Ferusnet Security Audit

Ferusnet Security Audit

Static-analysis security audit for your installed Obsidian community plugins.

Obsidian officially cannot sandbox community plugins — every plugin you enable inherits full access to your files, network, and the ability to run shell commands. This plugin scans every installed plugin's bundled main.js for dangerous patterns, verifies its hash against the official GitHub release, and gives each plugin a risk score you can inspect.

Everything runs locally in your vault. The only outbound calls are to api.github.com (to fetch release metadata and asset hashes). Nothing is sent to Ferusnet servers. There is no telemetry, no tracking, and no premium tier.

What it does

• Enumerates every installed community plugin.
• Scans each main.js for ~15 dangerous-API patterns (eval, child_process, remote script loads, mining strings, obfuscated payloads, …).
• Downloads the official GitHub release asset for the installed version and compares SHA-256 against your on-disk copy — a mismatch means the bundle was tampered with post-install.
• Aggregates signals (static findings + GitHub trust + registry stats + author history) into a 0-100 risk score with four tiers: safe / caution / warning / danger.
• Shows the report in a sortable in-vault panel. Expand any row for the exact findings and the top-3 reasons for the score.
• Detects newly installed plugins by polling and offers to scan them.

What it does NOT do

• Does not disable plugins for you. When something looks bad, it opens the Community plugins settings and shows you which one to review — you decide.
• Does not sandbox anything. Obsidian doesn't expose that capability, so no plugin can. This is an audit tool, not a firewall.
• Does not phone home. No Ferusnet backend, no analytics, no cloud sync of results.
• Does not use ML. All rules are transparent regex patterns you can read in src/constants.ts.
• Does not support mobile (isDesktopOnly: true). We hash arbitrary files and need the desktop-only vault adapter.
• Does not guarantee to catch malicious plugins. Static analysis has known blind spots (obfuscation, runtime payload loading, novel patterns). It is one layer of defense, not the only one.

Install

1. Open Settings → Community plugins → Browse.
2. Search for "Ferusnet Security Audit".
3. Install and enable.
4. Click the shield icon in the ribbon, or run Ferusnet Security Audit: Open report from the command palette.

FAQ

Can it stop malware? No. It flags suspicious patterns and hash mismatches, and it warns you the moment a new plugin is installed. Everything else is your call. If a plugin already installed itself and loaded before this one, static analysis can't retroactively undo what already ran.

GitHub rate limits? The unauthenticated GitHub API allows 60 requests per hour. If you have many plugins installed and want faster refresh, add a fine-grained personal access token in the plugin's settings (read-only, no scopes needed) for 5000/hr.

Does it hide any of my data? No. Every network request is to api.github.com for public metadata. No plugin data, no vault content, no telemetry ever leaves your machine.

License

MIT © 2026 Ferusnet