Godot Support
The AI review rates the findings as likely false positive, but the risk score (53/100) still counts them.
Analysis record
- Analysed
- 3 days ago
- Version
- v2024.1.171
- Artifact
- SHA256 DF6…219
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
13 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall network communication | 19 | LICENSE.mdout/lsp/NativeDocumentManager.jsout/lsp/MessageIO.js +15 more | - |
| LOW | postinstall crypto operations | 7 | syntaxes/GDScript.tmLanguage.json.github/ISSUE_TEMPLATE/feature_request.ymlrider-godot/dotnet/JetBrains.ReSharper.Plugins.Godot.pdb +4 more | - |
| LOW | UsingShellInterpreterWhenExecutingOSCommands | 1 | out/debugger/server_controller.js | - |
| LOW | postinstall system command | 17 | package.jsonrider-godot/dotnet/GodotTools.IdeMessaging.pdbrider-godot/bundles/godot-tools/[Content_Types].xml +14 more | - |
| LOW | postinstall file manipulation | 10 | out/debugger/debug_runtime.jsout/lsp/NativeDocumentManager.jsdist/extension.js +6 more | - |
| LOW | JavaDropper | 1 | rider-godot/lib/rider-godot-2024.1.171.jar | - |
| LOW | postinstall environment access | 2 | syntaxes/examples/gdscript1.gdresources/hashes | - |
| LOW | NoUseSocketManually | 1 | out/lsp/MessageIO.js | - |
| LOW | postinstall registry modification | 2 | rider-godot/dotnetDebuggerWorker/JetBrains.ReSharper.Plugins.Godot.Rider.Debugger.pdbrider-godot/dotnet/JetBrains.ReSharper.Plugins.Godot.pdb | - |
| LOW | postinstall obfuscation | 7 | out/debugger/server_controller.jsout/debugger/debug_session.jsrider-godot/dotnetDebuggerWorker/JetBrains.ReSharper.Plugins.Godot.Rider.Debugger.pdb +4 more | - |
| LOW | postinstall file download | 5 | README.mdrider-godot/dotnet/JetBrains.ReSharper.Plugins.Godot.pdbout/deps/prism/prism.js +1 more | - |
| LOW | credential env files | 5 | rider-godot/dotnetDebuggerWorker/JetBrains.ReSharper.Plugins.Godot.Rider.Debugger.pdbout/godot-tools.jsdist/extension.js +2 more | - |
| LOW | DebuggerStatementsShouldNotBeUsed | 10 | rider-godot/bundles/godot-tools/extension.vsixmanifestCHANGELOG.mdpackage.json +7 more | - |
Publisher Evidence
HighJetBrains
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
12 evidence rows available.
Finding Categories
YARA Rules Matched
13 rules(87 hits)AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality strong.
This extension is published by JetBrains s.r.o., a well-established IDE vendor, on the official JetBrains marketplace with 76,390 users. The extension provides Godot game engine support for the Rider IDE, which justifies its access patterns.
The two network findings are both websocket connections in expected locations. The finding NET-WEBSOCKET-rider-godot/bundles/godot-tools/extension/out/lsp/MessageIO.js-59 is in the Language Server Protocol (LSP) communication layer at rider-godot/bundles/godot-tools/extension/out/lsp/MessageIO.js:59. LSP is the industry-standard protocol for language servers, and websocket communication is the expected transport mechanism. The second finding NET-WEBSOCKET-rider-godot/bundles/godot-tools/extension/node_modules/ws/lib/websocket-server.js-359 is in a bundled dependency—the ws library at rider-godot/bundles/godot-tools/extension/node_modules/ws/lib/websocket-server.js:359. This is a standard Node.js websocket library, not suspicious code.
The remaining 417 findings are all metadata hashes of resource files. Examples include icon files like rider-godot/bundles/godot-tools/extension/resources/dark/icon_soft_body.svg and configuration files like rider-godot/bundles/godot-files/extension/lang.config-definition/config-definition.code-snippets. These are benign file integrity hashes, not security concerns.
Zero malware signatures matched. Zero obfuscation findings were detected. Zero credential-access or secret findings exist. Zero code-smell findings were flagged. The threat indicators show no IOC matches, no malware signatures, and no tool-poisoning indicators.
The strongest counterargument to this verdict is the total finding count of 419, which might suggest extensive suspicious activity to an automated system. However, the nature of these findings is entirely benign: 417 are metadata hashes of icons and documentation, and 2 are standard LSP websocket connections. Finding volume does not indicate malicious intent when the findings themselves are expected behaviors for a language support extension.
The extension's filesystem access is justified by its purpose: providing Godot language support requires reading project files and communicating with a language server. The process execution (websocket communication) is justified by the LSP architecture. No credential-access findings target actual secrets like .env files, SSH keys, or cloud credentials—there are no credential findings at all.
This is a legitimate development tool from a verified publisher with expected behavior patterns for an IDE language extension.
Key Reasons
- Published by verified JetBrains s.r.o. on official marketplace
- Zero malware signatures, obfuscation, or credential findings
- Websocket findings are standard LSP communication in MessageIO.js
- All 417 info findings are benign metadata hashes of icons and config files
- 76,390 users indicates established, trusted extension
False Positive Considerations
- Metadata hashes of resource files counted as findings
- LSP websocket communication flagged as network activity
- Bundled ws library triggering network detection
Reviewed 2026-05-23; recommended action: no action; model confidence 95%.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace