TM Launcher

AI Security Review

Evidence context: threat category none; evidence quality strong.

TM Launcher is a social media quick-launch extension that has triggered 156 total findings, primarily 150 IoC detections. A detailed examination of these findings reveals they are entirely benign and consistent with the extension's stated functionality.

All 150 IoC findings reference legitimate, well-known websites that directly align with the extension's description: "Quick launch your all Social Media's Accounts in a single click." The detected URLs include https://open.spotify.com/, https://www.netflix.com/in/, https://www.instagram.com/, https://www.linkedin.com/feed/, https://web.whatsapp.com/, https://www.youtube.com/, https://www.messenger.com/, https://www.amazon.in/, https://www.microsoft.com/, https://www.apple.com/, https://vk.com/, and https://www.epicgames.com/. These are not suspicious domains, custom search engines, or credential-harvesting endpoints. They are the exact websites a social media launcher extension would reference. The IoC extractor flagged these as findings because they are URLs, not because they indicate malicious behavior.

The remaining 6 findings are classified as code-smell with low severity. Per the CVEQ threat model, code-smell findings (including rules like postinstall_*, credential_*, and code-quality checks) are documented noise sources that fire on almost any non-trivial JavaScript and should never drive a verdict. These findings do not indicate malicious code.

Critically, the extension has zero malware signatures, zero malware findings, zero obfuscation findings, and zero network findings. There is no evidence of credential theft, browser hijacking, proxyware, or data exfiltration. The extension does not reference any suspicious domains outside the legitimate social media and e-commerce sites it is designed to launch.

Counterargument: A skeptic could argue that the developer using a personal Gmail address ([email protected]) instead of a verified company name is a red flag, and the high finding count (156 total) warrants concern. However, developer anonymity alone does not indicate malicious intent—many legitimate small-scale extensions use personal accounts. The finding count is driven entirely by the IoC extractor flagging legitimate URLs as detections, which is a known false-positive pattern. The nature of the IoCs (all legitimate websites matching the extension's purpose) matters far more than the count. Without malware signatures, obfuscation, or suspicious domains, the evidence does not support a malicious verdict.

This extension performs exactly what it claims: launching social media websites. The findings are false positives from the IoC extractor's volume-based detection.

Key Reasons

• All 150 IoC findings reference legitimate websites matching extension purpose
• Zero malware signatures detected
• Zero obfuscation or network findings
• Code-smell findings are documented false positives
• Extension behavior aligns with stated functionality

False Positive Considerations

• IoC volume from legitimate URLs
• Code-smell rules on non-trivial JavaScript

Reviewed 2026-05-09; recommended action: suppress false positive; model confidence 85%.