Based on the RiskyPlugins AI security review of the observed evidence.
No individual score drivers were recorded for this analysis.
Analysis record
- Analysed
- 2 weeks ago
- Version
- v1.4.7.0
- Artifact
- SHA256 BF6…229
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
11 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall crypto operations | 2 | ext/highlightjs/index.jsext/marked/index.js | - |
| LOW | postinstall network communication | 10 | LICENSE.txtext/wireloom/LICENSE.txtext/highlightjs/styles/dark-theme.LICENSE.txt +7 more | - |
| LOW | postinstall file manipulation | 5 | ext/wireloom/index.jsext/highlightjs/index.jsext/marked/index.js +2 more | - |
| LOW | postinstall system command | 11 | filters.sample.inistyle-dark-v202609.cssstyle-v202609.css +8 more | - |
| LOW | postinstall environment access | 1 | ReleaseNotes.txt | - |
| LOW | postinstall obfuscation | 6 | ext/wireloom/index.jsext/highlightjs/index.jsstyle-v202609.css +3 more | - |
| LOW | postinstall registry modification | 2 | ReleaseNotes.txtext/highlightjs/index.js | - |
| LOW | DebuggerStatementsShouldNotBeUsed | 1 | ext/highlightjs/index.js | - |
| LOW | postinstall file download | 1 | ext/highlightjs/index.js | - |
| LOW | SQLInjection | 1 | ext/highlightjs/index.js | - |
| LOW | credential env files | 1 | ext/highlightjs/index.js | - |
Finding Categories
YARA Rules Matched
11 rules(41 hits)AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality strong.
The extension’s purpose is to render HTML, Markdown, and AsciiDoc inside a Notepad++ WebView2 pane. The only filesystem access reported is reading its own bundled files (e.g., the extracted_from_files placeholder) to locate documentation URLs – this matches the extension’s rendering role and does not indicate unrelated file traversal. No process‑spawning findings appear, so there is no unjustified execution of external tools.
Credential‑related findings are absent; the secret category is empty and no .env, .ssh, or cloud‑credential files are referenced. All IoC entries are URLs or domains such as https://github.com/rdipardo/npp_preview/issues/4, www.gnu.org, and fossil.2of4.net. These point to the extension’s own issue tracker, GNU licensing pages, and a public fossil hosting site, all of which are typical reference links embedded in README or help content. None of the IoC items represent command‑and‑control servers or data‑exfiltration endpoints.
A possible counterargument is the volume of IoC matches (over sixty) which might look suspicious. However, the XIOC extractor is known to flag every literal URL in source files, and the list consists exclusively of benign project‑related links. The presence of a single low‑severity obfuscation flag is attributed to minified bundle code generated for the WebView, which is common for UI assets and not an indication of hidden payloads. Consequently, the high count does not alter the benign assessment.
Key Reasons
- All filesystem reads are limited to the extension’s own resources
- No credential‑access findings were identified
- IoC entries are only public project URLs and licensing sites
- No process execution or network exfiltration code detected
False Positive Considerations
- IoC extractor generic URL matches
- Bundled documentation links
- Minified UI assets triggering obfuscation rule
Reviewed 2026-05-31; recommended action: no action; model confidence 88%.
Notepad++ version history
Risk trend by version
3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace