Openresty
The AI review rates the findings as likely false positive, but the risk score (100/100) still counts them.
Analysis record
- Analysed
- 5 days ago
- Version
- v1.6.4-IDEA241
- Artifact
- SHA256 6E6…336
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
15 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | CAP HookExKeylogger | 1 | Openresty/lib/jna-platform-5.5.0.jar | Brian C. Bell -- @biebsmalwareguy FP 5% |
| LOW | postinstall obfuscation | 17 | Openresty/debugger/emmy/linux/emmy_core.soOpenresty/std/Lua53/debug.luaOpenresty/lib/jna-platform-5.5.0.jar +14 more | - |
| LOW | postinstall network communication | 20 | Openresty/debugger/emmy/linux/luatoolsOpenresty/std/resty/resty.websocket.server.luaOpenresty/lib/forms-1.2.1.jar +17 more | - |
| LOW | postinstall file manipulation | 35 | Openresty/std/Lua53/global.luaOpenresty/debugger/emmy/linux/luatoolsOpenresty/std/Lua54/io.lua +32 more | - |
| LOW | postinstall crypto operations | 10 | Openresty/std/resty/resty.core.hash.luaOpenresty/lib/kotlin-stdlib-common-1.8.21.jarOpenresty/lib/kotlin-stdlib-1.8.21.jar +7 more | - |
| LOW | postinstall system command | 50 | Openresty/std/resty/resty.shell.luaOpenresty/lib/gson-2.8.6.jarOpenresty/std/Lua53/package.lua +47 more | - |
| LOW | JavaDropper | 2 | Openresty/lib/jna-5.5.0.jarOpenresty/lib/instrumented-Openresty-1.6.4-IDEA241.jar | - |
| LOW | postinstall registry modification | 8 | Openresty/std/Lua53/debug.luaOpenresty/debugger/emmy/linux/luatoolsOpenresty/std/Lua54/debug.lua +5 more | - |
| LOW | postinstall file download | 15 | Openresty/debugger/emmy/emmyHelper.luaOpenresty/std/Lua53/global.luaOpenresty/std/resty/tablepool.lua +12 more | - |
| LOW | NoUseEval | 1 | Openresty/std/resty/resty.redis.lua | - |
| LOW | postinstall process injection | 1 | Openresty/lib/jna-platform-5.5.0.jar | - |
| LOW | DebuggerStatementsShouldNotBeUsed | 9 | Openresty/debugger/windows/x64/EasyHook.dllOpenresty/debugger/emmy/mac/x64/emmy_core.dylibOpenresty/debugger/windows/x64/dbghelp.dll +6 more | - |
| LOW | credential env files | 1 | Openresty/debugger/emmy/linux/luatools | - |
| LOW | postinstall persistence mechanism | 4 | Openresty/lib/jna-platform-5.5.0.jarOpenresty/debugger/emmy/linux/emmy_core.soOpenresty/debugger/emmy/linux/luatools +1 more | - |
| LOW | RedirectToUnknownPath | 1 | Openresty/std/resty/ngx.lua | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Network indicators are queued for lazy loading
Scroll this section into view to load the detailed rows.
Publisher Evidence
Limited evidence650efb46-1468-48cd-a3f0-773254150498
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
13 evidence rows available.
Finding Categories
YARA Rules Matched
15 rules(175 hits)AI Security Report
AI Security Review
Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-05-23. The review verdict is likely false positive with 95% confidence.
Recommended action: suppress false positive. Evidence context: threat category none; evidence quality strong.
The OpenResty extension for JetBrains IDEs provides language support for OpenResty (Nginx with embedded Lua). Analysis of the security findings reveals no actual security concerns.
Filesystem and Process Access Justification: The extension bundles standard OpenResty libraries including Lua files (coroutine.lua, resty.core.misc.lua, thread.exdata.lua, builtin.lua, resty.limit.traffic.lua, jit.lua, resty.core.lua, ngx.base64.lua), Kotlin standard library (kotlin-stdlib-jdk7-1.8.21.jar), Emmy debugger components (emmy_core.so, luatools), and searchable options (searchableOptions-1.6.4-IDEA241.jar). These are legitimate bundled dependencies for a language support extension that needs to provide syntax highlighting, code completion, and debugging capabilities for OpenResty development. This access pattern is fully justified by the extension's stated purpose.
Credential Access Findings: The findings summary explicitly shows zero secret-related findings ("secret":"0"). There are no findings indicating access to .env files, SSH keys, cloud credentials, or VS Code secret storage. The metadata findings are simply file hashes of bundled libraries, not credential access patterns.
Security Finding Analysis: All 151 findings are classified as "metadata" with "info" severity - they are file hashes, not security alerts. The threat_indicators field confirms zero findings in every security category: ioc (0), malware-signature (0), malware (0), network (0), obfuscation (0), and tool-poisoning (0). There are no code-smell findings, no suspicious network calls, no obfuscation patterns, and no postinstall payload execution.
Strongest Counterargument: The high finding count (151) might suggest concern to readers unfamiliar with security analysis. However, this is a classic case of finding volume noise. Every single finding is an informational metadata hash of a bundled library file. The findings_summary explicitly shows zero actual security findings across all threat categories. This is expected behavior for a language support extension that bundles runtime libraries - the scanner reports file hashes for tracking purposes, not because these files are malicious.
This extension is a legitimate OpenResty language support tool with no security concerns.
Key Reasons
- Zero actual security findings across all threat categories (ioc:0, malware-signature:0, malware:0, network:0, obfuscation:0)
- All 151 findings are informational metadata hashes of bundled OpenResty libraries
- Bundled files are legitimate language support dependencies (Lua runtime, Kotlin stdlib, Emmy debugger)
- No credential access, secret exposure, or suspicious network activity detected
- Extension serves clear legitimate purpose as OpenResty language support for JetBrains IDEs
False Positive Considerations
- Metadata hash findings mistaken for security alerts
- Bundled dependencies (kotlin-stdlib, emmy debugger, resty libraries) triggering file enumeration
- Finding count inflation from informational metadata entries
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace