OMICall

AI Security Review

Evidence context: threat category none; evidence quality strong.

OMICall is a VoIP call extension with 672 users and developer attribution to [email protected]. The evidence bundle contains exactly 2 findings, both network-type detections with medium severity.

The first finding, titled "NET-FETCH-thirdparty/pancake.js-1", triggers on thirdparty/pancake.js:1. The second finding, titled "NET-FETCH-thirdparty/hubspot.js-1", triggers on thirdparty/hubspot.js:1. Both findings report generic "Network call of type 'fetch' detected" without identifying specific domains or suspicious endpoints.

These files are located in a "thirdparty" directory, which is standard practice for bundling external SDKs and dependencies. HubSpot is a well-known CRM and marketing automation platform with legitimate JavaScript SDKs used for analytics and lead tracking. Pancake is a recognized analytics and conversion tracking service. The presence of fetch calls in these files is expected behavior for analytics SDKs that transmit user interaction data to their respective services.

Critically, the findings summary shows zero malware signatures, zero obfuscation findings, zero IoC findings, and zero code-smell findings. There are no suspicious domains extracted from the code, no credential access patterns, no browser hijacking indicators, and no typosquatting evidence. The extension name "OMICall" does not mimic any popular extension, and the description "Add VoIP call features to any websites" is consistent with legitimate functionality.

The strongest counterargument would be that network fetch calls in any extension could theoretically exfiltrate user data to unknown destinations. However, this argument fails because: (1) the files are explicitly named after known legitimate services (HubSpot, Pancake), not obfuscated or suspicious names; (2) the findings do not reveal any specific suspicious domains—only that fetch calls exist; (3) there is zero obfuscation to hide malicious payloads; (4) there are zero malware signatures; and (5) the developer email indicates a legitimate software company rather than an anonymous publisher. If these were malicious exfiltration channels, we would expect to see obfuscation, suspicious domain IoCs, or malware signatures alongside the network calls.

This extension exhibits the classic pattern of bundled third-party dependencies triggering network findings. The finding count is low (2), the nature of findings is benign (fetch calls in known SDKs), and there is no corroborating evidence of malicious intent. The verdict is likely_false_positive with a recommended action of suppress_false_positive.

Key Reasons

• Findings limited to fetch calls in thirdparty/ directory
• Files named after legitimate services (HubSpot, Pancake)
• Zero malware signatures and zero obfuscation findings
• No suspicious domains in IoC extraction
• Developer attribution present with legitimate email domain

False Positive Considerations

• Third-party SDK files in thirdparty/ directory
• Legitimate service SDKs (HubSpot, Pancake)
• Generic fetch call detection without domain specificity
• Bundled dependency pattern

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 88%.