Zowe Explorer

AI Security Review

Evidence context: threat category none; evidence quality strong.

The Zowe Explorer extension bundles a set of Java archive files under zowe-explorer/lib/ – for example converter-scalars-2.11.0.jar, annotations-13.0.jar, zowe-explorer-2.4.0-251.jar, jheaps-0.14.jar, and several others. All findings are of type metadata (e.g., HASH-647d7e81ac61eedf for converter-scalars-2.11.0.jar). No code‑smell, IoC, network, or secret‑access detections were reported, and the summary lists zero entries for those categories. Since the extension’s purpose is to provide a Zowe mainframe interface inside JetBrains IDEs, reading its own bundled JAR files is required to load the language server and UI components. There are no findings that show the extension reading user workspace files, spawning external processes, or contacting remote servers.

Credential‑access assessment – The evidence contains no secret‑related findings. No .env, .ssh, or cloud‑credential files are referenced, and no secret‑type detection (e.g., AWS keys, passwords) was triggered. Therefore the extension does not appear to target real secrets.

Strongest counterargument – One could argue that the lack of detailed static analysis of the JAR contents leaves a blind spot; malicious payloads could be hidden inside the packaged libraries. However, the scanning tool would have flagged any known malware signatures, suspicious network calls, or obfuscation patterns, none of which appear. Moreover, the extension is published for JetBrains by the official “Zowe Binary Project a Series of LF Projects, LLC” and is used by over twelve thousand developers, which further reduces the likelihood of a supply‑chain attack.

Overall, the only observations are benign hash metadata for internal libraries, fully consistent with a legitimate development tool.

Key Reasons

• Only metadata (hash) findings for internal JAR files
• Zero detections in IoC, malware, network, or secret categories
• File reads are limited to the extension's own lib directory
• No process‑execution or external‑communication patterns

False Positive Considerations

• metadata-only findings
• no IoC or network indicators
• no code‑smell detections
• absence of secret‑type findings

Reviewed 2026-05-23; recommended action: no action; model confidence 92%.