MapQuest Directions

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension presents a themed new tab page with MapQuest branding. The security findings initially appear concerning but are explainable as documented false positive patterns.

The seven malware-signature findings (YARA--postinstall_crypto_operations, YARA--credential_env_files, YARA--NoUseWeakRandom, YARA--SQLInjection, YARA--postinstall_obfuscation) are all code-smell rules that match basic Node.js patterns. These rules are documented as noise sources that fire on any non-trivial JavaScript using crypto, fetch, or environment variables. Notably, the findings_summary shows "malware-signature": "0" while listing seven such findings, indicating data inconsistency. Additionally, all malware-signature findings reference "unknown_file" as the file_path, suggesting improper attribution rather than actual malicious code detection.

The five network findings show generic axios and fetch calls in script.js:45 and background.js:8,9,37,38. These are standard HTTP libraries used by virtually all extensions. Critically, no suspicious destination domains are identified—only the fact that network calls exist. Without specific IoCs like query., search., or third-party tracking domains, these findings are benign.

The thirty-four code-smell findings in the summary are expected noise from bundled dependencies and standard JavaScript patterns. The findings_summary explicitly shows "ioc": "0" and "malware": "0", meaning no actual indicators of compromise or malware signatures were detected.

Counterargument: A skeptic would argue the extension could be browser hijacking since it replaces the new tab page, and the developer is an unverified email ([email protected]) rather than MapQuest itself. This is a valid concern—MapQuest is a legitimate company, and this extension uses their branding without clear authorization. However, browser hijacking requires evidence of unwanted behavior (forced search engine changes, redirect tracking, monetized content), which is absent from the findings. The extension description claims it's a "themed" page, which is a legitimate use case. The technical evidence does not support malicious behavior; it supports a themed extension with unclear publisher authorization.

The high finding count (39 total) is driven by code-smell noise, not actual threats. No malware signatures, no suspicious domains, no obfuscation in actual code files. This is a false positive driven by known CVEQ noise patterns.

Key Reasons

• All malware-signature findings are code-smell rules (postinstall_*, credential_*, NoUseWeakRandom, SQLInjection) documented as false positives
• No actual malware signatures detected (findings_summary shows malware-signature: 0)
• Network findings show only generic axios/fetch calls with no suspicious destination domains
• All malware-signature findings reference unknown_file indicating improper attribution
• Extension behavior (themed new tab) is legitimate use case despite unclear publisher authorization

False Positive Considerations

• postinstall_* YARA rules matching basic Node.js patterns
• credential_env_files rule matching API key references
• Code-quality rules (NoUseWeakRandom, SQLInjection) firing on standard code
• High finding count from bundled dependencies and code-smell noise

Reviewed 2026-05-23; recommended action: monitor; model confidence 82%.