AWS Lab Maker
The AI review rates the findings as likely false positive, but the risk score (63/100) still counts them.
Analysis record
- Analysed
- 2 days ago
- Version
- v1.10.0
- Artifact
- SHA256 1EE…5F1
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
13 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall file download | 9 | chunks/useSubtitles-BjVjlhb_.jscontent-scripts/cont-lxp.jscontent-scripts/cont-crossDomainIframe.js +6 more | - |
| LOW | SQLInjection | 2 | chunks/sidepanel-B-iGqOBO.jschunks/router-CBjLuYWs.js | - |
| LOW | NoUseWeakRandom | 9 | chunks/useSubtitles-BjVjlhb_.jscontent-scripts/cont-lxp.jscontent-scripts/cont-crossDomainIframe.js +6 more | - |
| LOW | postinstall obfuscation | 8 | chunks/router-CBjLuYWs.jschunks/useSubtitles-BjVjlhb_.jscontent-scripts/cont-crossDomainIframe.js +5 more | - |
| LOW | postinstall crypto operations | 5 | chunks/useSubtitles-BjVjlhb_.jsbackground.jschunks/sidepanel-B-iGqOBO.js +2 more | - |
| LOW | postinstall file manipulation | 11 | chunks/useSubtitles-BjVjlhb_.jsbackground.jscontent-scripts/cont-skillbuilder.js +8 more | - |
| LOW | postinstall network communication | 11 | assets/router-DXzkWygP.cssmanifest.jsonbackground.js +8 more | - |
| LOW | postinstall environment access | 2 | chunks/sidepanel-B-iGqOBO.jschunks/video-player-CHqjTCSb.js | - |
| LOW | postinstall registry modification | 2 | chunks/useSubtitles-BjVjlhb_.jschunks/router-CBjLuYWs.js | - |
| LOW | postinstall system command | 8 | chunks/useSubtitles-BjVjlhb_.jscontent-scripts/cont-crossDomainIframe.jscontent-scripts/cont-aws.js +5 more | - |
| LOW | OriginsNotVerified | 2 | chunks/router-CBjLuYWs.jsbackground.js | - |
| LOW | credential env files | 3 | chunks/useSubtitles-BjVjlhb_.jsbackground.jschunks/router-CBjLuYWs.js | - |
| LOW | postinstall persistence mechanism | 7 | chunks/useSubtitles-BjVjlhb_.jscontent-scripts/cont-crossDomainIframe.jscontent-scripts/cont-aws.js +4 more | - |
Publisher Evidence
LowAWS
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Firefox does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
13 rules(79 hits)Requested Permissions
17 permissionsAccess your identity and sign-in tokens
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The extension 'AWS Lab Maker' has a high number of IoC findings, with 600 medium-severity IoC findings detected by XIOC. However, upon closer inspection, these findings appear to be related to the extension's functionality, which involves generating personalized hands-on labs for AWS services with AI-powered guidance. The network findings, such as 'NET-SOCKET_IO-chunks/router-CS1mzAfL.js-1' and 'NET-FETCH-chunks/useSubtitles-D9vAI-Yh.js-312', suggest that the extension is making network calls to facilitate its functionality. Despite the high number of IoC findings, there is no evidence of malicious behavior, such as malware signatures or obfuscation. A potential counterargument to this verdict could be that the extension's lack of developer name and high number of IoC findings could indicate a potential security risk. However, given the extension's functionality and the nature of the findings, it is likely that the findings are related to the extension's legitimate functionality. Therefore, the verdict is likely_false_positive.
Key Reasons
- High number of IoC findings related to extension functionality
- No evidence of malicious behavior, such as malware signatures or obfuscation
- Network findings suggest legitimate functionality
False Positive Considerations
- IoC extractor garbage
- High finding count driven by XIOC extractor
Reviewed 2026-05-31; recommended action: suppress false positive; model confidence 80%.
Firefox version history
Risk trend by version
11 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace