YesCaptcha assistant

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The YesCaptcha assistant extension claims to automatically solve reCaptcha/hCaptcha challenges. Analysis of the evidence reveals that all 59 findings stem from known false-positive patterns rather than actual malware.

The malware-signature findings in /tmp/extract-6dbc17162d8b5061f871d394e568c5578542e9487c45ba8a6cda20c4fc012e7a-2709301808/background.js are exclusively postinstall_* YARA rules (postinstall_obfuscation, postinstall_file_manipulation, postinstall_network_communication, postinstall_system_command, postinstall_persistence_mechanism). According to CVEQ's documented false-positive patterns, these rules match basic Node.js patterns like fetch, exec, fs, crypto, and process.env — they are classified as code-smell and should never drive a verdict. The findings_summary confirms this: 58 of 59 findings are categorized as code-smell, while actual malware-signature, malware, and ioc counts are all zero.

The only substantive finding is MANIFEST-SENSITIVE-PERM-<ALL_URLS> in manifest.json, which grants broad URL access. This permission is functionally necessary for a captcha solver that must operate across all websites. While broad permissions warrant scrutiny, the permission alone does not indicate malicious intent.

No suspicious network domains appear in the IoC findings (count is 0). No obfuscation findings exist (count is 0). No actual malware signatures were detected (the malware-signature category in findings_by_category contains only code-smell misclassifications). The extension has no developer attribution and a low user count of 125, which are risk factors, but they do not constitute evidence of malicious behavior.

The strongest counterargument is that the findings are labeled severity "high" and the extension is anonymous. However, the threat model explicitly states that code-smell findings (severity=low or high, finding_type=code-smell) are NOISE and should not drive verdicts. The high severity labels on postinstall_* rules are a known scoring artifact, not an indicator of actual threat. Without suspicious domains, actual malware signatures, or obfuscation, the high finding count is purely driven by false-positive YARA rules.

This extension performs its stated function (captcha solving) which may violate service terms but does not constitute security malware. The findings are inflated by known false-positive patterns.

Key Reasons

• All findings are code-smell from postinstall_* YARA rules
• Zero actual malware signatures or suspicious IoCs detected
• No obfuscation findings present
• Extension performs stated function without evidence of malicious behavior

False Positive Considerations

• postinstall_* YARA rules matching basic Node.js patterns
• code-smell findings misclassified as malware-signature
• high finding count from known false-positive patterns
• severity inflation on code-smell detections

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 85%.