CodeSnippet

AI Security Review

Evidence context: threat category none; evidence quality moderate.

CodeSnippet is a JetBrains IDE plugin, version 1.0.5, with 1,233 users. Its manifest declares no permissions and no host permissions, so it asks for nothing beyond the IDE defaults. Nothing in the package matched a malware signature, and the scan recorded no obfuscation, no dependency, no secret and no network findings.

On filesystem and process access: a snippet manager needs to read and write source files inside the open project, and it may spawn a helper for clipboard or template expansion. The scan produced no process-execution finding and no workspace-file-read finding, so there is no capability to weigh against that purpose. The 22 indicators that carry medium severity all come from a single extractor pass over packaged files, and their titles name build and source artifacts rather than infrastructure the plugin contacts.

On credentials: the secret category returned zero. No finding references .env, .git/config, id_rsa, AWS or GCP credential paths, and none touches IDE secret storage. Six code-smell hits sit at low severity. Those rules match generic constructs such as environment variable reads and child_process references, which turn up in ordinary build scripts and bundled libraries. Seven informational hits round out the 35.

The endpoint list deserves a direct look, because it is the only part of the evidence that reads as threatening. Entries q7ɖ.lv, ș.gg, ژ.gl, ݑtӗx.mm and ϱ.tt mix non-Latin characters into TLD-shaped strings. XIOC-DOMAIN-pom.properties flags a Maven descriptor filename, not a hostname. XIOC-DOMAIN-t.ph, XIOC-DOMAIN-f.ru and XIOC-DOMAIN-n.pe match fragments of two to five letters. Strings like these get lifted from constant pools inside compiled class files and from minified JavaScript during extraction. The manifest declares no network permission, so the plugin holds no sanctioned route to contact any of them.

The strongest counterargument is that a plugin with no declared permissions can still ship a payload the static pass never sees, and the developer identity here is a bare UUID (df1a1dba-6b1e-42e0-a24a-116c1507dadd) with no publisher name attached. That absence of a named publisher lowers accountability. It does not change what the scan found, because a payload that reads workspace files and posts them out needs code doing both, and no such code surfaced. JetBrains reviews plugins before they reach the marketplace, and CodeSnippet has been installed 1,233 times without a reported incident.

A snippet manager that handles text files and declares no permissions gives the scanner nothing real to grab onto. The medium-severity indicators trace back to domain pattern matching over compiled artifacts, not to anything CodeSnippet does at runtime.

Key Reasons

• No permissions and no host permissions declared in the JetBrains manifest, so no runtime route exists for the listed endpoints.
• Zero malware signatures, zero secret findings, zero obfuscation and zero network findings across the package.
• All 22 medium-severity indicators are XIOC domain matches over string fragments in packaged artifacts, typified by XIOC-DOMAIN-pom.properties flagging a Maven descriptor filename.
• Code-smell hits sit at low severity and match generic Node/Java constructs present in bundled build tooling.
• A snippet manager reading and writing project text files matches its stated purpose, and no findings show workspace reads paired with outbound calls.

False Positive Considerations

• Domain-pattern extraction over two to five letter string fragments in compiled class files (XIOC-DOMAIN-t.ph, XIOC-DOMAIN-f.ru, XIOC-DOMAIN-n.pe)
• Build descriptor filename pom.properties parsed as a domain (XIOC-DOMAIN-pom.properties)
• Low-severity code-smell rules matching generic environment variable and child_process patterns in bundled libraries
• Non-Latin characters in TLD-shaped strings (q7ɖ.lv, ș.gg, ݑtӗx.mm) produced by the IoC extractor

Reviewed 2026-09-30; recommended action: suppress false positive; model confidence 85%.