currentScore":99,"currentPrivacyLevel":0,"confidence":null,"totalDownloads":56033,"lastAnalyzedAt":"2026-08-20T06:30:15.000Z","securityMdStatus":null,"artifactStatus":"unavailable","artifactUnavailableReason":"Build failed: Node.js v22.23.1","artifactDivergenceSummary":null,"activityTier":"active"},"versions":[{"id":120075,"version":"0.1.7","score":99,"privacyLevel":0,"analyzedAt":"2026-08-20T06:30:15.000Z","releaseDate":"2026-05-30T12:52:03.000Z","artifactStatus":"unavailable"},{"id":120074,"version":"0.1.6","score":99,"privacyLevel":0,"analyzedAt":"2026-08-20T06:30:03.000Z","releaseDate":"2026-05-14T18:10:01.000Z","artifactStatus":null},{"id":120073,"version":"0.1.5","score":99,"privacyLevel":0,"analyzedAt":"2026-08-20T06:29:52.000Z","releaseDate":"2026-05-14T17:51:04.000Z","artifactStatus":null},{"id":120072,"version":"0.1.4","score":99,"privacyLevel":0,"analyzedAt":"2026-08-20T06:29:41.000Z","releaseDate":"2026-05-14T17:42:15.000Z","artifactStatus":null}],"findings":[{"id":1175226,"pluginId":"smart-lookup","version":"0.1.7","category":"permissions_scope","severity":"info","filePath":"src/main.js","lineNumber":28,"codeSnippet":"this.app.workspace.onLayoutReady","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/brianpetro/smart-lookup-obsidian/blob/refs/tags/0.1.7/src/main.js#L28"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.1.6","initialDiffTo":"0.1.7","summary":"Smart Lookup is a local semantic-search plugin that works on the contents of your vault to find notes by meaning, preview matches, and help surface related links and next steps. In the reviewed metadata, it does not use Obsidian Vault APIs and no network activity was observed, so it does not demonstrably send vault data to any external service. Based on this information, its behavior appears limited to on-device note analysis and retrieval.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.2","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=2.0.0 <2.1.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":"<3.15.0","severity":"moderate","title":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","advisoryUrl":"https://github.com/advisories/GHSA-h67p-54hq-rp68","ghsaId":"GHSA-h67p-54hq-rp68","cveId":null,"vulnerableRange":"<3.15.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=3.0.0 <3.15.0","severity":"high","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","advisoryUrl":"https://github.com/advisories/GHSA-52cp-r559-cp3m","ghsaId":"GHSA-52cp-r559-cp3m","cveId":null,"vulnerableRange":">=3.0.0 <3.15.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"tar","packageVersion":"<=7.5.15","severity":"moderate","title":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causi