Swift
From the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 5 days ago
- Version
- v231.9423.4
- Artifact
- SHA256 D28…5FA
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
10 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall file download | 1 | clion-swift/lib/clion-swift.jar | - |
| LOW | postinstall crypto operations | 6 | clion-swift/native/linux/libSKWrapper.soclion-swift/native/linux/libObjCHelper.soclion-swift/native/linux/SKServer +3 more | - |
| LOW | postinstall system command | 8 | clion-swift/native/linux/libObjCHelper.soclion-swift/native/linux/libSKClient.soclion-swift/native/win/SKClient.dll +5 more | - |
| LOW | postinstall file manipulation | 5 | clion-swift/native/linux/libSKWrapper.soclion-swift/lib/clion-swift.jarclion-swift/native/linux/SKServer +2 more | - |
| LOW | postinstall network communication | 7 | clion-swift/native/win/SKClient.dllclion-swift/native/linux/libSKWrapper.soclion-swift/lib/clion-swift.jar +4 more | - |
| LOW | postinstall registry modification | 5 | clion-swift/native/linux/libSKWrapper.soclion-swift/lib/clion-swift.jarclion-swift/native/linux/SKServer +2 more | - |
| LOW | postinstall obfuscation | 5 | clion-swift/native/linux/libSKWrapper.soclion-swift/lib/clion-swift.jarclion-swift/native/linux/SKServer +2 more | - |
| LOW | DebuggerStatementsShouldNotBeUsed | 7 | clion-swift/lib/clion-swift.jarclion-swift/native/mac/libSKWrapper.dylibclion-swift/native/linux/libSKWrapper.so +4 more | - |
| LOW | credential env files | 1 | clion-swift/lib/clion-swift.jar | - |
| LOW | postinstall persistence mechanism | 1 | clion-swift/lib/clion-swift.jar | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Network indicators are queued for lazy loading
Scroll this section into view to load the detailed rows.
Publisher Evidence
HighJetBrains
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
12 evidence rows available.
Finding Categories
YARA Rules Matched
10 rules(46 hits)AI Security Report
AI Security Review
Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-05-23. The review verdict is benign but powerful with 92% confidence.
Recommended action: no action. Evidence context: threat category none; evidence quality strong.
The Swift plugin for CLion ships a set of native binaries (e.g., clion‑swift/native/linux/libObjCHelper.so, clion‑swift/native/win/ObjCHelper.dll, clion‑swift/native/mac/libSKWrapper.dylib) and a Java archive (clion‑swift/lib/clion‑swift.jar). All findings are of type metadata and simply report hash values for these files; there are no code‑smell, IoC, network, or secret‑access detections.
Filesystem / process access – The native libraries are required to interface with Swift toolchains and to run language‑server processes, which is exactly the purpose of a CLion language support plugin. No findings indicate that the extension spawns arbitrary shell commands or writes to the workspace beyond what a language server needs.
Credential access – The evidence contains no secret‑related findings; no .env, .ssh, or cloud‑credential files are read. The only files listed are library binaries and the plugin JAR, which do not contain logic for credential harvesting.
Strongest counterargument – One could argue that native binaries might embed hidden functionality that static analysis missed. However, the CVEQ scan reports only hash metadata for those binaries and flags zero IoCs, malware signatures, or network calls, indicating no observable malicious payloads. Without concrete evidence of unwanted behavior, the extension’s capabilities are consistent with a legitimate development tool.
Overall, the plugin’s behavior aligns with its stated purpose of providing Swift language support in CLion, and no malicious patterns were detected.
Key Reasons
- Only metadata hash findings for native binaries and JAR
- No IoC, network, or secret‑access detections
- Capabilities match language‑server requirements
False Positive Considerations
- metadata‑only findings
- absence of code‑smell detections
- no network or IoC entries
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Python Community Edition
JetBrains
Web Browser (JCEF)
JetBrains
OpenTelemetry
JetBrains
YourKit Profiler for IDE Performance Testing
JetBrains
Unity Support
JetBrains
Kotlin Onboarding: Collections
JetBrains