Is Eclipse Codewind tool for OpenAPI safe to use?

Eclipse Codewind tool for OpenAPI has a security risk score of 63.05/100 (MEDIUM risk). Our security analysis detected 8987 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of Eclipse Codewind tool for OpenAPI?

Based on our automated security analysis, Eclipse Codewind tool for OpenAPI presents medium risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Is "Eclipse Codewind tool for OpenAPI" on VS Code Marketplace Safe to Install?

Verified

IBM · vscode · v0.14.1

Create API clients, server stubs, and HTML documentation from an OpenAPI definition

Risk Assessment

Analyzed

63.05

out of 100

MEDIUM

8987 security findings detected across all analyzers

VS Code extension analyzed via package manifest and static code analysis

Severity Breakdown

Critical

900

High

8080

Medium

Low

Info

Finding Categories

900

Malware Signatures

Network

IoC Indicators

YARA Rules Matched

9 rules(900 hits)

postinstall registry modification postinstall file download postinstall network communication postinstall system command postinstall obfuscation HavingAPermissiveCrossOriginResourceSharingPolicy postinstall file manipulation postinstall environment access postinstall crypto operations

About This Extension

Create API clients, server stubs, and HTML documentation from an OpenAPI definition

Detailed Findings

908 total

YARA Rule Matches

9 rules

Indicators of Compromise

Network indicators, suspicious strings, and potential IoCs extracted during analysis

URLs

IP Addresses

Strings

All Indicators · 92

URL

detected URL: https://github.com/tj/commander.js/issues/995

XIOC detected URL: https://github.com/tj/commander.js/issues/995

extracted_from_files

URL

detected URL: http://google.com',

XIOC detected URL: http://google.com',

extracted_from_files

URL

detected URL: https://registry.npmjs.org/parse5/-/parse5-3.0.3.tgz

XIOC detected URL: https://registry.npmjs.org/parse5/-/parse5-3.0.3.tgz

extracted_from_files

URL

detected URL: http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#preprocessing-the-input-stream)

XIOC detected URL: http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#preprocessing-the-input-stream)

extracted_from_files

URL

detected URL: https://github.com/inikulin/parse5/tree/master/scripts/generate_named_entity_data/README.md)

XIOC detected URL: https://github.com/inikulin/parse5/tree/master/scripts/generate_named_entity_data/README.md)

extracted_from_files

URL

detected URL: http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#tokenizing-character-references)

XIOC detected URL: http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#tokenizing-character-references)

extracted_from_files

URL

detected URL: https://github.com/inikulin/parse5/tree/master/scripts/generate_named_entity_data/README.md

XIOC detected URL: https://github.com/inikulin/parse5/tree/master/scripts/generate_named_entity_data/README.md

extracted_from_files

URL

detected URL: http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#appropriate-end-tag-token)

XIOC detected URL: http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#appropriate-end-tag-token)

extracted_from_files

URL

detected URL: https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/String/fromCharCode#Getting_it_to_work_with_higher_values)

XIOC detected URL: https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/String/fromCharCode#Getting_it_to_work_with_higher_values)

extracted_from_files

URL

detected URL: https://github.com/sindresorhus/path-is-absolute/issues

XIOC detected URL: https://github.com/sindresorhus/path-is-absolute/issues

extracted_from_files

URL

detected URL: https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz

XIOC detected URL: https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/blob/b3fcc245fb25539909ef1d5eaa01dbf92e168633/lib/path.js#L56

XIOC detected URL: https://github.com/nodejs/node/blob/b3fcc245fb25539909ef1d5eaa01dbf92e168633/lib/path.js#L56

extracted_from_files

URL

detected URL: https://github.com/inikulin/parse5

XIOC detected URL: https://github.com/inikulin/parse5

extracted_from_files

URL

detected URL: https://github.com/inikulin/parse5/graphs/contributors

XIOC detected URL: https://github.com/inikulin/parse5/graphs/contributors

extracted_from_files

URL

detected URL: https://github.com/inikulin/parse5/issues

XIOC detected URL: https://github.com/inikulin/parse5/issues

extracted_from_files

URL

detected URL: https://github.com/inikulin

XIOC detected URL: https://github.com/inikulin

extracted_from_files

URL

detected URL: https://github.com/andrewrk/node-pend/issues

XIOC detected URL: https://github.com/andrewrk/node-pend/issues

extracted_from_files

URL

detected URL: https://registry.npmjs.org/pend/-/pend-1.2.0.tgz

XIOC detected URL: https://registry.npmjs.org/pend/-/pend-1.2.0.tgz

extracted_from_files

URL

detected URL: http://nodejs.org/api/path.html#path_path_isabsolute_path).

XIOC detected URL: http://nodejs.org/api/path.html#path_path_isabsolute_path).

extracted_from_files

URL

detected URL: http://nodejs.org/api/path.html#path_path_isabsolute_path)

XIOC detected URL: http://nodejs.org/api/path.html#path_path_isabsolute_path)

extracted_from_files

URL

detected URL: https://travis-ci.org/sindresorhus/path-is-absolute.svg?branch=master)](https://travis-ci.org/sindresorhus/path-is-absolute)

XIOC detected URL: https://travis-ci.org/sindresorhus/path-is-absolute.svg?branch=master)](https://travis-ci.org/sindresorhus/path-is-absolute)

extracted_from_files

URL

detected URL: https://github.com/sindresorhus/path-is-absolute.git

XIOC detected URL: https://github.com/sindresorhus/path-is-absolute.git

extracted_from_files

URL

detected URL: https://github.com/sindresorhus/path-is-absolute#readme

XIOC detected URL: https://github.com/sindresorhus/path-is-absolute#readme

extracted_from_files

URL

detected URL: https://registry.npmjs.org/read/-/read-1.0.7.tgz

XIOC detected URL: https://registry.npmjs.org/read/-/read-1.0.7.tgz

extracted_from_files

URL

detected URL: https://github.com/mafintosh/pump#readme

XIOC detected URL: https://github.com/mafintosh/pump#readme

extracted_from_files

URL

detected URL: https://github.com/mafintosh/pump/issues

XIOC detected URL: https://github.com/mafintosh/pump/issues

extracted_from_files

URL

detected URL: https://registry.npmjs.org/pump/-/pump-3.0.0.tgz

XIOC detected URL: https://registry.npmjs.org/pump/-/pump-3.0.0.tgz

extracted_from_files

URL

detected URL: https://github.com/mafintosh/pumpify)

XIOC detected URL: https://github.com/mafintosh/pumpify)

extracted_from_files

URL

detected URL: http://img.shields.io/travis/mafintosh/pump.svg?style=flat)](http://travis-ci.org/mafintosh/pump)

XIOC detected URL: http://img.shields.io/travis/mafintosh/pump.svg?style=flat)](http://travis-ci.org/mafintosh/pump)

extracted_from_files

URL

detected URL: https://github.com/andrewrk/node-pend#readme

XIOC detected URL: https://github.com/andrewrk/node-pend#readme

extracted_from_files

URL

detected URL: https://travis-ci.com/nodejs/readable-stream.svg?branch=master)](https://travis-ci.com/nodejs/readable-stream)

XIOC detected URL: https://travis-ci.com/nodejs/readable-stream.svg?branch=master)](https://travis-ci.com/nodejs/readable-stream)

extracted_from_files

URL

detected URL: https://github.com/joyent/node

XIOC detected URL: https://github.com/joyent/node

extracted_from_files

URL

detected URL: http://en.wikipedia.org/wiki/Consensus-seeking_decision-making)

XIOC detected URL: http://en.wikipedia.org/wiki/Consensus-seeking_decision-making)

extracted_from_files

URL

detected URL: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md

XIOC detected URL: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md

XIOC detected URL: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md

extracted_from_files

URL

detected URL: https://github.com/isaacs/read#readme

XIOC detected URL: https://github.com/isaacs/read#readme

extracted_from_files

URL

detected URL: https://github.com/isaacs/read/issues

XIOC detected URL: https://github.com/isaacs/read/issues

extracted_from_files

URL

detected URL: https://nodejs.org/en/blog/release/v10.0.0/),

XIOC detected URL: https://nodejs.org/en/blog/release/v10.0.0/),

extracted_from_files

URL

detected URL: https://nodejs.org/en/blog/release/v9.0.0/)

XIOC detected URL: https://nodejs.org/en/blog/release/v9.0.0/)

extracted_from_files

URL

detected URL: http://r.va.gg/2014/06/why-i-dont-use-nodes-core-stream-module.html).

XIOC detected URL: http://r.va.gg/2014/06/why-i-dont-use-nodes-core-stream-module.html).

extracted_from_files

URL

detected URL: https://nodejs.org/dist/v10.19.0/docs/api/stream.html).

XIOC detected URL: https://nodejs.org/dist/v10.19.0/docs/api/stream.html).

extracted_from_files

URL

detected URL: https://saucelabs.com/browser-matrix/readabe-stream.svg)](https://saucelabs.com/u/readabe-stream)

XIOC detected URL: https://saucelabs.com/browser-matrix/readabe-stream.svg)](https://saucelabs.com/u/readabe-stream)

extracted_from_files

URL

detected URL: https://nodei.co/npm-dl/readable-stream.png?&months=6&height=3)](https://nodei.co/npm/readable-stream/)

XIOC detected URL: https://nodei.co/npm-dl/readable-stream.png?&months=6&height=3)](https://nodei.co/npm/readable-stream/)

extracted_from_files

URL

detected URL: https://nodei.co/npm/readable-stream.png?downloads=true&downloadRank=true)](https://nodei.co/npm/readable-stream/)

XIOC detected URL: https://nodei.co/npm/readable-stream.png?downloads=true&downloadRank=true)](https://nodei.co/npm/readable-stream/)

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/18994

XIOC detected URL: https://github.com/nodejs/node/pull/18994

extracted_from_files

URL

detected URL: https://github.com/nodejs/readable-stream/pull/344

XIOC detected URL: https://github.com/nodejs/readable-stream/pull/344

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/15665,

XIOC detected URL: https://github.com/nodejs/node/pull/15665,

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/15042,

XIOC detected URL: https://github.com/nodejs/node/pull/15042,

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/16589,

XIOC detected URL: https://github.com/nodejs/node/pull/16589,

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/13291,

XIOC detected URL: https://github.com/nodejs/node/pull/13291,

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/13310,

XIOC detected URL: https://github.com/nodejs/node/pull/13310,

extracted_from_files

URL

detected URL: https://github.com/calvinmetcalf))

XIOC detected URL: https://github.com/calvinmetcalf))

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/17979

XIOC detected URL: https://github.com/nodejs/node/pull/17979

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/17907

XIOC detected URL: https://github.com/nodejs/node/pull/17907

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/18211

XIOC detected URL: https://github.com/nodejs/node/pull/18211

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/18780

XIOC detected URL: https://github.com/nodejs/node/pull/18780

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/18438

XIOC detected URL: https://github.com/nodejs/node/pull/18438

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/pull/18813

XIOC detected URL: https://github.com/nodejs/node/pull/18813

extracted_from_files

URL

detected URL: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith

XIOC detected URL: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith

extracted_from_files

URL

detected URL: https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js

XIOC detected URL: https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js

extracted_from_files

URL

detected URL: https://saucelabs.com

XIOC detected URL: https://saucelabs.com

extracted_from_files

URL

detected URL: https://github.com/yoshuawuyts))

XIOC detected URL: https://github.com/yoshuawuyts))

extracted_from_files

URL

detected URL: https://github.com/lrlna))

XIOC detected URL: https://github.com/lrlna))

extracted_from_files

URL

detected URL: https://github.com/mcollina))

XIOC detected URL: https://github.com/mcollina))

extracted_from_files

URL

detected URL: https://github.com/mafintosh))

XIOC detected URL: https://github.com/mafintosh))

extracted_from_files

URL

detected URL: https://github.com/nodejs/readable-stream#readme

XIOC detected URL: https://github.com/nodejs/readable-stream#readme

extracted_from_files

URL

detected URL: https://github.com/nodejs/readable-stream/issues

XIOC detected URL: https://github.com/nodejs/readable-stream/issues

extracted_from_files

URL

detected URL: https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.0.tgz

XIOC detected URL: https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.0.tgz

extracted_from_files

URL

detected URL: https://github.com/mafintosh/pump

XIOC detected URL: https://github.com/mafintosh/pump

extracted_from_files

URL

detected URL: https://github.com/mafintosh/end-of-stream

XIOC detected URL: https://github.com/mafintosh/end-of-stream

extracted_from_files

URL

detected URL: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes

XIOC detected URL: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes

extracted_from_files

URL

detected URL: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith

XIOC detected URL: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith

extracted_from_files

URL

detected URL: https://www.npmjs.com/package/buffer-from)

XIOC detected URL: https://www.npmjs.com/package/buffer-from)

extracted_from_files

URL

detected URL: https://www.npmjs.com/package/safer-buffer)

XIOC detected URL: https://www.npmjs.com/package/safer-buffer)

extracted_from_files

URL

detected URL: https://github.com/joyeecheung/node-dep-codemod#dep005)

XIOC detected URL: https://github.com/joyeecheung/node-dep-codemod#dep005)

extracted_from_files

URL

detected URL: https://github.com/nodejs/Release#release-schedule)).

XIOC detected URL: https://github.com/nodejs/Release#release-schedule)).

extracted_from_files

URL

detected URL: https://github.com/chalker/safer-buffer#why-not-safe-buffer)

XIOC detected URL: https://github.com/chalker/safer-buffer#why-not-safe-buffer)

extracted_from_files

URL

detected URL: https://github.com/mysticatea/eslint-plugin-node/blob/master/docs/rules/no-deprecated-api.md)

XIOC detected URL: https://github.com/mysticatea/eslint-plugin-node/blob/master/docs/rules/no-deprecated-api.md)

extracted_from_files

URL

detected URL: https://eslint.org/docs/rules/no-buffer-constructor)

XIOC detected URL: https://eslint.org/docs/rules/no-buffer-constructor)

extracted_from_files

URL

detected URL: https://img.shields.io/npm/v/safer-buffer.svg

XIOC detected URL: https://img.shields.io/npm/v/safer-buffer.svg

extracted_from_files

URL

detected URL: https://travis-ci.org/ChALkeR/safer-buffer

XIOC detected URL: https://travis-ci.org/ChALkeR/safer-buffer

extracted_from_files

URL

detected URL: https://travis-ci.org/ChALkeR/safer-buffer.svg?branch=master

XIOC detected URL: https://travis-ci.org/ChALkeR/safer-buffer.svg?branch=master

extracted_from_files

URL

detected URL: https://github.com/chalker/safer-buffer#why-not-safe-buffer).

XIOC detected URL: https://github.com/chalker/safer-buffer#why-not-safe-buffer).

extracted_from_files

URL

detected URL: https://www.npmjs.com/package/safe-buffer)

XIOC detected URL: https://www.npmjs.com/package/safe-buffer)

extracted_from_files

URL

detected URL: https://ponyfill.com/)

XIOC detected URL: https://ponyfill.com/)

extracted_from_files

URL

detected URL: https://www.npmjs.com/package/buffer-alloc)

XIOC detected URL: https://www.npmjs.com/package/buffer-alloc)

extracted_from_files

URL

detected URL: https://www.npmjs.com/package/safe-buffer'

XIOC detected URL: https://www.npmjs.com/package/safe-buffer'

extracted_from_files

URL

detected URL: https://standardjs.com)

XIOC detected URL: https://standardjs.com)

extracted_from_files

URL

detected URL: https://npmjs.com/safe-buffer)?

XIOC detected URL: https://npmjs.com/safe-buffer)?

extracted_from_files

URL

detected URL: https://github.com/ChALkeR/safer-buffer/blob/master/Porting-Buffer.md)

XIOC detected URL: https://github.com/ChALkeR/safer-buffer/blob/master/Porting-Buffer.md)

extracted_from_files

URL

detected URL: https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md

XIOC detected URL: https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md

extracted_from_files

URL

detected URL: https://img.shields.io/badge/Security-Responsible%20Disclosure-green.svg

XIOC detected URL: https://img.shields.io/badge/Security-Responsible%20Disclosure-green.svg

extracted_from_files

Security Analysis Summary

Security Analysis Overview

Eclipse Codewind tool for OpenAPI is a Visual Studio Code Marketplace extension published by IBM. Version 0.14.1 has been analyzed by the Risky Plugins security platform, receiving a risk score of 63.05/100 (MEDIUM risk) based on 8987 security findings.

Risk Assessment

This extension presents high security risk. Significant concerns were identified during analysis. It is not recommended for use in sensitive or production environments without thorough review.

Findings Breakdown

High: 900 finding(s)
Medium: 8080 finding(s)
Low: 7 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

Malware Detection: YARA rule matching against 2,400+ malware signatures
Secret Detection: Scanning for exposed API keys, tokens, and credentials
Static Analysis: Code-level security analysis for common vulnerability patterns
Network Analysis: Detection of suspicious network communications and endpoints
Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

Eclipse Codewind tool for OpenAPI is published by IBM on the Visual Studio Code Marketplace marketplace. The extension has approximately 12K users.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

compiledcodecoverage

IBM

CRITICAL 967 users

watsonx Code Assistant

IBM

CRITICAL 47K users

IBM CICS Interdependency Analyzer for Zowe Explorer

IBM

CRITICAL 868 users

Db2 Connect

IBM

CRITICAL 31K users

Spark Labs - IBM Analytics Engine

IBM

CRITICAL 431 users

zopendebug

IBM

CRITICAL 12K users

Risk Assessment

Severity Breakdown

Finding Categories

YARA Rules Matched

About This Extension

Detailed Findings

NET-FETCH-extension/node_modules/htmlparser2/lib/FeedHandler.js-19

NET-FETCH-extension/node_modules/htmlparser2/lib/FeedHandler.js-54

NET-FETCH-extension/node_modules/htmlparser2/lib/FeedHandler.js-85

NET-FETCH-extension/node_modules/htmlparser2/lib/FeedHandler.js-101

NET-SOCKET_IO-extension/node_modules/lodash/lodash.min.js-75

NET-FETCH-extension/node_modules/htmlparser2/lib/FeedHandler.js-73

NET-FETCH-extension/node_modules/htmlparser2/lib/FeedHandler.js-71

NET-FETCH-extension/node_modules/htmlparser2/lib/FeedHandler.js-26

YARA Rule Matches

postinstall registry modification

postinstall file download

postinstall network communication

postinstall system command

postinstall obfuscation

HavingAPermissiveCrossOriginResourceSharingPolicy

postinstall file manipulation

postinstall environment access

postinstall crypto operations

Indicators of Compromise

All Indicators · 92

Security Analysis Summary

Security Analysis Overview

Risk Assessment

Findings Breakdown

What Was Analyzed

Developer Information

Recommendation

Frequently Asked Questions

Similar Extensions

compiledcodecoverage

watsonx Code Assistant

IBM CICS Interdependency Analyzer for Zowe Explorer

Db2 Connect

Spark Labs - IBM Analytics Engine

zopendebug