Baidu Comate

AI Security Review

Evidence context: threat category unknown malware; evidence quality moderate.

Baidu Comate is a JetBrains IDE extension with over 530k users. The extension declares no special permissions in the marketplace manifest, but the bundled code reveals extensive network access and file I/O typical of an AI assistant plugin that communicates with remote services.

The most concerning finding is the YARA--CAP_HookExKeylogger signature in /comate-intellij-plugin/lib/jna-platform-5.6.0.jar:11585. This is a false positive. The signature triggers on jna-platform, a standard Java Native Access library used for cross-platform native function calls. JNA is widely used in legitimate Java applications and carries no intrinsic keylogging capability. The JetBrains marketplace would not permit a keylogger to distribute publicly at this scale.

Network activity appears in minified plugin code: axios and fetch calls in comate-agent/bin/comate-kernel/plugins/demo-feature/dist/index.js, socket.io in the f2c plugin, and git integration in git plugin. These are found at lines 22152, 25387, 25383, 25371, 25367, 25358, 25333 and others. The presence of network calls in a plugin designed to provide AI-powered code suggestions is expected. The bundled JavaScript is minified (webpack/esbuild output), which creates noise: each of the dozens of npm packages included in dist/ files triggers its own network findings.

Obfuscation flags on comate-agent/bin/comate-kernel/server.js (OBFUSCATION-unicode_heavy, OBFUSCATION-function_indirect) are consistent with minified source code, not deliberate obfuscation intended to hide malicious logic. Minification is standard practice in Node.js/browser builds.

The IoC count (3128 total) is high but misleading. The vast majority are false positives from IoC extraction on minified code: property chains misread as domains, hex substrings from compressed syntax misidentified as IPv6 fragments. The network_endpoints list includes filenames like 2026-07-06-ducc-skill-approval-no-button.md and markdown paths, which are not actual external endpoints but noise from the extraction process.

The strongest counterargument is that the plugin runs on JetBrains infrastructure with 530k users and version 4.14.3 indicates a mature, actively maintained project. However, the obfuscation findings combined with the keylogger signature and bundled network code create enough uncertainty to warrant runtime behavior analysis before full confidence can be established. The finding nature does not indicate confirmed malicious intent, but the bundled complexity makes it difficult to rule out unintended data access.

Key Reasons

• YARA--CAP_HookExKeylogger signature detected in jna-platform-5.6.0.jar, a legitimate JNA library often misidentified by broad YARA rules
• Network activity (axios, fetch, socket.io) found in minified dist/ plugin bundles (demo-feature, git, f2c, dev-tools), consistent with bundled dependencies
• OBFUSCATION-unicode_heavy and OBFUSCATION-function_indirect in server.js; likely minified output, not intentional obfuscation
• Large IoC count (3128) but mostly false positives from minified code and bundled npm packages
• 530k users and JetBrains marketplace presence suggest some legitimate distribution, but findings require verification

False Positive Considerations

• YARA rule CAP_HookExKeylogger fires on jna-platform library, a standard Java FFI dependency—not malware
• Network findings in dist/ files from webpack/esbuild bundled code, not source-level malicious activity
• Obfuscation findings match minified JavaScript output pattern (server.js, bundled plugins), not deliberate obfuscation
• IoC volume inflated by CDN and package manager domains in bundled dependencies

Reviewed 2026-09-29; recommended action: runtime analysis; model confidence 62%.