The AI review rates the findings as likely false positive, but the risk score (74/100) still counts them.
Analysis record
- Analysed
- 6 days ago
- Version
- v0.3.115
- Artifact
- SHA256 60C…DA6
- Source
- Findings (non-IoC)
Is Embedder Infineon safe?
Embedder Infineon is described as an AI firmware engineer for Infineon teams. This package declares no special permissions and lists no named network endpoints. Its packaged webview code contains network-capable calls, including NET-FETCH-extension/out/webview-plan.js-78655 in extension/out/webview-plan.js and NET-FETCH-extension/media/kicanvas/kicanvas.js-1 in extension/media/kicanvas/kicanvas.js.
The scanner also flagged OBFUSCATION-LARGE_BASE64-extension/out/webview-plan.js-13387 and OBFUSCATION-FUNCTION_INDIRECT-extension/out/webview-plan.js-55798. If those locations hid code that read a project and sent it to an unknown server, that would be serious. No named server, workspace-file read, secret-file read, shell command, malware signature, or credential finding is provided for these locations.
These alerts come from compiled webview files such as extension/out/webview-plan.js and extension/out/webview/index.js, where bundled JavaScript often contains encoded assets and indirect helper calls. OBFUSCATION-UNICODE_HEAVY-extension/out/extension.js-73497 records a scanner match in packaged output, without showing a harmful action.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
27 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | Base64 encoded Executable Detects an base64 encoded executable (often embedded) | 1 | bin/embedder.exe | Florian Roth FP 2% |
| LOW | credential env files | 5 | out/webview-console.jsout/extension.jsbin/embedder.exe +2 more | - |
| LOW | WeakSSLTLSProtocolsShouldNotBeUsed | 1 | bin/embedder.exe | - |
| LOW | postinstall persistence mechanism | 8 | out/webview/index.jspackage.jsonout/webview-console.js +5 more | - |
| LOW | postinstall crypto operations | 7 | out/webview-console.jsmedia/kicanvas/kicanvas.jsout/webview/index.js +4 more | - |
| LOW | postinstall file manipulation | 11 | package.jsonout/webview-plan.jsmedia/codicon.ttf +8 more | - |
| LOW | NoUseSocketManually | 1 | out/extension.js | - |
| LOW | postinstall system command | 12 | out/extension.jspackage.jsonout/webview-plan.js +9 more | - |
| LOW | postinstall registry modification | 5 | out/webview-console.jsout/extension.jsbin/embedder.exe +2 more | - |
| LOW | postinstall obfuscation | 6 | out/webview-console.jsout/extension.jsbin/embedder.exe +3 more | - |
| LOW | postinstall network communication | 12 | package.jsonout/webview-plan.jsREADME.md +9 more | - |
| LOW | OriginsNotVerified | 2 | bin/embedder.exeout/webview/index.js | - |
| LOW | UsingShellInterpreterWhenExecutingOSCommands | 2 | out/extension.jsbin/embedder.exe | - |
| LOW | credential postgres credentials | 1 | bin/embedder.exe | - |
| LOW | NoUseEval | 1 | bin/embedder.exe | - |
| LOW | NoUseWeakRandom | 5 | out/webview/index.jsout/webview-console.jsout/extension.js +2 more | - |
| LOW | postinstall file download | 8 | media/kicanvas/kicanvas.jsmedia/codicon.ttfREADME.md +5 more | - |
| LOW | credential git credentials | 2 | out/webview/index.jsbin/embedder.exe | - |
| LOW | SQLInjection | 2 | bin/embedder.exeout/webview-sidebar.js | - |
| LOW | credential generic tokens | 1 | out/webview-plan.js | - |
| LOW | postinstall process injection | 1 | bin/embedder.exe | - |
| LOW | DebuggerStatementsShouldNotBeUsed | 5 | out/extension.jsbin/embedder.exeout/webview/index.js +2 more | - |
| LOW | LocalStorageShouldNotBeUsed | 4 | media/kicanvas/kicanvas.jsout/webview/index.jsbin/embedder.exe +1 more | - |
| LOW | spyeye | 1 | bin/embedder.exe | - |
| LOW | UsingCommandLineArguments | 2 | out/extension.jsbin/embedder.exe | - |
| LOW | GEN PowerShell | 1 | bin/embedder.exe | - |
| LOW | ServerHostnameNotVerified | 1 | bin/embedder.exe | - |
Publisher Evidence
Limited evidenceEmbedder
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
12 evidence rows available.
Finding Categories
YARA Rules Matched
27 rules(108 hits)AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The extension describes itself as an “AI firmware engineer for Infineon teams,” and the flagged code is in packaged interface files: extension/out/webview-plan.js, extension/out/webview/index.js, and extension/media/kicanvas/kicanvas.js. The NET-FETCH-extension/out/webview-plan.js-78655 and NET-FETCH-extension/media/kicanvas/kicanvas.js-1 findings show that these browser-facing components contain fetch-capable code. No finding identifies workspace file reads, file writes, shell execution, or child-process creation in extension/out/extension.js or any other path. The package also declares no special permissions and lists no network endpoint, so the available material does not tie these fetch calls to source-code collection or command execution.
There are no findings for .env, .ssh, Git configuration, cloud credential files, VS Code secret storage, or credential providers. The available results contain no secret finding, and the only flagged extension/out/extension.js item is OBFUSCATION-UNICODE_HEAVY-extension/out/extension.js-73497. Unicode-heavy content is not evidence of credential access. Likewise, OBFUSCATION-LARGE_BASE64-extension/out/extension.js-30735 identifies a large Base64 sequence in a compiled output file, without showing that it reads a secret path or sends credentials anywhere.
The strongest concern is the concentration of fetch and obfuscation alerts in extension/out/webview-plan.js. NET-FETCH-extension/out/webview-plan.js-78401, NET-FETCH-extension/out/webview-plan.js-78484, and NET-FETCH-extension/out/webview-plan.js-78659 identify several fetch call sites, while OBFUSCATION-FUNCTION_INDIRECT-extension/out/webview-plan.js-55798 and OBFUSCATION-LARGE_BASE64-extension/out/webview-plan.js-13387 identify indirect calls and embedded encoded data. If these locations contained concealed code that uploaded firmware projects, that would be a serious concern. The findings provide neither a destination hostname nor a connection between those calls and workspace data, credentials, or install-time execution.
The file names also fit ordinary bundled webview code. extension/out/webview-plan.js and extension/out/webview/index.js are generated output paths where minifiers commonly produce indirect functions, encoded assets, and dense Unicode content. OBFUSCATION-UNICODE_HEAVY-extension/out/webview-plan.js-19688 and OBFUSCATION-LARGE_BASE64-extension/out/webview/index.js-1539 therefore describe scanner patterns in distribution artifacts rather than a shown malicious action. No malware signature, tool-poisoning finding, or named suspicious endpoint accompanies these alerts.
This assessment is limited by the lack of source-level context for the fetch calls in extension/out/webview-plan.js. Runtime inspection would be warranted if a future scan links NET-FETCH-extension/out/webview-plan.js-78655 to a named untrusted host, or links it to reads of workspace files or secret paths. On the material available here, the alerts identify bundled webview behavior without evidence of data theft, credential collection, or payload execution.
Key Reasons
NET-FETCH-extension/out/webview-plan.js-78655and related alerts identify fetch-capable bundled webview code, with no named destination or linked workspace-data read.- No special permissions or named network endpoints are declared.
- No finding identifies reads of
.env,.ssh, cloud credentials, Git configuration, or VS Code secret storage. OBFUSCATION-LARGE_BASE64-extension/out/webview-plan.js-13387and related alerts occur in compiled output paths, without malware, payload-execution, or exfiltration evidence.
False Positive Considerations
- Bundled and minified webview output in
extension/out/webview-plan.jsandextension/out/webview/index.js. - Generic fetch detection without a named destination or shown transmitted data.
- Base64, indirect-function, and Unicode-heavy patterns in compiled JavaScript.
- No malware signature, credential-access finding, or tool-poisoning finding.
Reviewed 2026-09-27; recommended action: suppress false positive; model confidence 82%.
Open VSX version history
Risk trend by version
9 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace