bridgecode

AI Security Review

Evidence context: threat category unknown malware; evidence quality moderate.

The extension bridgecode bundles AI coding agents with voice command capabilities, which explains the inclusion of SoX audio processing libraries in extension/scripts/bin/sox/. The 14 critical obfuscation findings all target DLLs like libsox-3.dll, libvorbis-0.dll, and libflac-8.dll. These are standard SoX dependencies, not obfuscated code. Native binary addons in compiled form trigger this detector rule, but they're legitimate components for the stated voice command feature.

Network findings concentrate in extension/node_modules/@modelcontextprotocol/sdk/, the Model Context Protocol library for AI agent communication. Fetch and websocket calls in webStandardStreamableHttp.js and websocket.js are expected for an extension coordinating multiple AI services. The Hono web framework in node_modules/hono/ and Server-Sent Events library in node_modules/eventsource/ support the same functionality. These 80 network findings reflect bundled dependencies, not suspicious outbound connections.

Two tool-poisoning findings warrant attention. The files extension/bundled/cli/claude/skills/server-management/SKILL.md and extension/bundled/cli/claude/skills/red-team-tactics/SKILL.md contain skill definitions that reference credential access. These are markdown prompt templates for the Claude AI agents, not executable code. The red-team-tactics skill could legitimately teach security testing procedures, while server-management might cover SSH key and API token management for development workflows. Without inspecting the actual prompt content, we can't determine if these instruct agents to manage credentials appropriately or to exfiltrate them.

The network endpoints list includes 3do5vmywmrnaxalvz6wi3zicyftgio6psuvyniis6gco6bp6ekl4cqj4id.onion, a Tor hidden service address. This is unusual for a coding assistant extension. The endpoint 40smp4.simplex.im points to SimpleX, a privacy-focused messaging platform. A development tool connecting to anonymous messaging services raises questions about its communication patterns. The Google OAuth client ID 1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com suggests authentication integration, which could be legitimate.

The extension declares no explicit permissions in its manifest, yet version 2.0.12 has zero users. The developer name bidgecode differs from the extension name bridgecode by one letter. These factors don't constitute evidence of malicious intent, but they're unusual for a production extension.

The strongest counterargument to a benign verdict is the combination of credential-access skill definitions, a .onion endpoint, and zero adoption despite a high version number. However, no malware signatures matched, no actual credential theft code was detected, and the skill files are prompts rather than executable payloads. The obfuscation findings are false positives from legitimate audio libraries. The network findings stem from expected AI service communication patterns.

Manual review of the SKILL.md files and investigation into the .onion and SimpleX endpoints would clarify whether this extension poses a real risk or simply has unusual but legitimate design choices.

Key Reasons

• Skill definition files reference credential access in server-management and red-team-tactics prompts
• Tor hidden service address found in network endpoints
• Zero users despite version 2.0.12
• Developer name bidgecode differs from extension name bridgecode
• SimpleX messaging endpoint unusual for coding extension

False Positive Considerations

• SoX audio library DLLs flagged as obfuscated native binaries
• Model Context Protocol SDK network calls from bundled dependencies
• IoC extractor matches on markdown filenames parsed as domains
• Code-smell findings from bundled npm packages

Reviewed 2026-10-09; recommended action: reanalyze; model confidence 65%.