Big Data Tools Core

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Big Data Tools Core is JetBrains' first-party plugin that connects JetBrains IDEs to databases, Spark clusters and cloud object stores. Its declared surface is empty here: no permission requests, no network endpoints, no manifest analysis findings. For a plugin whose whole job is opening connections the user configures, that profile matches the design. Network destinations live in per-user connection profiles, not in hardcoded hosts, and no activation-time shell execution appears anywhere in the evidence.

The one high-severity item is a YARA match, YARA--PlugX, at bigdatatools-core/lib/intellij.libraries.azure.storage.jar:32607. That path is a bundled IntelliJ platform library jar wrapping the Azure Storage SDK, the kind of dependency any plugin that talks to blob storage has to ship. PlugX is a genuine remote access trojan family, so a real match would mean a backdoor compiled into an artifact JetBrains distributes to roughly 4.3 million installs. The offset lands inside one entry of a compressed Java archive, which is where generic YARA strings do their worst work: PlugX detection rules lean on short byte sequences and API-name fragments that survive in ordinary bytecode, class metadata and archive padding. A genuine PlugX implant would also leave a loader stage, an execution path, or at minimum a network destination. None of those appear.

Credential access gets the same clean reading. No finding references .env, .ssh, .git/config, cloud credential files or IDE secret storage. The 110 low-severity entries are code-smell rules firing across bundled library code, the standard result of scanning a plugin that vendors the IntelliJ platform, and they carry no behavioural claim.

The strongest counterargument is that PlugX inside a JetBrains-signed jar would be a supply chain disaster, and dismissing a named malware family because the host is trusted is exactly how such a compromise would survive review. That argument would carry weight if anything else lined up. It does not: obfuscation findings sit at zero, endpoint extraction produced nothing, and the match has no companion payload. A trojan needs a way to run. Nothing in intellij.libraries.azure.storage.jar or anywhere else in the plugin shows one. The more economical reading is a broad rule hitting library bytecode, and the fix belongs in the rule's string set.

Key Reasons

• Single high-severity hit is YARA--PlugX inside a bundled Azure Storage SDK jar at bigdatatools-core/lib/intellij.libraries.azure.storage.jar:32607, with no companion payload or execution path.
• No network endpoints, no permission requests and no manifest-analysis findings were recorded for the plugin.
• No credential-access findings reference .env, .ssh, .git/config, cloud credential files or IDE secret storage.
• The remaining 110 entries are low-severity code-smell rules firing on bundled library code, which carry no behavioural claim.
• Publisher is JetBrains with roughly 4.3 million installs, and the finding sits in a vendored platform dependency rather than plugin-authored code.

False Positive Considerations

• YARA--PlugX rule matching generic bytecode and archive strings inside a bundled Azure Storage SDK jar
• Code-smell rules firing across 110 vendored library files with no behavioural significance
• Match resolved to a single offset within compressed Java archive data rather than an executable stage
• No corroborating network endpoint, credential access or postinstall execution to support the malware signature

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 87%.