The AI review rates the findings as likely false positive, but the risk score (65/100) still counts them.
Analysis record
- Analysed
- 1 weeks ago
- Version
- v1.3.4
- Artifact
- SHA256 08C…AC0
- Source
- Findings (non-IoC)
Is LogRAM safe?
LogRAM adds a two-pane log viewer to Notepad++: you open a large .log file and search it in memory instead of loading the whole thing into the editor. It ships Microsoft's .NET 8 runtime alongside its own code so it runs on a plain Notepad++ install. Notepad++ has no permission prompt, so once installed the plugin can read the files you open and write the results you export. Nothing in the scan shows it going further than that.
The scary-looking items are Microsoft's own files. A rule called OBFUSCATION-supply_chain_binary fires on System.Private.CoreLib.dll, System.Net.WebClient.dll and System.Private.Xml.Linq.dll, which are the runtime libraries bundled with the plugin. Hundreds of library files come along with any .NET app and each one gets flagged. The listed network endpoints are the same kind of noise: 0system.drawing.graphics is the .NET type name System.Drawing.Graphics with a stray byte in front, and 6e.gs or 9f.ms are short substrings pulled out of compiled binaries, not addresses the plugin contacts. No malware signature matched anything in the package, and no finding points at .env files, SSH keys or saved credentials.
What the scanner tripped on is the size and shape of a self-contained .NET bundle: hundreds of signed Microsoft DLLs, each scanned as if it were the plugin. That is a claim about the scanner's rules. The one thing worth knowing is that a plugin shipped with its own runtime carries more code than a bare DLL, and signing off on that part means looking at LogRAM's own assembly rather than at the framework around it.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
12 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall registry modification | 3 | LogRAM.Core.pdbLogRAM.Npp.Viewer.deps.jsonLogRAM.Npp.Viewer.pdb | - |
| LOW | postinstall crypto operations | 4 | LogRAM.Npp.Viewer.deps.jsonLogRAM.Npp.Viewer.pdbLogRAM.Core.pdb +1 more | - |
| LOW | postinstall system command | 9 | licenses/GCC-RUNTIME-LIBRARY-EXCEPTION.txtLogRAM.Npp.Viewer.pdbLogRAM.Npp.Viewer.deps.json +6 more | - |
| LOW | postinstall file manipulation | 3 | licenses/GPL-3.0.txtLogRAM.Npp.Viewer.pdblicenses/dotnet-THIRD-PARTY-NOTICES.txt | - |
| LOW | postinstall network communication | 9 | licenses/dotnet-LICENSE.txtLogRAM.Npp.Viewer.deps.jsonVALIDATION.md +6 more | - |
| LOW | CAP HookExKeylogger | 2 | WindowsBase.dllSystem.Windows.Forms.Primitives.dll | - |
| LOW | postinstall obfuscation | 1 | licenses/dotnet-THIRD-PARTY-NOTICES.txt | - |
| LOW | GenerateTLSClientHelloPacket Test | 2 | wpfgfx_cor3.dllPresentationNative_cor3.dll | - |
| LOW | postinstall persistence mechanism | 1 | LogRAM.Npp.Viewer.deps.json | - |
| LOW | DebuggerStatementsShouldNotBeUsed | 8 | System.Windows.Forms.dllit/System.Windows.Forms.resources.dllit/WindowsBase.resources.dll +5 more | - |
| LOW | postinstall file download | 3 | LogRAM.Npp.Viewer.pdbLogRAM.Npp.Viewer.deps.jsonLogRAM.Core.pdb | - |
| LOW | NoUseWeakRandom | 1 | System.IO.Compression.Native.dll | - |
Finding Categories
YARA Rules Matched
12 rules(46 hits)AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
LogRAM is a Notepad++ plugin that opens a large .log file in a two-pane view and searches it in memory. It ships the .NET 8 runtime inside the package, which is why almost every finding here lands on a Microsoft framework assembly rather than on LogRAM's own code.
Filesystem and process access. Notepad++ plugins are native DLLs loaded into the editor process, so a plugin that reads log files, runs a search engine and writes exported results already has wide reach on the machine. The findings show nothing beyond that job. There is no installer script, no download-and-execute sequence, and no activation-time fetch. The files touched by the findings are the runtime the description says is bundled, not workspace paths: System.Private.CoreLib.dll, System.Private.Xml.Linq.dll, System.ObjectModel.dll, System.Printing.dll. For a read-only log viewer that exports results, that footprint is expected.
Credential access. Nothing in the scan targets real secrets. There are no matches on .env files, .git/config, SSH keys or cloud credential paths, and the secret category is empty. The networking-related names that do show up, System.Net.WebClient.dll, System.Net.Security.dll, System.Net.Sockets.dll, System.Net.WebProxy.dll, are framework libraries that any .NET application carries whether or not it opens a socket. Their presence is not evidence that LogRAM makes outbound calls.
The obfuscation findings. All 461 obfuscation hits use the same title, OBFUSCATION-supply_chain_binary, and every one names a Microsoft runtime DLL. A supply-chain binary rule firing on System.Private.CoreLib.dll is reading packed PE metadata in a shipped framework, not detecting something LogRAM did. These files are signed build output from Redmond.
The network endpoints. The endpoint list is fragment noise. 0system.drawing.graphics and 6system.net.security are .NET type names with a stray leading byte. 2f.md, 6e.gs, 9f.ms and 7e.ss are two-character hex and printable substrings lifted out of compiled binaries. None of them is a host the plugin resolves.
The strongest counterargument is that bundling a full .NET runtime is real supply-chain surface: LogRAM's own assembly sits among hundreds of Microsoft DLLs, and this scan does not isolate a clean result for it. Notepad++ has no permission model, so nothing is scoped either. That argues for looking at the plugin binary directly, and it does not change the conclusion, because across 2,058 findings not one malware signature matched, no secret was read and no behavior departed from opening and searching a log file.
Key Reasons
- Every obfuscation finding is titled OBFUSCATION-supply_chain_binary and names a Microsoft .NET runtime assembly such as System.Private.CoreLib.dll or System.Net.Security.dll, matching the description's statement that the .NET 8 runtime is bundled
- Zero malware signatures and zero secret findings across the package; no .env, .ssh, .git/config or credential-store access appears anywhere
- The listed endpoints are extractor artifacts: 0system.drawing.graphics is a mangled System.Drawing.Graphics type name, and 6e.gs, 9f.ms, 7e.ss are short substrings rather than resolvable hosts
- A Notepad++ plugin that reads logs, runs an in-memory search engine and exports results is doing exactly what its description promises
False Positive Considerations
- Self-contained .NET publishing bundles hundreds of signed Microsoft framework DLLs, each scanned as a separate binary and each tripping the binary supply-chain obfuscation rule
- IoC extractor reading hex and printable substrings out of compiled .NET binaries as if they were domain names
- No Notepad++ permission model, so host_permissions and permissions are empty and cannot scope the plugin
Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 83%.
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace