 84 | \t\t// Commit with the packageSemver as the message","explanation":"Prepares all file changes for saving to version control","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/lorens-osman-dev/double-row-toolbar/blob/1.0.1/bump.ts#L81"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"bump.ts","lineNumber":81,"codeSnippet":" 78 | function gitCommitAndTag() {\n 79 | \ttry {\n 80 | \t\t// Stage all changes\n> 81 | \t\texecSync(\"git add .\");\n 82 | \t\tconsole.log();\n 83 | \t\tconsole.log(logInsert([\"-- staged all changes. ✓✓\", \"greenBright\", null]));\n 84 | \t\t// Commit with the packageSemver as the message","networkType":"active-outbound","sendsData":true,"dataDescription":"child_process.execSync() executes a shell command — review for network access","endpointSource":"unresolved"}],"initialDiff":{"pluginId":"double-row-toolbar","fromVersion":"1.0.0","toVersion":"1.0.1","files":[],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":5}},"initialDiffFrom":"1.0.0","initialDiffTo":"1.0.1","summary":"The double-row-toolbar plugin adds a mobile UI feature without accessing Obsidian's vault APIs or local files. The plugin performs outbound network activity to prepare file changes for version control systems, indicating integration with git or similar VCS workflows. With no detected obfuscation, the code is transparent for review. No data exfiltration or remote communication to external services was observed beyond the version control integration.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packag

Double row toolbar