Assistencia Dev Tracker — Technical Support Metrics

AI Security Review

Evidence context: threat category none; evidence quality moderate.

ciro-maciel-assistencia-dev-tracker (version 0.0.5, OpenVSX, about 1,130 installs) is described as a session tracker for VS Code: it records support, mentoring, debugging and incident sessions and turns them into exportable metrics. The scan of the package produced no findings in any category, which shapes everything below.

Filesystem and process access. Nothing in the package triggered a postinstall rule, a shell-execution rule, or a child_process pattern. Those rules match basic Node.js shapes such as fetch, exec, fs and process.env, and they fire on most extensions that ship real JavaScript, so their absence is a signal rather than a gap. A session tracker has to write a log file somewhere in workspace or global storage; there is no evidence of it reaching past that into arbitrary paths. The package declares no permissions and no host permissions, so there is no scope request to weigh against the stated job.

Credentials. No secret-detection finding, no credential-access rule and no reference to .env files, .git/config, SSH keys or VS Code secret storage came back from the scan. Credential rules are broad and fire on almost any code that touches an API key or an environment variable; they stayed silent here. A tool that logs debugging sessions has no reason to read cloud credentials, and nothing recovered from the package shows it doing so.

Network. No network endpoints were extracted: no domain, no IP address, no URL. That matters most for a tool whose stated output is "exportable metrics", because the export could have been an upload. There is no destination in the package for source code or session content to travel to, and no IoC hits pointing at one.

The strongest counterargument. A completely empty result can also mean the scanner never got inside the package. The manifest metadata came back empty, so there are no activation events, engine constraints or bundled dependency list to reason from, and a scan that stopped early would produce the same blank page. What argues against that reading is the shape of the package itself: version 0.0.5, 1,130 installs, a single named publisher on OpenVSX, and a description matching the local logging behaviour a small utility would implement. A supply-chain impostor usually borrows a popular name and ships weight; this one has neither.

Conclusion. Every high-risk pattern we look for (install-time execution, source exfiltration, credential reads, lookalike naming) is absent, and the only real gap is how much of the manifest the scan recovered. On the evidence available, the extension behaves like the small local session logger it says it is.

Key Reasons

• Zero findings in every category, including the postinstall and child_process rules that fire on most JavaScript-shipping extensions
• No declared permissions and no host permissions in the package
• No network endpoints or IoC hits recovered, so no destination for exfiltration
• No credential-access or secret-detection findings touching .env, .git/config, SSH keys or VS Code secret storage
• Package shape (v0.0.5, 1,130 installs, single named OpenVSX publisher) shows no typosquat or impostor pattern

False Positive Considerations

• Empty finding set across all categories leaves no scanner noise to filter
• No obfuscation detections, so no minified bundle false positives to discount
• Empty manifest metadata means the absence of permissions is not independently confirmed
• Small early-stage package on OpenVSX, not a lookalike of a popular extension

Reviewed 2026-10-18; recommended action: no action; model confidence 72%.