dAt":"2026-08-15T10:04:43.000Z","releaseDate":"2026-05-19T17:41:23.000Z","artifactStatus":null},{"id":109816,"version":"1.0.3","score":100,"privacyLevel":0,"analyzedAt":"2026-08-15T10:04:34.000Z","releaseDate":"2026-05-19T17:37:32.000Z","artifactStatus":null},{"id":109815,"version":"1.0.2","score":100,"privacyLevel":0,"analyzedAt":"2026-08-15T10:04:24.000Z","releaseDate":"2026-05-19T17:34:58.000Z","artifactStatus":null},{"id":109814,"version":"1.0.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-15T10:04:15.000Z","releaseDate":"2026-05-19T17:31:42.000Z","artifactStatus":null},{"id":109813,"version":"1.0.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-15T10:04:05.000Z","releaseDate":"2026-05-19T15:52:33.000Z","artifactStatus":null}],"findings":[{"id":1110173,"pluginId":"iconik","version":"1.0.5","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":25,"codeSnippet":"this.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/creagleone/obsidian-iconik/blob/refs/tags/1.0.5/src/main.ts#L25"},{"id":1110174,"pluginId":"iconik","version":"1.0.5","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":33,"codeSnippet":"this.app.vault.on","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/creagleone/obsidian-iconik/blob/refs/tags/1.0.5/src/main.ts#L33"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.0.4","initialDiffTo":"1.0.5","summary":"Iconik is a local customization plugin that changes icons and text colors in Obsidian. In the reviewed code, it does not use Obsidian vault APIs and no network activity was observed, so it does not demonstrably read vault contents or send data to any external service during normal use. Any effect it has appears to be limited to applying user-selected appearance settings within the app.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.2","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=2.0.0 <2.1.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":