Gearch

AI Security Review

Evidence context: threat category none; evidence quality strong.

The CVEQ findings for "Gearch" (UUID: 333c0b20-e52a-5dc5-8b8d-7df5cfa9da0d) are driven entirely by documented false positive patterns in the XIOC extractor. All 610 IoC findings are JavaScript property access chains misidentified as domain names. For example, XIOC-DOMAIN-array.prototype.filter.call is a standard JavaScript method invocation pattern, not a network domain. Similarly, XIOC-DOMAIN-event.prototype.stopimmediatepropagation.call, XIOC-DOMAIN-this.host, XIOC-DOMAIN-b.host, and XIOC-DOMAIN-zb.call are all property access chains that the XIOC extractor incorrectly parses as domains.

The findings summary shows zero malware signatures, zero malware findings, zero obfuscation findings, and zero network findings. The 33 code-smell findings match basic JavaScript constructs and are classified as low-severity patterns that fire on almost any non-trivial JavaScript code. No actual external domains appear anywhere in the IoC list. There are no custom search engine domains (query., search., hp.*), no history API manipulation findings, no credential extraction patterns, and no session cookie manipulation indicators.

The extension's developer is listed as [email protected], an email address rather than a verified company name. While this represents anonymous publishing, it is common for small extensions and is not inherently suspicious without corroborating malicious behavior.

A skeptic might argue that 610 IoC findings represents significant risk. However, finding count is explicitly not evidence of threat—the nature of findings matters. Every single IoC finding in this bundle is a documented false positive pattern (property access chains like b.call, h.next, g.id). The XIOC extractor is known to produce massive false-positive volumes from minified JavaScript, and this extension's findings match that exact pattern. Without a single actual domain, malware signature, or behavioral indicator of harm, the high finding count is meaningless. The extension has 51 users and zero malware signatures, which is consistent with a benign tool that triggered analyzer noise.

Key Reasons

• All 610 IoC findings are JavaScript property access chains, not actual domains
• Zero malware signatures detected
• Zero obfuscation findings
• Zero network findings to external domains
• XIOC false positive patterns explicitly documented in threat model

False Positive Considerations

• XIOC-DOMAIN property access chain misidentification
• Minified JavaScript parsing artifacts
• Code-smell rules on basic JS constructs
• No actual external domains in findings

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 85%.