SaaS Stack Detector

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension is a technology stack detection tool that identifies SaaS platforms and frameworks used by websites. The evidence strongly indicates the findings are false positives driven by the extension's legitimate functionality.

The 13,541 IoC findings consist entirely of legitimate business domains that the extension uses for technology detection. Sample domains include sharepoint.microsoft.com (Microsoft service), www.intercom.com (SaaS platform), www.syncfusion.com (SaaS platform), gerrit.googlesource.com (Google code review), and various company websites like www.localfocus.nl and www.eidosmedia.com. These are not suspicious C2 domains or tracking endpoints—they are the exact types of domains a SaaS detection tool would legitimately reference in its detection database. The extension's stated purpose ("detect the SaaS tools, frameworks, and libraries any website uses") directly explains why these domains appear in the code.

The three network findings are benign and expected: content.js:330 contains a fetch call for the detection functionality, and telemetry.js:60 contains a fetch call for analytics/usage data. Both are standard patterns for browser extensions with this functionality. There are zero malware signatures, zero obfuscation findings, and the 30 code-smell findings are classified as low severity—per CVEQ documentation, these are noise that should not drive verdicts.

The strongest counterargument is the anonymous developer ([email protected]) and extremely low user count (6 users). A skeptic could argue this is a new extension that hasn't been vetted. However, anonymous developers are common for legitimate developer tools, and the low user count is consistent with a new, niche extension. Critically, the nature of the findings—not the developer identity—should determine the verdict. The findings show no evidence of malicious behavior: no credential theft patterns, no browser hijacking, no proxyware, no malware signatures, and no obfuscation. The extension does exactly what its description claims.

The XIOC extractor is known to produce massive false-positive volumes when extensions contain domain lists for legitimate purposes. This is a documented noise source per CVEQ guidelines. The verdict is based on the absence of any high-confidence threat indicators, not the absence of findings.

Key Reasons

• All 13,541 IoC findings are legitimate business/SaaS domains consistent with extension's stated detection purpose
• Zero malware signatures detected
• Zero obfuscation findings
• Network calls in content.js and telemetry.js are expected for this functionality
• No high-confidence threat indicators (no credential theft, hijacking, or proxyware patterns)

False Positive Considerations

• XIOC extractor flagging legitimate SaaS detection database domains
• Code-smell findings (low severity, documented noise source)
• High IoC count from legitimate domain list, not malicious C2

Reviewed 2026-04-29; recommended action: suppress false positive; model confidence 85%.