Adblock/AdGuard/uBlock filters grammar

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension provides syntax highlighting and grammar support for ad blocking filter rules (AdGuard, uBlock, Adblock formats) within VS Code. The 157 total findings are almost entirely noise from bundled dependencies and code-smell YARA rules.

The filesystem access this extension requires is justified by its stated purpose. A syntax highlighting extension must read workspace files to apply grammar rules and provide IntelliSense features. The metadata findings show standard bundled npm packages in extension/server/out/vendors/ and extension/client/out/vendors/ including js-yaml.js, vscode-languageserver-protocol.js, zod.js, vscode-languageclient.js, tldts.js, semver.js, and vscode-jsonrpc.js. These are legitimate language server infrastructure libraries that enable the extension's core functionality. The adblock.plist file in extension/syntaxes/out/ confirms this is a grammar/syntax definition extension.

Zero credential-access findings were detected. The secret:0 count in the findings summary confirms no code patterns matching .env files, SSH keys, cloud credentials, or VS Code secret storage access. This is expected for a syntax highlighting extension that has no legitimate need to access developer secrets. There are no findings indicating the extension reads .env, .git/config, SSH keys, or credential providers.

The strongest counterargument is the 115 high-severity code-smell findings. However, these are YARA rules designed to detect code-quality patterns like basic Node.js API usage (fetch, exec, fs, crypto, process.env), not actual vulnerabilities. As documented in CVEQ's false-positive patterns, code-smell findings are noise that should never drive a verdict. The severity classification is misleading—these match standard JavaScript patterns in any non-trivial extension. The code-smell:115 count represents legitimate build output and bundled library code, not intentional obfuscation or malicious behavior.

Additional false positive drivers include the 42 metadata findings (file hashes from bundled dependencies), zero actual IoC or malware signatures (ioc:0, malware-signature:0, malware:0), and zero network findings indicating no data exfiltration (network:0). The extension's purpose, developer name (adguard), and finding profile all align with a legitimate language support tool. The 3 dependency findings represent standard npm package analysis, not supply chain compromise.

This extension exhibits no indicators of postinstall payload execution, credential theft, source code exfiltration, or supply chain poisoning. All findings are explainable as expected IDE extension behavior combined with known YARA false-positive patterns.

Key Reasons

• Zero malware, IoC, network, obfuscation, or secret findings detected
• All 115 high-severity findings are code-smell YARA noise from bundled dependencies
• Extension purpose (syntax highlighting) justifies file reading capability
• Developer name 'adguard' aligns with extension functionality
• No evidence of credential access or data exfiltration

False Positive Considerations

• Code-smell YARA rules matching standard JavaScript patterns
• Bundled npm dependencies in vendors/ folder
• Metadata findings from file hashes
• Severity inflation from code-smell classification

Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 88%.