Hyperbook

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Hyperbook Studio renders Markdown projects with the Hyperbook renderer inside the editor, and it is published on OpenVSX with roughly 94,000 users. Everything flagged here sits in the renderer's own web asset tree.

Filesystem and process access is justified by the job. The extension declares no permissions and no host permissions, and nothing in this set shows a spawned process or an install-time hook. There is no postinstall execution finding at all. Reading Markdown from the open workspace is the product, and the only file activity reported is the extension loading its own packaged assets.

The network side is nine NET-FETCH hits, each inside a separate Hyperbook directive bundle: extension/assets/hyperbook/directive-archive/client.js, extension/assets/hyperbook/directive-audio/wavesurfer.min.js, extension/assets/hyperbook/directive-download/client.js, extension/assets/hyperbook/directive-h5p/main.bundle.js, extension/assets/hyperbook/directive-openscad/worker.js, extension/assets/hyperbook/directive-pyide/python-friendly-error-messages.js, extension/assets/hyperbook/directive-struktolab/struktolab-renderer.umd.js, extension/assets/hyperbook/directive-typst/client.js, and extension/assets/hyperbook/cloud.js. These are client-side bundles: wavesurfer loads audio, the openscad worker loads a module for the 3D viewer, the h5p bundle loads interactive course content. The extension reports no endpoints of its own. A renderer that supports embedded audio, Python playgrounds and 3D models has to fetch those resources.

The four obfuscation hits are all build output or third-party libraries. extension/out/extension.js is TypeScript compile output, and the Unicode-heavy rule fires on its string tables. extension/assets/hyperbook/directive-bitflow/mathlive.min-CJgy9wA_-zbEajnyR.js is the MathLive typesetting library, which carries dense Unicode math ranges by design. extension/assets/hyperbook/directive-bitflow/compute-engine.min.esm-B8GYsYEC-Bk85Berc.js is a bundled compute engine with an inlined base64 block, which is how a WASM blob ships inside a minified module. The DYNAMIC_EVAL hit on extension/assets/hyperbook/directive-jsxgraph/jsxgraphcore.js comes from JSXGraph's expression parser, a well-known plotting library.

Nothing here targets credentials. No finding references .env files, .ssh keys, .git/config, cloud credential paths, or editor secret storage, and the rules that normally fire on API key strings are absent entirely.

The strongest counterargument is that a renderer which fetches remote assets could pull a malicious script at render time, and the scan cannot see where those fetches point. That is a real property of the design, but the fetch pattern repeats once per directive, matching each directive's own resource, and none of the nine tie back to an installer, an updater, or a credential read. With no postinstall hook, no process spawn, and no secret access, the shape here is packaged library code.

Key Reasons

• All nine network findings are NET-FETCH hits inside per-directive Hyperbook client bundles (wavesurfer.min.js, openscad worker.js, h5p main.bundle.js), matching each feature's own resource rather than a hidden endpoint.
• No permissions, host permissions or network endpoints are declared, and no postinstall, process-spawn or installer finding appears anywhere in the set.
• Obfuscation hits land on TypeScript compile output in extension/out/extension.js and on bundled third-party libraries (mathlive.min, compute-engine.min.esm, jsxgraphcore.js) that use Unicode math ranges, inlined WASM base64 and expression parsing by design.
• Zero credential, secret, IoC and malware-signature findings; no reference to .env, .ssh, .git/config or editor secret storage.
• Publisher openpatch ships the Hyperbook renderer itself, and the flagged paths are that renderer's packaged asset tree, consistent with a 94,000-user documentation tool.

False Positive Considerations

• Minified third-party libraries bundled under extension/assets/hyperbook (mathlive, compute-engine, wavesurfer, jsxgraph) matching obfuscation rules
• TypeScript compiler output in extension/out/extension.js flagged as Unicode-heavy
• Each Hyperbook directive shipping its own client bundle that performs one fetch for the resource it renders, producing nine separate NET-FETCH hits
• Inlined base64 WASM payload inside a minified compute-engine module tripping LARGE_BASE64

Reviewed 2026-10-13; recommended action: suppress false positive; model confidence 85%.