Any plan to address the risk shown in obsidian plugin website?

[ronaldsuwandi]

As of 23 June 2026, quickadd plugin website indicate 2 risks

https://community.obsidian.md/plugins/quickadd

Any plan to address these?

Disclosures (4)

• Found atob()/btoa() base64 calls (2 total). May be used to obscure strings.
• Malware scan not available.
• Vulnerable dependencies scan not available.
• Obfuscation scan not available.

Risks (2)

• Unsafe assignment to innerHTML src/gui/shared/dragPill.ts:39
• eval can be harmful. src/utilityObsidian.ts:1079

[chhoumann]

Hey @ronaldsuwandi. Thanks for flagging this, and it's nice to see that you're checking.

None of these are actual security issues.
They're heuristic warnings from the automated scanner, and since QuickAdd is fully open source you can verify every one.

Let me explain why I'm saying this.

The automated scanner claims two risks.

1. innerHTML in dragPill.ts. This was setting a static, hardcoded SVG icon (the 6-dot grip you see when reordering choices). There's no user, network, or dynamic data anywhere near it, so it isn't an injection vector. That said, I've already rewritten it to use Obsidian's own DOM helpers (createDiv/createSvg) so there's no innerHTML at all now. That's on master (fix: resolve Obsidian reviewer code-quality findings #1320) and ships in the next release.
2. eval in utilityObsidian.ts. This is QuickAdd's User Scripts / Macros feature. It runs JavaScript that you write and save in your own vault; it never downloads or runs remote or third-party code. It's the core capability that powers custom macros and can't be removed without removing that feature. On master I've already swapped the raw eval for a Function constructor (functionally identical, it runs the same local script). The scanner will keep flagging this in some form, because any plugin that lets you run your own scripts trips this rule. It's inherent to scripting, not a vulnerability.

And as for the disclosures:

• atob()/btoa() is standard base64 encode/decode in src/utils/base64.ts, used by the package import/preview feature. Nothing is obscured. It's all in plain source.
• "Malware / vulnerable-dependency / obfuscation scan not available". These just mean the scanner didn't run those particular checks; they aren't findings against QuickAdd.

I'm closing this as answered, but please let me know if I can answer any further questions!