"artifactStatus":"verified"},{"id":44360,"version":"1.0.2","score":100,"privacyLevel":0,"analyzedAt":"2025-10-08T07:43:15.000Z","releaseDate":"2025-10-08T07:43:15.000Z","artifactStatus":"verified"},{"id":44358,"version":"1.0.0","score":100,"privacyLevel":0,"analyzedAt":"2025-10-06T13:15:58.000Z","releaseDate":"2025-10-06T13:15:58.000Z","artifactStatus":"verified"},{"id":44359,"version":"1.0.1","score":100,"privacyLevel":0,"analyzedAt":"2025-10-06T12:53:59.000Z","releaseDate":"2025-10-06T12:53:59.000Z","artifactStatus":"unavailable"}],"findings":[{"id":1191536,"pluginId":"time-log","version":"1.0.4","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":46,"codeSnippet":"this.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/eddie/obsidian-time-log/blob/refs/tags/1.0.4/main.ts#L46"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.0.3","initialDiffTo":"1.0.4","summary":"Timelog is a local note-editing plugin that adds timestamps to entries under dated headers for lab-notebook-style logging. It does not use Obsidian Vault APIs and, based on the reviewed metadata, does not send data to any network destination; no network-capable behavior was identified.","dependencyVulnerabilities":[{"packageName":"braces","packageVersion":"<3.0.3","severity":"high","title":"Uncontrolled resource consumption in braces","advisoryUrl":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","ghsaId":"GHSA-grv7-fg5c-xmjg","cveId":null,"vulnerableRange":"<3.0.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"micromatch","packageVersion":"<4.0.8","severity":"moderate","title":"Regular Expression Denial of Service (ReDoS) in micromatch","advisoryUrl":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","ghsaId":"GHSA-952p-6rrq-rcjv","cveId":null,"vulnerableRange":"<4.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7-rcm5-vvqj","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":10,"directDeps":1,"transitiveDeps":0}}]]}]