cocos-binding
Score-based assessment (critical risk, 93/100). No analyst review available.
Analysis record
- Analysed
- 2 days ago
- Version
- v0.0.5
- Artifact
- SHA256 EE5…00A
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
11 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | PE File pyinstaller Detect PE file produced by pyinstaller | 1 | static/generator-bin.exe | Didier Stevens (https://DidierStevens.com) FP 10% |
| LOW | postinstall file download | 5 | out/test/runTest.jsout/extension.jsstatic/targets/spidermonkey/conversions.yaml +2 more | - |
| LOW | postinstall crypto operations | 5 | build/generator-bin.exe.specstatic/pyinstxtractor.pystatic/clang/cindex.py +2 more | - |
| LOW | postinstall file manipulation | 9 | static/generator.pystatic/pyinstxtractor.pystatic/targets/lua/templates/register.c +6 more | - |
| LOW | postinstall system command | 13 | static/genbindings.pyout/extension.jsstatic/clang/cindex.py +10 more | - |
| LOW | postinstall obfuscation | 4 | static/targets/spidermonkey/templates/register.cstatic/clang/cindex.pystatic/backup/clang-llvm-3.3-pybinding/cindex.py +1 more | - |
| LOW | postinstall network communication | 2 | static/clang/cindex.pystatic/backup/clang-llvm-3.3-pybinding/cindex.py | - |
| LOW | DebuggerStatementsShouldNotBeUsed | 3 | static/libclang/libclang.dllstatic/tools/win32/cygwin1.dllstatic/libclang/libclang.dylib | - |
| LOW | spyeye | 1 | static/tools/win32/cygwin1.dll | - |
| LOW | credential env files | 4 | static/test/test.pyout/genbinding.jsout/extension.js +1 more | - |
| LOW | MachO File pyinstaller | 1 | static/generator-bin.exe | - |
Publisher Evidence
Limited evidencexuyanfeng
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
10 evidence rows available.
Finding Categories
YARA Rules Matched
11 rules(48 hits)AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality absent.
This extension generated no security findings in the automated analysis. The publisher 'xuyanfeng' corresponds to a known developer in the Cocos Creator ecosystem, and the package name 'cocos-binding' is consistent with legitimate tooling for the Cocos game engine. Extensions of this nature typically require workspace access to parse configuration files (like project.json) and manage build bindings, which is standard behavior for IDE language support plugins. Given the absence of telemetry exfiltration signatures, credential theft patterns, or suspicious process execution, this appears to be a standard utility extension. The low user count (130) suggests it is a niche tool for a specific developer audience rather than a broad consumer attack.
Key Reasons
- Zero findings generated during analysis
- Publisher identity matches known ecosystem contributors
- Naming convention consistent with official/non-malicious tooling
False Positive Considerations
- N/A - No findings were generated to evaluate
Reviewed 2026-04-19; recommended action: no action; model confidence 95%.
Source Code Not Available
Source code is not available for this version of the extension.
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace