JTools SSH Publisher

AI Security Review

Evidence context: threat category none; evidence quality moderate.

JTools SSH Publisher is a JetBrains IDE extension with no declared permissions and no host access requests. The extension's stated purpose is SSH publishing—spawning SSH processes and managing key-based connections are core functions for this use case, and the bundle shows no credential-access findings targeting .env, .ssh directories, or cloud credentials.

The 162 XIOC findings reporting domains like jm.ad, i.cl, tf.cd, and s.re are characteristic false positives from the XIOC extractor parsing minified JavaScript. Several extracted domains contain diacritical marks (ϣr.sm, 0ϗ.cc, 9rŕ.tz, 2ļ.ky), which are artifacts of minified code parsing rather than real network indicators. The property-chain pattern (pom.properties appearing as a domain, m.mo, m.ye) confirms the extractor is tokenizing code, not discovering actual infrastructure.

No malware signatures matched. Zero credential-theft indicators. The 21 code-smell findings are low-severity YARA rules firing on standard Node.js patterns (process, fs, env variable reference)—this is expected in any extension that performs local system operations. These rules are not indicators of malicious intent.

The network_endpoints list in the bundle consists of the same implausible two-letter domains extracted by XIOC, strongly suggesting they are parsing artifacts rather than command-and-control servers the extension actually connects to. Real C2 infrastructure does not consist of random TLD combinations with Unicode corruption.

The strongest counterargument is that 162 findings could indicate obfuscation or intentional hiding. However, the nature of the findings—property-chain misreadings, locale file fragments with diacritical marks, and bundled dependency IoCs—points to scan noise, not malicious obfuscation. Legitimate IDE extensions are routinely minified, bundled with npm packages, and generate large XIOC counts as a side effect of toolchain output. The absence of any malware signature match, credential theft attempt, or postinstall payload execution is more informative than the raw finding count.

This extension appears to be a legitimate development tool triggering expected false positives from automated scanning of minified code.

Key Reasons

• 162 of 191 findings are XIOC domain extractions from minified JavaScript, matching known false-positive patterns (property chains, locale file fragments, and generic TLDs)
• No malware signatures matched; no credential-access findings; no secret reads detected
• Network endpoints consist entirely of implausible two-letter domains with diacritical marks (0ϗ.cc, 9rŕ.tz, 2ļ.ky) characteristic of XIOC parsing minified code, not real C2
• 21 code-smell findings are low-severity YARA noise on standard Node.js patterns
• Extension declares no special permissions and makes no host access requests

False Positive Considerations

• XIOC extractor misreading minified JavaScript property chains and character sequences as domain names
• Diacritical marks and Unicode artifacts in extracted domains indicate OCR/parsing errors, not actual network infrastructure
• Bundled or minified source producing multiplicative false positives across generic TLD combinations

Reviewed 2026-09-29; recommended action: suppress false positive; model confidence 72%.