BI_POC

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-30. The review verdict is likely false positive with 75% confidence.

Recommended action: suppress false positive. Evidence context: threat category none; evidence quality moderate.

This extension demonstrates characteristics of a legitimate enterprise tool with findings driven by known false positive patterns rather than malicious behavior.

The developer is identified as "[email protected]", which corresponds to Whatfix, a known digital adoption platform company. The extension description "BI POC extension for Successfactors" indicates a business intelligence proof of concept for SAP SuccessFactors integration, a legitimate enterprise use case.

All 27 network findings connect exclusively to whatfix.com, the developer's own domain. For example, NET-FETCH-whatfix.com/8efcc575-9edf-46e7-9cfc-d808e4f7bdbb/workflowengine/workflowengine.nocache.js-45878 and NET-XMLHTTPREQUEST-extension.background/extension.background.nocache.js-999 show standard extension background and workflow engine communication. No third-party or suspicious domains appear in the network findings.

The 9 obfuscation findings occur in .nocache.js files, which are characteristic of bundled/minified JavaScript from build processes. The OBFUSCATION-LARGE_BASE64-extension.foreground/extension.foreground.nocache.js-701 and OBFUSCATION-FROMCHARCODE_BULK-whatfix.com/8efcc575-9edf-46e7-9cfc-d808e4f7bdbb/workflowengine/workflowengine.nocache.js-41337 findings are consistent with webpack or similar bundler output, not malicious obfuscation.

The 3458 IoC findings represent the XIOC extractor's known false positive volume. Without specific suspicious domains in the evidence (only whatfix.com appears), this count is noise rather than evidence of malicious infrastructure.

The 0 malware signatures and 0 malware findings are the strongest indicators of benign behavior. The 367 code-smell findings are expected noise from YARA rules that fire on almost any non-trivial JavaScript.

Counterargument: A skeptic might argue the 0 user count indicates this is an untested or malicious extension that hasn't gained traction. However, the extension name "BI_POC" explicitly indicates this is a proof of concept, which may be deployed internally or to a limited audience before public release. The identifiable developer and clean network traffic to their own domain outweigh the user count concern. If this were a malicious extension, it would show malware signatures, suspicious third-party domains, or anonymous publication, none of which appear in the evidence.

Key Reasons

• No malware signatures or malware findings in 3861 total findings
• All network traffic goes to developer's own domain (whatfix.com)
• Identifiable developer ([email protected]) from known company
• Obfuscation patterns consistent with bundled/minified code in .nocache.js files
• High IoC count is known XIOC extractor false positive pattern

False Positive Considerations

• XIOC extractor volume (3458 IoCs without suspicious domains)
• Code-smell YARA rules (367 findings on standard JS patterns)
• Obfuscation in bundled .nocache.js files from build process
• Minified/bundled JavaScript triggering false obfuscation matches