Dark Factory

AI Security Review

Evidence context: threat category unknown malware; evidence quality moderate.

The filesystem and process access for this extension cannot be evaluated as justified because the extension has no documented description. The evidence bundle shows an empty description field, preventing assessment of whether any capabilities align with stated functionality.

No credential-access findings target actual secrets. The findings summary shows zero findings in the "secret" category, and no code-smell rules fired for credential patterns. This absence of credential theft indicators is notable but does not offset the domain concerns.

The strongest counterargument to this verdict is the complete absence of malware signatures, code-smell findings, and active network behavior detections. The findings summary shows 0 malware-signature, 0 code-smell, and 0 network findings. A malicious extension typically exhibits at least some behavioral indicators beyond static IoC matches. Additionally, the extension has 733 users on JetBrains, suggesting some level of community adoption without reported issues.

However, the 126 IoC findings reveal a pattern of suspicious domain infrastructure that cannot be dismissed as false positives. The XIOC-DOMAIN findings include domains with unusual characteristics: "XIOC-DOMAIN-n.pm", "XIOC-DOMAIN-gmn.bi", "XIOC-DOMAIN-35.fk", "XIOC-DOMAIN-mؼ.ws", and "XIOC-DOMAIN-8oĸ.np". These domains exhibit hallmarks of malicious infrastructure including short random subdomains, uncommon TLDs (.pm, .bi, .fk, .sa, .br, .ws, .ag, .pa, .np, .vg, .cx, .jo), and non-ASCII characters (mؼ.ws contains Arabic character, 8oĸ.np contains unusual character). These are not generic CDN or infrastructure domains like googleapis.com or npmjs.org that would constitute IoC extractor garbage.

The developer name "古时的风筝" is in Chinese characters, and the extension name "Dark Factory" provides no indication of legitimate development functionality. The combination of 126 medium-severity IoC findings for suspicious domain infrastructure with zero legitimate purpose documentation creates a confirmed_risk profile. The extension warrants monitoring and potential takedown investigation, particularly given the JetBrains marketplace context where extensions should have clear documented purposes.

Key Reasons

• 126 IoC findings for suspicious domain infrastructure
• Domains exhibit malicious infrastructure patterns (unusual TLDs, non-ASCII characters)
• No documented extension purpose
• Developer name in non-Latin script
• Zero malware signatures or behavioral findings

False Positive Considerations

• No malware signatures detected
• No code-smell findings
• No credential access findings
• No obfuscation findings

Reviewed 2026-05-06; recommended action: monitor; model confidence 75%.