VS Code Marketplace Verified

Kombai - Your AI design engineer

by Kombai · 56.4K users · 5.0 rating
4965c75e-493d-5dad-b0de-a11601e11006 | v2.0.116
100/ 100
CRITICAL risk
Risk verdict
Do not install

Score-based assessment (critical risk, 100/100). No analyst review available.

Analysis record

Analysed
2 days ago
Version
v2.0.116
Artifact
SHA256 16B…94C
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

1000 detail rows
Showing 25 of 75 · highest severity first

YARA Rule Matches

23 rules
SeverityRuleHitsFilesMetadata
HIGHsupply chain sourcemap appended iife 1
kombai-vendor-runtime.js
-
LOWLocalStorageShouldNotBeUsed 7
browser-server/index.cjsbrowser-server/681.worker.cjsbundle.js +4 more
-
LOWUsingCommandLineArguments 19
browser-server/655.worker.cjsvendor/claude-agent-sdk/browser-sdk.jsbrowser-server/node-gyp-build/bin.js +16 more
-
LOWDebuggerStatementsShouldNotBeUsed 33
ui/5065.62f95393.jsui/7359.8f63570f.jschat-worker/worker.cjs +30 more
-
LOWcredential aws profile 2
vendor/claude-agent-sdk/bridge.mjsvendor/claude-agent-sdk/sdk.mjs
-
LOWServerHostnameNotVerified 2
bundle.jsbrowser-extension/iframe-ui/assets/index-C1bkGQHn.js
-
LOWpostinstall file download 214
browser-server/680.worker.cjsui/7024.9674db52.jsui/327.c9b9c5f0.js +211 more
-
LOWHavingAPermissiveCrossOriginResourceSharingPolicy 9
browser-server/worker.cjsbrowser-server/681.worker.cjsdesign-mode-server/test-server.cjs +6 more
-
LOWNoUseWeakRandom 36
vendor/claude-agent-sdk/browser-sdk.jsbrowser-extension/iframe-ui/assets/index-C1bkGQHn.jsui/7659.736d2e96.js +33 more
-
LOWNoUseEval 7
browser-server/655.worker.cjsbrowser-server/681.worker.cjsmcp-gateway.cjs +4 more
-
LOWSQLInjection 8
mcp-server/worker.cjsui/2813.1f8bab09.jsbrowser-server/index.cjs +5 more
-
LOWcredential gcp credentials 2
vendor/claude-agent-sdk/sdk.mjsvendor/claude-agent-sdk/bridge.mjs
-
LOWcredential git credentials 2
bundle.jsui/5393.9183a458.js
-
LOWpostinstall persistence mechanism 71
design-mode-server/dev.cjsui/2593.d0701aa4.jsui/1318.ce928e94.js +68 more
-
LOWcredential env files 53
ui/8278.70812207.jsruntime.jsvendor/claude-agent-sdk/sdk.mjs +50 more
-
LOWRedirectToUnknownPath 11
mcp-server/worker.cjsbrowser-server/index.cjsdesign-mode-server/plugins/screenshot.cjs +8 more
-
LOWpostinstall crypto operations 37
ui/1222.4f82d192.jsvendor/claude-agent-sdk/browser-sdk.jsui/2378.ff89ddcc.js +34 more
-
LOWpostinstall file manipulation 293
ui/8340.b4d7400a.jsui/5677.b5ac24ba.jsui/9950.15d97c81.js +290 more
-
LOWpostinstall registry modification 49
bundle.jsvendor/@jsquash/png/codec/pkg/squoosh_png_bg.wasmmcp-gateway.cjs +46 more
-
LOWpostinstall obfuscation 59
ui/2408.b8e8849f.jsbrowser-server/212.worker.cjsui/4679.2b0080d1.js +56 more
-
LOWJavaDropper 1
browser-server/655.worker.cjs
-
LOWNoUseSocketManually 3
browser-server/index.cjssocket-worker/worker.cjsbrowser-server/worker.cjs
-
LOWpostinstall environment access 6
vendor/@jsquash/resize/index.d.tsvendor/claude-agent-sdk/sdk.d.tsmcp-server/vendor/@jsquash/resize/index.d.ts +3 more
-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

4,705 total
...

Network indicators are queued for lazy loading

Scroll this section into view to load the detailed rows.

Publisher Evidence

Low

Kombai

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

73
Noisy-finding weight
x1.00
Publisher domain
kombai.com
Observed
Store verification signal
Verified publisher
Verified
Extension portfolio
1
Portfolio

13 evidence rows available.

Finding Categories

1
Malware Signatures
48
Obfuscation
25
Network
4,705
IoC Indicators

YARA Rules Matched

23 rules(925 hits)
supply chain sourcemap appended iife LocalStorageShouldNotBeUsed UsingCommandLineArguments DebuggerStatementsShouldNotBeUsed credential aws profile ServerHostnameNotVerified postinstall file download HavingAPermissiveCrossOriginResourceSharingPolicy NoUseWeakRandom NoUseEval SQLInjection credential gcp credentials credential git credentials postinstall persistence mechanism credential env files RedirectToUnknownPath +7 more

Package Analysis

VS Code extensions use package.json for configuration. Unlike browser extensions, they run within the editor's extension host and access the workspace through the VS Code API.

MANIFEST-SENSITIVE-PERM-TABS manifest.json

Security Analysis Summary

Security Analysis Overview

Kombai - Your AI design engineer is a Visual Studio Code Marketplace extension published by Kombai. Version 2.0.116 has been analyzed by the Risky Plugins security platform, receiving a risk score of 100/100 (CRITICAL risk) based on 6483 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

  • Critical: 12 finding(s)
  • High: 24 finding(s)
  • Medium: 4744 finding(s)
  • Low: 1703 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

Kombai - Your AI design engineer is published by Kombai on the Visual Studio Code Marketplace marketplace. The extension has approximately 56K users.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

About This Extension

Ship standout websites and product frontends. Bring design craft and production code together. Works with VS Code, Cursor, Devin Desktop, Claude Code, Codex etc.

Frequently Asked Questions