People

AI Security Review

Evidence context: threat category none; evidence quality strong.

The People extension (version 1.0.5, developer: [email protected]) generates 643 total findings, but the nature of these findings indicates systematic false positives rather than malicious behavior.

IoC Findings Are Extractor Artifacts All 609 IoC findings (94.7% of total) are property access chains incorrectly parsed as domains by the XIOC extractor. Specific examples from the evidence include: array.prototype.filter.call, this.host, a.host, htmlelement.prototype.click, and e.nativemethods.queryselectorall.call. These are JavaScript method chains, not network domains. The CVEQ documentation explicitly lists property access chains like b.call, h.next, g.id as IoC Extractor Garbage. The file_path for all IoC findings is extracted_from_files, indicating these were extracted from minified/bundled JavaScript without semantic analysis.

No Malware Signatures Detected The findings_summary shows "malware-signature":"0" and "malware":"0". This is critical: confirmed malicious extensions always have malware signatures co-located with obfuscation. The absence of any malware signatures means no known malicious code patterns were detected.

No Obfuscation or Network Activity The findings_summary shows "obfuscation":"0" and "network":"0". Malicious extensions route data to suspicious domains, which would appear as network findings. The 34 code-smell findings (severity: high) are classified as noise per CVEQ documentation—rules like postinstall_* and credential_* fire on basic JavaScript patterns and should never drive a verdict.

Counterargument Addressed A skeptic might argue that the developer email [email protected] is not a verified publisher and the extension description is vague. However, publisher verification alone does not determine maliciousness. The evidence shows no actual suspicious behavior: no real domains in IoCs, no malware signatures, no obfuscation, no network exfiltration. The 455 user count is low but not anomalous for a new extension. The finding nature—not the developer identity—determines the verdict, and the finding nature here is textbook false positive patterns.

Conclusion This extension's findings are driven entirely by known CVEQ false-positive patterns. The risk score inflation from 609 garbage IoC findings is a documented scoring bias. No evidence of malicious intent or capability exists.

Key Reasons

• All 609 IoC findings are property access chains misread as domains (e.g., array.prototype.filter.call, htmlelement.prototype.click)
• Zero malware signatures detected in findings_summary
• Zero obfuscation findings detected
• Zero network findings—no actual domain communication detected
• Code-smell findings are low-severity noise per CVEQ documentation

False Positive Considerations

• IoC extractor property chain misinterpretation
• Code-smell rules firing on basic JavaScript patterns
• No malicious network activity detected

Reviewed 2026-05-09; recommended action: suppress false positive; model confidence 85%.