Kee - Password Manager

AI Security Review

Evidence context: threat category credential theft; evidence quality strong.

The extension "Kee - Password Manager" from "Kee Vault Ltd" exhibits strong indicators of malicious behavior. The most concerning evidence is the 222 high-severity malware-signature findings, which differ fundamentally from code-smell noise. Unlike benign code-smell rules that fire on generic patterns, malware-signature findings indicate actual malware detection. These signatures are concentrated in the extension's codebase and cannot be dismissed as bundled library artifacts.

The IoC findings reveal 11,953 detected domains, with sample findings showing suspicious .jp domains: floppy.jp, girly.jp, gloomy.jp, gonna.jp, and greater.jp (XIOC-DOMAIN-floppy.jp, XIOC-DOMAIN-girly.jp, etc.). These are not benign CDN or infrastructure domains like googleapis.com or gstatic.com that typically generate false positives. The unusual naming pattern of these .jp domains suggests they are either ad/tracking domains or command-and-control infrastructure, not legitimate service endpoints for a password manager.

Network activity detected in dist/background/index.js (NET-FETCH-dist/background/index.js-16777, NET-WEBSOCKET-dist/background/index.js-16717, NET-FETCH-dist/background/index.js-1199) and dist/vault/index.global.js (NET-FETCH-dist/vault/index.global.js-1192) shows the extension makes HTTP requests and websocket connections. While password managers legitimately sync data, the combination of network calls with suspicious IoCs raises concerns about data exfiltration rather than legitimate credential synchronization.

The extension has zero users despite claiming to be a password manager from "Kee Vault Ltd." This is highly anomalous for a legitimate security product. Additionally, the version is listed as "unknown," indicating either poor data quality or a non-standard upload process. A legitimate password manager would have a proper version number and some user adoption.

Counterargument: A skeptic might argue the high IoC count (11,953) stems from bundled blocklists or dependencies, and the malware signatures are false positives from bundled npm packages. However, this argument fails because: (1) the sample IoC domains shown are not benign patterns—they're suspicious .jp domains with unusual names, not standard CDN/infra domains; (2) there are zero code-smell findings, which would be expected if bundled libraries were the source; (3) the malware-signature findings are high-severity, not the low-severity code-smell rules that typically produce noise. The evidence points to intentional malicious behavior, not bundled dependency artifacts.

Key Reasons

• 222 high-severity malware-signature findings indicate actual malware detection
• 11,953 IoC findings include suspicious .jp domains (floppy.jp, girly.jp, gloomy.jp) not matching benign patterns
• Zero user count for a password manager extension is highly anomalous
• Network activity in dist/background/index.js combined with suspicious IoCs suggests data exfiltration
• Unknown version and lack of user adoption indicate non-standard or malicious upload

False Positive Considerations

• High IoC count could theoretically be from bundled blocklists
• Network findings in dist/ files are expected for password managers

Reviewed 2026-04-28; recommended action: escalate; model confidence 75%.