Preview HTML

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This Notepad++ extension provides HTML preview functionality using WebView2 embedded browser technology. The extension's stated purpose—previewing HTML, Markdown, and AsciiDoc files rendered as HTML—justifies the presence of a native DLL component (PreviewHTML.dll) that handles the rendering functionality.

Filesystem/Process Access Assessment: The findings show no evidence of suspicious filesystem or process access. The metadata findings are limited to standard files: 3RD-PARTY/COPYING.FPC, 3RD-PARTY/WebView4Delphi/LICENSE, style-dark.css, style.css, LICENSE.txt, 3RD-PARTY/COPYING, ReleaseNotes.txt, and filters.sample.ini. These are all expected configuration and documentation files for a Notepad++ plugin. No findings indicate credential access, secret reads, or workspace file enumeration beyond what the extension's preview functionality requires.

Credential Access Findings: There are zero secret-related findings. The findings_summary shows "secret":"0" and "code-smell":"0". No evidence indicates the extension targets .env files, SSH keys, cloud credentials, or VS Code secret storage.

The Critical Obfuscation Finding: The only security-relevant finding is OBFUSCATION-supply_chain_binary on PreviewHTML.dll. This finding type alone does not confirm malicious intent. For Notepad++ plugins, the main DLL often contains compiled Delphi/Pascal code (indicated by the WebView4Delphi licensing file) that may trigger obfuscation patterns due to legitimate binary packing, compiler optimizations, or bundled WebView2 components. Crucially, this finding is not accompanied by malware signatures ("malware-signature":"0"), IoC hits ("ioc":"0"), network activity ("network":"0"), or tool-poisoning indicators ("tool-poisoning":"0").

Strongest Counterargument: The critical severity of the obfuscation finding combined with zero user count could indicate a newly malicious supply chain attack. However, this counterargument fails because the absence of malware signatures, network findings, and credential theft patterns strongly suggests the obfuscation is from legitimate binary packaging rather than malicious code hiding. If this were truly malicious, we would expect at least one malware signature match or suspicious network domain in the IoC findings.

Conclusion: The single obfuscation finding without corroborating threat indicators represents a false positive from legitimate binary compilation. The extension performs its stated preview functionality without evidence of malicious behavior.

Key Reasons

• No malware signatures matched
• No IoC or network findings present
• Obfuscation finding lacks corroborating threat indicators
• Extension structure matches legitimate Notepad++ plugin patterns

False Positive Considerations

• Obfuscation finding on compiled DLL without malware signatures
• No IoC or network findings to support malicious intent
• Standard Notepad++ plugin structure with expected metadata files
• WebView2/Delphi binary compilation patterns triggering obfuscation rules

Reviewed 2026-05-31; recommended action: suppress false positive; model confidence 75%.