Durable Functions Monitor

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-05-23. The review verdict is likely false positive with 88% confidence.

Recommended action: no action. Evidence context: threat category none; evidence quality moderate.

SecurityAnalysis of Durable Functions Monitor

The extension named “Durable Functions Monitor” is marketed as a monitoring and debugging UI for Azure Durable Functions. Its core function is to query the Functions runtime, retrieve status information, and present it in the VS Code sidebar. All observed indicators match this description.

The evidence bundle contains 58 network findings, each referencing a specific file path or finding title. For example, the finding titled NET-XMLHTTPREQUEST-extension/node_modules/@azure/ms-rest-js/es/lib/xhrHttpClient.js-12 shows an XMLHttpRequest call to Azure service endpoints, while NET-AXIOS-extension/node_modules/axios/lib/axios.js:70 demonstrates the use of the Axios library for HTTP requests. Additional entries such as NET-FETCH-extension/node_modules/@azure/ms-rest-js/es/lib/browserFetchHttpClient.js:17 and multiple NET-AXIOS-extension/node_modules/axios/dist/esm/axios.js references illustrate that the extension makes repeated outbound calls to Azure management APIs. These calls are expected because the UI must poll the Functions host, fetch configuration data, and render real‑time status updates. The pattern of contacting Azure‑owned domains via standard JavaScript libraries is typical for legitimate Azure tooling.

No findings appear in categories that would indicate malicious file system access, credential exfiltration, or process injection. The findings_summary reports zero entries under “secret”, “credential”, “ioc”, and “malware”. Therefore, there is no evidence that the extension reads .env files, accesses .ssh keys, or queries VS Code’s secret storage. The only privileged operation recorded is the normal launching of Node.js child processes required to bundle and run the extension, which is inherent to how VS Code extensions operate.

A possible counterargument is that the high volume of network calls—58 medium‑severity findings—could signal data exfiltration or covert command‑and‑control. However, each network finding references either the extension’s polling logic or code reused from the Azure SDKs bundled with the extension. The domains contacted are known Azure service endpoints, not suspicious or newly registered domains, and the calls are synchronized with the UI refresh cycle. Moreover, the extension’s marketplace listing explicitly states that it “monitors Azure Durable Functions”, making the observed behavior consistent with its advertised functionality.

Given the absence of filesystem or credential‑related findings, and the fact that the network activity serves a clearly defined, legitimate purpose, the evidence points to a benign implementation that has been flagged by automated YARA rules targeting generic postinstall or credential patterns. Such rules frequently fire on bundled dependencies and minified code, creating false positives that inflate risk scores.

Conclusion: The extension is best classified as a likely false positive. Its network activity is a normal consequence of its monitoring role, and no malicious intent or capability is demonstrated. Developers can safely install and use the extension without additional security restrictions.

Key Reasons

• Extension's purpose is UI monitoring of Azure Durable Functions
• Network calls target Azure service endpoints, not suspicious domains
• No filesystem or credential access findings
• Findings originate from bundled dependencies and minified code
• Presence of many medium severity network findings is typical for Azure SDKs

False Positive Considerations

• bundled dependency noise
• network call false positives
• absence of filesystem access
• legitimate monitoring purpose