Расширение для откликов на вакансии

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension for hh.ru job application automation shows 234 total findings, but the evidence reveals these are entirely driven by known false positive patterns. The 200 IoC findings include entries like f.remove.call, q.call, c.predispatch.call, s.event.handlers.call, u.data, and this.show — all of which are JavaScript property access chains misread as domains by the XIOC extractor, not actual network destinations. This matches the documented false positive pattern where property chains like b.call, h.next, g.id are incorrectly flagged as domains.

The extension has zero malware signatures, zero obfuscation findings, and no suspicious actual domains. The 33 code-smell findings are low-severity matches against basic JavaScript patterns (fetch, crypto, etc.) that fire on almost any non-trivial code and should not drive verdicts per CVEQ guidelines. The single network finding is not detailed in the evidence but given the absence of any other suspicious indicators, it likely represents legitimate API calls to hh.ru services.

The extension's purpose is legitimate: automating job application responses on hh.ru, a major Russian job board. The developer uses a Gmail address ([email protected]) rather than a corporate domain, which is common for individual developers but provides less accountability than verified publishers. The 782 user count indicates some adoption without raising red flags.

Counterargument: A skeptic might argue that 200 IoC findings and an anonymous Gmail publisher warrant caution. However, the IoC evidence is not actual network activity — every single domain listed is syntactically impossible as a real domain (e.g., f.remove.call contains periods in positions that violate DNS naming conventions). The XIOC extractor's garbage output is a well-documented noise source, and relying on these counts would incorrectly flag legitimate extensions. Without malware signatures, obfuscation, or actual suspicious domains, there is no evidence of malicious intent.

Resolution: This case requires suppressing false positive findings from the XIOC extractor. The extension appears to be a legitimate productivity tool with inflated finding counts from automated extraction errors.

Key Reasons

• All 200 IoC findings are property access chain false positives (e.g., f.remove.call, this.show)
• Zero malware signatures detected
• Zero obfuscation findings
• Extension serves legitimate job application automation purpose
• Code-smell findings are low-severity noise patterns

False Positive Considerations

• XIOC property access chain misinterpretation
• Code-smell YARA rules on basic JS patterns
• IoC volume inflation from extraction errors

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 92%.