Abbenay Provider

AI Security Review

Evidence context: threat category none; evidence quality moderate.

abbenay-provider is Red Hat's bring-your-own-model AI assistant for VS Code, mirrored on OpenVSX with roughly 5,800 users. Its job is to send editor context to a model provider and stream the answer into a chat panel, so outbound HTTP and a bundled chat UI are the product rather than a side effect. The three network findings land in exactly the files that job requires: NET-FETCH-extension/out/extension.js-8 in the extension entry point, and two NET-SOCKET_IO hits in extension/out/webview-ui/chat/main.js, the webview that renders the conversation.

Nothing here shows a postinstall or activation-time payload. There are no malware signatures, no tool-poisoning hits, and no secret-access findings, so no .env file, .git/config, .ssh directory or cloud credential store is being read. The 1,393 IoC entries are extractor noise; the endpoint list they generated holds obvious fragments from minified JavaScript such as a27.google, address.host, accordion-section.open and anthropic.computer, sitting next to generic infrastructure like amazonaws.com. A string shaped like a property access chain or a CSS selector is not a destination the extension contacts.

The two obfuscation findings are build artifacts. OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/keytar.node is a compiled Node addon, and keytar is the standard open source package authors use to keep API keys in the operating system keychain instead of a settings file. A scanner cannot read compiled bytes, so it labels the binary itself as obfuscation; the finding describes the file format, not hidden behavior. OBFUSCATION-FROMCHARCODE_BULK-extension/out/extension.js-5 comes from the bundled, minified output in out/, which is how extensions ship after a webpack or esbuild pass.

Filesystem and process access matches this class of tool and goes no further. The manifest declares no permissions and no host permissions. Reading workspace files to build model context, and storing and reading back the user's own provider API key through keytar, are the only capabilities that matter, and both are the stated function of a Copilot alternative. The 68 code-smell entries and 7 dependency entries are the usual bundled-library background.

The strongest argument against this verdict is that keytar.node is unreadable native code: if someone had tampered with that binary, a source-level review would miss it. That argument would carry weight if the extension came from an unknown publisher with a thin listing, but this is a Red Hat release with a matching store page and an active user base, the bundled keytar path matches the official npm module, and nothing else in the package shells out, downloads code at install time, or reaches for credentials beyond the keychain. The open question sits in a well known dependency, not in the extension's own logic.

Key Reasons

• Network findings are the extension's stated function: NET-FETCH-extension/out/extension.js-8 and two NET-SOCKET_IO hits in extension/out/webview-ui/chat/main.js serve the LLM chat client.
• OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/keytar.node is the standard npm keychain module shipped as compiled code, which scanners cannot read and flag by default.
• OBFUSCATION-FROMCHARCODE_BULK-extension/out/extension.js-5 is webpack/esbuild output, not intentional hiding.
• No malware signatures, no secret-access findings, no tool-poisoning hits, and no postinstall or activation-time execution.
• The 1,393 IoC entries include property-chain and CSS-selector fragments such as address.host and accordion-section.open, which are extraction noise.

False Positive Considerations

• IoC extractor fragments misread as domains (a27.google, address.host, accordion-section.open) from minified webview JavaScript
• keytar.node native binary addon flagged as obfuscation, describing file format rather than behavior
• FROMCHARCODE_BULK match on minified extension/out/extension.js build output
• Code-smell and dependency counts inflated by hundreds of bundled libraries in out/

Reviewed 2026-09-29; recommended action: no action; model confidence 85%.