"artifactDivergenceSummary":null,"activityTier":"active"},"versions":[{"id":114254,"version":"1.0.2","score":100,"privacyLevel":0,"analyzedAt":"2026-08-17T08:23:32.000Z","releaseDate":"2026-05-29T04:06:58.000Z","artifactStatus":"verified"},{"id":114253,"version":"1.0.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-17T08:23:22.000Z","releaseDate":"2026-05-17T19:55:51.000Z","artifactStatus":null},{"id":114252,"version":"1.0.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-17T08:23:11.000Z","releaseDate":"2026-05-17T18:46:19.000Z","artifactStatus":null}],"findings":[{"id":1138914,"pluginId":"multi-state-checkboxes","version":"1.0.2","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":178,"codeSnippet":"this.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/wolfm/obsidian-multi-state-checkboxes/blob/refs/tags/1.0.2/main.ts#L178"},{"id":1138915,"pluginId":"multi-state-checkboxes","version":"1.0.2","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":446,"codeSnippet":"this.app.vault.process","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/wolfm/obsidian-multi-state-checkboxes/blob/refs/tags/1.0.2/main.ts#L446"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.0.1","initialDiffTo":"1.0.2","summary":"This plugin appears to only change checkbox states in the note you’re editing, using a click, keyboard shortcut, or context menu; it is not confirmed to read other vault data because it uses no Obsidian vault APIs. It has no network activity, so it does not send data to any service, and there is no documented capability to send data to external endpoints.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=8.0.0 <=8.0.15","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":">=8.0.0 <=8.0.15","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=8.0.0 <=8.0.15","severity":"high","title":"vite: `server.fs.deny` bypass on Windows alternate paths","advisoryUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","ghsaId":"GHSA-fx2h-pf6j-xcff","cveId":null,"vulnerableRange":">=8.0.0 <=8.0.15","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":8,"directDeps":0,"transitiveDeps":0}}]]}]

Multi-State Checkboxes