183998,"pluginId":"sync-contacts-macos","version":"2.0.0","category":"permissions_scope","severity":"info","filePath":"src/suggesters/Suggest.ts","lineNumber":164,"codeSnippet":"this.app.keymap.pushScope","explanation":"Accesses Obsidian API: app.keymap","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/motschel123/Mac-Contact-Sync-Obsidian/blob/refs/tags/2.0.0/src/suggesters/Suggest.ts#L164"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"src/services/OsascriptService.ts","lineNumber":10,"codeSnippet":" 7 | \n 8 | export class OsaScriptService {\n 9 | executeScriptStream(JXA_script: string): Readable {\n> 10 | const osascript = spawn('osascript', ['-l', 'JavaScript', '-e', JXA_script], SPAWN_OPTS);\n 11 | if (!osascript.stdout) {\n 12 | throw new Error('Failed to start osascript process');\n 13 | }","networkType":"active-outbound","sendsData":true,"dataDescription":"child_process.spawn() executes a shell command — review for network access","endpointSource":"unresolved"},{"host":"","url":null,"filePath":"src/services/OsascriptService.ts","lineNumber":35,"codeSnippet":" 32 | async executeScript(JXA_script: string): Promise {\n 33 | return new Promise((resolve, reject) => {\n 34 | // Start JXA Script\n> 35 | const osascript = spawn('osascript', ['-l', 'JavaScript', '-e', JXA_script]);\n 36 | \n 37 | let output: string = '';\n 38 | \t\t\tosascript.stdout.on('data', (data: Buffer) => {","networkType":"active-outbound","sendsData":true,"dataDescription":"child_process.spawn() executes a shell command — review for network access","endpointSource":"unresolved"}],"initialDiff":null,"initialDiffFrom":"1.0.7","initialDiffTo":"2.0.0","summary":"The plugin reads one vault file by path and has permission to access all files in the vault, so it can inspect additional notes or metadata if its code uses that broader access. It also launches a shell command with `child_process.spawn()`, which is confirmed process execution and may involve network activity depending on what command is run. No specific remote endpoint was identified from the available data.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.2","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=2.0.0 <2.1.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryU

Sync Contacts on macOS