,"sendsData":true,"dataDescription":"URL property targets obsidian.md (https://obsidian.md/plugins?id=select-to-note) (allowlisted)","endpointSource":"hardcoded-url"},{"host":"translation.googleapis.com","url":"https://translation.googleapis.com/language/translate/v2?key=${encodeURIComponent(settings.googleTranslateApiKey)}","filePath":"chrome-extension/service-worker.js","lineNumber":197,"codeSnippet":" 194 | if (!settings.googleTranslateApiKey) {\n 195 | throw new Error(\"Set Google Cloud Translation API key first.\");\n 196 | }\n> 197 | const response = await fetch(`https://translation.googleapis.com/language/translate/v2?key=${encodeURIComponent(settings.googleTranslateApiKey)}`, {\n 198 | body: JSON.stringify({\n 199 | format: \"text\",\n 200 | q: text,","networkType":"active-outbound","sendsData":true,"dataDescription":"Sends data to translation.googleapis.com via fetch. This destination is hardcoded in the plugin source.","endpointSource":"hardcoded-url"}],"initialDiff":null,"initialDiffFrom":"0.1.8","initialDiffTo":"0.1.9","summary":"The plugin reads one vault file and can scan files by path in a loop, which suggests it looks through your notes to place clipped content into the active note or related files. It sends selected browser content to a local companion service at `127.0.0.1:27124/capture`, and it retrieves data from a configured endpoint plus a URL that is determined at runtime. The source code also sends data to Baidu and Google translation services, and it contains one additional outbound request whose destination could not be resolved from the code.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":">=0.27.3 <0.28.1","severity":"low","title":"esbuild allows arbitrary file read when running the development server on Windows","advisoryUrl":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","ghsaId":"GHSA-g7r4-m6w7-qqqr","cveId":null,"vulnerableRange":">=0.27.3 <0.28.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=7.0.0 <=7.3.4","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":">=7.0.0 <=7.3.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=7.0.0 <=7.3.4","severity":"high","title":"vite: `server.fs.deny` bypass on Windows alternate paths","advisoryUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","ghsaId":"GHSA-fx2h-pf6j-xcff","cveId":null,"vulnerableRange":">=7.0.0 <=7.3.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vitest","packageVersion":"<3.2.6","severity":"critical","title":"When Vitest UI server is listening, arbitrary file can be read and executed","advisoryUrl":"https://github.com/advisories/GHSA-5xrq-8626-4rwp","ghsaId":"GHSA-5xrq-8626-4rwp","cveId":null,"vulnerableRange":"<3.2.6","fixAvailable":null,"source":"npm-audit","isDirect":true,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":6,"directDeps":0,"transitiveDeps":0}}]]}]

Select to Note