Blockify: Ad Blocker for Spotify, YouTube, & more!

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension presents a classic false-positive pattern driven by the CVEQ scoring system's bias toward network activity volume. The analysis reveals 27 total findings, all classified as medium-severity network detections for basic fetch() calls in files like injected/ads_removal.js:49, analytics.js:306, content_script.js:37, and popup.js:281. These are expected behaviors for any modern browser extension that needs to communicate with APIs or load external resources.

Critically, the findings summary shows zero malware signatures, zero obfuscation detections, and zero IoC matches. This is the most important signal: if this were malicious software, the static analysis would have identified actual malware patterns or suspicious domain communications. The file structure itself supports legitimate functionality—ads_removal.js for Spotify ad blocking, twitch_cs.js and opt/yt_autocomment.js for additional platform features, analytics.js for usage tracking, and promo_optin.js for promotional content. These are reasonable components for an ad blocker with cross-platform capabilities.

The extension has 400,000 users, which while not determinative, is consistent with a legitimate, widely-used tool rather than a targeted malware campaign. The developer attribution ([email protected]) is minimal but not deceptive—it's an email address rather than a company name, which is common for smaller extension developers. There is no evidence of typosquatting or impersonation; the extension name "Spotify Ad Blocker - Blockify" is descriptive rather than mimicking a specific brand like "Spotify Premium Unlocker" or "Spotify Web Helper."

The strongest counterargument would be that 26 network findings is a high volume and could indicate data exfiltration or command-and-control communication. However, this argument collapses when examining the actual finding details: every single network finding is simply detecting that fetch() exists in the code, with no suspicious domains extracted. The findings summary explicitly shows "ioc":"0"—meaning the IoC extractor found zero actual domain names, IP addresses, or other network indicators to flag. Without specific suspicious domains, the network finding count is meaningless noise. A malicious extension would show specific domains like query., search., or unknown third-party servers, not generic fetch() detections.

The verdict is clear: this is a legitimate ad blocker extension that triggered the scanner's network detection rules but shows no actual malicious indicators. The findings are artifacts of how the detection system flags basic web API usage, not evidence of harmful behavior.

Key Reasons

• Zero malware signatures detected
• Zero obfuscation findings
• Zero IoC matches despite 26 network findings
• File structure matches legitimate ad blocker functionality
• Network findings are generic fetch() detections with no suspicious domains

False Positive Considerations

• Generic network fetch() detection inflating finding count
• No actual IoC domains extracted despite network activity
• Code-smell and malware rules correctly not triggered

Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 85%.